diff --git a/src/default/analytic_stories.conf b/src/default/analytic_stories.conf index 55b6a6bee0..adac6d7a16 100644 --- a/src/default/analytic_stories.conf +++ b/src/default/analytic_stories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security-content -# On Date: 2019-04-26T19:56:35 UTC +# On Date: 2019-04-29T21:24:59 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -271,9 +271,9 @@ support_searches = [] data_models = ["Certificates", "Network_Resolution", "Web"] providing_technologies = ["Bro", "Censys", "Splunk Stream"] description = Detect DNS and web requests to fake websites generated by the EvilGinx2 toolkit. These websites are designed to fool unwitting users who have clicked on a malicious link in a phishing email. -narrative = As most people know, these emails use fraudulent domains, email scraping (see https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), familiar contact names inserted as senders, and other tactics to lure targets into clicking a malicious link, opening an attachment with a nefarious payload (see https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), or entering sensitive personal information that perpetrators may intercept. This attack technique requires a relatively low level of skill and allows adversaries to easily cast a wide net. Because phishing is a technique that relies on human psychology, you will never be able to eliminate this vulnerability 100%. But you can use automated detection to significantly reduce the risks.\ +narrative = As most people know, these emails use fraudulent domains, [email scraping](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), familiar contact names inserted as senders, and other tactics to lure targets into clicking a malicious link, opening an attachment with a [nefarious payload](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), or entering sensitive personal information that perpetrators may intercept. This attack technique requires a relatively low level of skill and allows adversaries to easily cast a wide net. Because phishing is a technique that relies on human psychology, you will never be able to eliminate this vulnerability 100%. But you can use automated detection to significantly reduce the risks.\ \ -This Analytic Story focuses on detecting signs of MiTM attacks enabled by EvilGinx (see https://github.com/kgretzky/evilginx2), a toolkit that sets up a transparent proxy between the targeted site and the user. In this way, the attacker is able to intercept credentials and two-factor identification tokens. It employs a proxy template to allow a registered domain to impersonate targeted sites, such as Linkedin, Amazon, Okta, Github, Twitter, Instagram, Reddit, Office 365, and others. It can even register SSL certificates and camouflage them via a URL shortener, making them difficult to detect. Searches in this story look for signs of MiTM attacks enabled by EvilGinx2. +This Analytic Story focuses on detecting signs of MiTM attacks enabled by [EvilGinx2](https://github.com/kgretzky/evilginx2), a toolkit that sets up a transparent proxy between the targeted site and the user. In this way, the attacker is able to intercept credentials and two-factor identification tokens. It employs a proxy template to allow a registered domain to impersonate targeted sites, such as Linkedin, Amazon, Okta, Github, Twitter, Instagram, Reddit, Office 365, and others. It can even register SSL certificates and camouflage them via a URL shortener, making them difficult to detect. Searches in this story look for signs of MiTM attacks enabled by EvilGinx2. [Credential Dumping] category = "Adversary Tactics" @@ -685,19 +685,19 @@ support_searches = [] data_models = ["Endpoint"] providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon", "Tanium", "Ziften"] description = Detect signs of malicious payloads that may indicate that your environment has been breached via a phishing attack. -narrative = Despite its simplicity, phishing remains the most pervasive and dangerous cyberthreat. In fact, research shows that as many as 91% of all successful attacks (see https://digitalguardian.com/blog/91-percent-cyber-attacks-start-phishing-email-heres-how-protect-against-phishing) are initiated via a phishing email. \ +narrative = Despite its simplicity, phishing remains the most pervasive and dangerous cyberthreat. In fact, research shows that as many as [91% of all successful attacks](https://digitalguardian.com/blog/91-percent-cyber-attacks-start-phishing-email-heres-how-protect-against-phishing) are initiated via a phishing email. \ \ -As most people know, these emails use fraudulent domains, email scraping (see https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), familiar contact names inserted as senders, and other tactics to lure targets into clicking a malicious link, opening an attachment with a nefarious payload (see https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), or entering sensitive personal information that perpetrators may intercept. This attack technique requires a relatively low level of skill and allows adversaries to easily cast a wide net. Worse, because its success relies on the gullibility of humans, it's impossible to completely "automate" it out of your environment. However, you can use ES and ESCU to detect and investigate potentially malicious payloads injected into your environment subsequent to a phishing attack. \ +As most people know, these emails use fraudulent domains, [email scraping](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), familiar contact names inserted as senders, and other tactics to lure targets into clicking a malicious link, opening an attachment with a [nefarious payload](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), or entering sensitive personal information that perpetrators may intercept. This attack technique requires a relatively low level of skill and allows adversaries to easily cast a wide net. Worse, because its success relies on the gullibility of humans, it's impossible to completely "automate" it out of your environment. However, you can use ES and ESCU to detect and investigate potentially malicious payloads injected into your environment subsequent to a phishing attack. \ \ While any kind of file may contain a malicious payload, some are more likely to be perceived as benign (and thus more often escape notice) by the average victim—especially when the attacker sends an email that seems to be from one of their contacts. An example is Microsoft Office files. Most corporate users are familiar with documents with the following suffixes: .doc/.docx (MS Word), .xls/.xlsx (MS Excel), and .ppt/.pptx (MS PowerPoint), so they may click without a second thought, slashing a hole in their organizations' security. \ \ -Following is a typical series of events, according to an article by Trend Micro (see https://blog.trendmicro.com/trendlabs-security-intelligence/rising-trend-attackers-using-lnk-files-download-malware/):\ +Following is a typical series of events, according to an [article by Trend Micro](https://blog.trendmicro.com/trendlabs-security-intelligence/rising-trend-attackers-using-lnk-files-download-malware/):\ \ 1. Attacker sends a phishing email. Recipient downloads the attached file, which is typically a .docx or .zip file with an embedded .lnk file\ \ 1. The .lnk file executes a PowerShell script\ \ -1. Powershell executes a reverse shell, rendering the exploit successful As a side note, adversaries are likely to use a tool like Empire to craft and obfuscate payloads and their post-injection activities, such as exfiltration, lateral movement, and persistence. (see https://github.com/EmpireProject/Empire)\ +1. Powershell executes a reverse shell, rendering the exploit successful As a side note, adversaries are likely to use a tool like Empire to craft and obfuscate payloads and their post-injection activities, such as [exfiltration, lateral movement, and persistence](https://github.com/EmpireProject/Empire).\ \ This Analytic Story focuses on detecting signs that a malicious payload has been injected into your environment. For example, one search detects outlook.exe writing a .zip file. Another looks for suspicious .lnk files launching processes. diff --git a/src/default/savedsearches.conf b/src/default/savedsearches.conf index e54dbe9d33..94a1b3a667 100644 --- a/src/default/savedsearches.conf +++ b/src/default/savedsearches.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security-content -# On Date: 2019-04-26T19:56:35 UTC +# On Date: 2019-04-29T21:24:59 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -2009,7 +2009,7 @@ action.escu.enabled = 1 description = This search looks for execution of process `outlook.exe` where the process is writing a `.zip` file to the disk. action.escu.mappings = {"mitre_attack": ["Spearphishing Attachment"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "cis20": ["CIS 7", "CIS 8"], "nist": ["ID.AM", "PR.DS"]} action.escu.data_models = ["Endpoint"] -action.escu.eli5 = In this search, we are essentially trying to detect if outlook.exe is writing a `.zip` file to the disk. The way this search would run is, it will execute the the subsearch first which looks for all .zip files being written to the disk and outputs a crucial field "process_id", that we use the main search to check if that process_id belongs to a process_name of outlook.exe. The search uses a join command to essentially give you an end result of the first and last time that zip file was written by outlook.exe, the dest and user logged on the system, the hash value and the complete path to the zip file on disk +action.escu.eli5 = In this search, we are essentially trying to detect if outlook.exe is writing a `.zip` file to the disk. The way this search would run is, it will execute the the subsearch first which looks for all .zip files being written to the disk and outputs a crucial field "process\_id", that we use the main search to check if that process\_id belongs to a process\_name of outlook.exe. The search uses a join command to essentially give you an end result of the first and last time that zip file was written by outlook.exe, the dest and user logged on the system, the hash value and the complete path to the zip file on disk action.escu.how_to_implement = You must be ingesting data that records filesystem and process activity from your hosts to populate the Endpoint data model. This is typically populated via endpoint detection-and-response products, such as Carbon Black, or endpoint data sources, such as Sysmon. action.escu.known_false_positives = It is not uncommon for outlook to write legitimate zip files to the disk. action.escu.creation_date = 2019-04-29 @@ -7191,7 +7191,7 @@ action.escu.eli5 = This search looks at files being created or modified in the E action.escu.how_to_implement = You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint file-system data model node. This is typically populated via endpoint detection-and-response products, such as Carbon Black, or via other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report file system reads and writes. In addition, this search leverages an included lookup file that contains the names of the files to watch for, as well as a note to communicate why that file name is being monitored. This lookup file can be edited to add or remove file the file names you want to monitor. action.escu.known_false_positives = It's possible for a legitimate file to be created with the same name as one noted in the lookup file. Filenames listed in the lookup file should be unique enough that collisions are rare. Looking at the location of the file and the process responsible for the activity can help determine whether or not the activity is legitimate. action.escu.creation_date = 2018-06-14 -action.escu.modification_date = 2018-11-14 +action.escu.modification_date = 2019-04-25 action.escu.confidence = high action.escu.full_search_name = ESCU - Suspicious File Write - Rule action.escu.search_type = detection @@ -7232,7 +7232,7 @@ quantity = 0 realtime_schedule = 0 schedule_window = auto is_visible = false -search = | tstats `summariesonly` count values(Filesystem.action) as action values(Filesystem.file_path) as file_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem by Filesystem.file_name Filesystem.dest | `ctime(lastTime)` | `ctime(firstTime)` | `drop_dm_object_name(Filesystem)` +search = | tstats `summariesonly` count values(Filesystem.action) as action values(Filesystem.file_path) as file_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem by Filesystem.file_name Filesystem.dest | `ctime(lastTime)` | `ctime(firstTime)` | `drop_dm_object_name(Filesystem)` | `suspicious_writes` [ESCU - Suspicious Java Classes - Rule] action.escu = 0 @@ -7289,10 +7289,10 @@ search = sourcetype="stream:http" http_method=POST http_content_length>1 | regex [ESCU - Suspicious LNK file launching a process - Rule] action.escu = 0 action.escu.enabled = 1 -description = This search looks for a *.lnk file under C:\User* or *\Local\Temp\* executing a process. This is common behavior used by various spear phishing tools. +description = This search looks for a ``*.lnk` file under `C:\User*` or `*\Local\Temp\*` executing a process. This is common behavior used by various spear phishing tools. action.escu.mappings = {"mitre_attack": ["Spearphishing Attachment"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "cis20": ["CIS 7", "CIS 8"], "nist": ["ID.AM", "PR.DS"]} action.escu.data_models = ["Endpoint"] -action.escu.eli5 = In this search, we are essentially trying to detect if a LNK file created under the C:\User* or *\Local\Temp\* directory structures is launching a process with in 1 hour of its creation. LNK files or also known as Windows shortcut files are commonly associated with phishing and are a preferred method used for exploitation see: https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html. +action.escu.eli5 = In this search, we are essentially trying to detect if a LNK file created under the C:\User* or *\Local\Temp\* directory structures is launching a process with in 1 hour of its creation. LNK files or also known as Windows shortcut files are commonly associated with phishing and are a [preferred method used for exploitation](https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html). action.escu.how_to_implement = You must be ingesting data that records filesystem and process activity from your hosts to populate the Endpoint data model. This is typically populated via endpoint detection-and-response products, such as Carbon Black, or endpoint data sources, such as Sysmon. action.escu.known_false_positives = This detection should yield little or no false positive results. It is uncommon for LNK files to execute process from temporary or user directories. action.escu.creation_date = 2019-04-29 diff --git a/src/default/use_case_library.conf b/src/default/use_case_library.conf index 99da64dad4..fe2f5c3150 100644 --- a/src/default/use_case_library.conf +++ b/src/default/use_case_library.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security-content -# On Date: 2019-04-26T19:56:35 UTC +# On Date: 2019-04-29T21:24:59 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -219,9 +219,9 @@ maintainers = [{"company": "Splunk", "email": "research@splunk.com", "name": "Sp spec_version = 2 searches = ["ESCU - Detect DNS requests to Phishing Sites leveraging EvilGinx2 - Rule", "ESCU - Get Certificate logs for a domain"] description = Detect DNS and web requests to fake websites generated by the EvilGinx2 toolkit. These websites are designed to fool unwitting users who have clicked on a malicious link in a phishing email. -narrative = As most people know, these emails use fraudulent domains, email scraping (see https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), familiar contact names inserted as senders, and other tactics to lure targets into clicking a malicious link, opening an attachment with a nefarious payload (see https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), or entering sensitive personal information that perpetrators may intercept. This attack technique requires a relatively low level of skill and allows adversaries to easily cast a wide net. Because phishing is a technique that relies on human psychology, you will never be able to eliminate this vulnerability 100%. But you can use automated detection to significantly reduce the risks.\ +narrative = As most people know, these emails use fraudulent domains, [email scraping](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), familiar contact names inserted as senders, and other tactics to lure targets into clicking a malicious link, opening an attachment with a [nefarious payload](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), or entering sensitive personal information that perpetrators may intercept. This attack technique requires a relatively low level of skill and allows adversaries to easily cast a wide net. Because phishing is a technique that relies on human psychology, you will never be able to eliminate this vulnerability 100%. But you can use automated detection to significantly reduce the risks.\ \ -This Analytic Story focuses on detecting signs of MiTM attacks enabled by EvilGinx (see https://github.com/kgretzky/evilginx2), a toolkit that sets up a transparent proxy between the targeted site and the user. In this way, the attacker is able to intercept credentials and two-factor identification tokens. It employs a proxy template to allow a registered domain to impersonate targeted sites, such as Linkedin, Amazon, Okta, Github, Twitter, Instagram, Reddit, Office 365, and others. It can even register SSL certificates and camouflage them via a URL shortener, making them difficult to detect. Searches in this story look for signs of MiTM attacks enabled by EvilGinx2. +This Analytic Story focuses on detecting signs of MiTM attacks enabled by [EvilGinx2](https://github.com/kgretzky/evilginx2), a toolkit that sets up a transparent proxy between the targeted site and the user. In this way, the attacker is able to intercept credentials and two-factor identification tokens. It employs a proxy template to allow a registered domain to impersonate targeted sites, such as Linkedin, Amazon, Okta, Github, Twitter, Instagram, Reddit, Office 365, and others. It can even register SSL certificates and camouflage them via a URL shortener, making them difficult to detect. Searches in this story look for signs of MiTM attacks enabled by EvilGinx2. [analytic_story://Credential Dumping] category = "Adversary Tactics" @@ -557,19 +557,19 @@ maintainers = [{"company": "Splunk", "email": "research@splunk.com", "name": "Sp spec_version = 2 searches = ["ESCU - Detect Oulook.exe writing a .zip file - Rule", "ESCU - Suspicious LNK file launching a process - Rule", "ESCU - Get Parent Process Info"] description = Detect signs of malicious payloads that may indicate that your environment has been breached via a phishing attack. -narrative = Despite its simplicity, phishing remains the most pervasive and dangerous cyberthreat. In fact, research shows that as many as 91% of all successful attacks (see https://digitalguardian.com/blog/91-percent-cyber-attacks-start-phishing-email-heres-how-protect-against-phishing) are initiated via a phishing email. \ +narrative = Despite its simplicity, phishing remains the most pervasive and dangerous cyberthreat. In fact, research shows that as many as [91% of all successful attacks](https://digitalguardian.com/blog/91-percent-cyber-attacks-start-phishing-email-heres-how-protect-against-phishing) are initiated via a phishing email. \ \ -As most people know, these emails use fraudulent domains, email scraping (see https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), familiar contact names inserted as senders, and other tactics to lure targets into clicking a malicious link, opening an attachment with a nefarious payload (see https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), or entering sensitive personal information that perpetrators may intercept. This attack technique requires a relatively low level of skill and allows adversaries to easily cast a wide net. Worse, because its success relies on the gullibility of humans, it's impossible to completely "automate" it out of your environment. However, you can use ES and ESCU to detect and investigate potentially malicious payloads injected into your environment subsequent to a phishing attack. \ +As most people know, these emails use fraudulent domains, [email scraping](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), familiar contact names inserted as senders, and other tactics to lure targets into clicking a malicious link, opening an attachment with a [nefarious payload](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), or entering sensitive personal information that perpetrators may intercept. This attack technique requires a relatively low level of skill and allows adversaries to easily cast a wide net. Worse, because its success relies on the gullibility of humans, it's impossible to completely "automate" it out of your environment. However, you can use ES and ESCU to detect and investigate potentially malicious payloads injected into your environment subsequent to a phishing attack. \ \ While any kind of file may contain a malicious payload, some are more likely to be perceived as benign (and thus more often escape notice) by the average victim—especially when the attacker sends an email that seems to be from one of their contacts. An example is Microsoft Office files. Most corporate users are familiar with documents with the following suffixes: .doc/.docx (MS Word), .xls/.xlsx (MS Excel), and .ppt/.pptx (MS PowerPoint), so they may click without a second thought, slashing a hole in their organizations' security. \ \ -Following is a typical series of events, according to an article by Trend Micro (see https://blog.trendmicro.com/trendlabs-security-intelligence/rising-trend-attackers-using-lnk-files-download-malware/):\ +Following is a typical series of events, according to an [article by Trend Micro](https://blog.trendmicro.com/trendlabs-security-intelligence/rising-trend-attackers-using-lnk-files-download-malware/):\ \ 1. Attacker sends a phishing email. Recipient downloads the attached file, which is typically a .docx or .zip file with an embedded .lnk file\ \ 1. The .lnk file executes a PowerShell script\ \ -1. Powershell executes a reverse shell, rendering the exploit successful As a side note, adversaries are likely to use a tool like Empire to craft and obfuscate payloads and their post-injection activities, such as exfiltration, lateral movement, and persistence. (see https://github.com/EmpireProject/Empire)\ +1. Powershell executes a reverse shell, rendering the exploit successful As a side note, adversaries are likely to use a tool like Empire to craft and obfuscate payloads and their post-injection activities, such as [exfiltration, lateral movement, and persistence](https://github.com/EmpireProject/Empire).\ \ This Analytic Story focuses on detecting signs that a malicious payload has been injected into your environment. For example, one search detects outlook.exe writing a .zip file. Another looks for suspicious .lnk files launching processes. @@ -1497,7 +1497,7 @@ providing_technologies = ["AWS"] type = detection asset_type = Endpoint confidence = high -explanation = In this search, we are essentially trying to detect if outlook.exe is writing a `.zip` file to the disk. The way this search would run is, it will execute the the subsearch first which looks for all .zip files being written to the disk and outputs a crucial field "process_id", that we use the main search to check if that process_id belongs to a process_name of outlook.exe. The search uses a join command to essentially give you an end result of the first and last time that zip file was written by outlook.exe, the dest and user logged on the system, the hash value and the complete path to the zip file on disk +explanation = In this search, we are essentially trying to detect if outlook.exe is writing a `.zip` file to the disk. The way this search would run is, it will execute the the subsearch first which looks for all .zip files being written to the disk and outputs a crucial field "process\_id", that we use the main search to check if that process\_id belongs to a process\_name of outlook.exe. The search uses a join command to essentially give you an end result of the first and last time that zip file was written by outlook.exe, the dest and user logged on the system, the hash value and the complete path to the zip file on disk how_to_implement = You must be ingesting data that records filesystem and process activity from your hosts to populate the Endpoint data model. This is typically populated via endpoint detection-and-response products, such as Carbon Black, or endpoint data sources, such as Sysmon. annotations = {"mitre_attack": ["Spearphishing Attachment"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "cis20": ["CIS 7", "CIS 8"], "nist": ["ID.AM", "PR.DS"]} known_false_positives = It is not uncommon for outlook to write legitimate zip files to the disk. @@ -2583,7 +2583,7 @@ providing_technologies = ["Splunk Stream", "Bro", "Bluecoat", "Apache"] type = detection asset_type = Endpoint confidence = high -explanation = In this search, we are essentially trying to detect if a LNK file created under the C:\User* or *\Local\Temp\* directory structures is launching a process with in 1 hour of its creation. LNK files or also known as Windows shortcut files are commonly associated with phishing and are a preferred method used for exploitation see: https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html. +explanation = In this search, we are essentially trying to detect if a LNK file created under the C:\User* or *\Local\Temp\* directory structures is launching a process with in 1 hour of its creation. LNK files or also known as Windows shortcut files are commonly associated with phishing and are a [preferred method used for exploitation](https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html). how_to_implement = You must be ingesting data that records filesystem and process activity from your hosts to populate the Endpoint data model. This is typically populated via endpoint detection-and-response products, such as Carbon Black, or endpoint data sources, such as Sysmon. annotations = {"mitre_attack": ["Spearphishing Attachment"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "cis20": ["CIS 7", "CIS 8"], "nist": ["ID.AM", "PR.DS"]} known_false_positives = This detection should yield little or no false positive results. It is uncommon for LNK files to execute process from temporary or user directories. @@ -2858,24 +2858,24 @@ how_to_implement = If Splunk>Phantom is also configured in your environment, a P \ known_false_positives = None at this time -earliest_time_offset = 43200 -latest_time_offset = 1 +earliest_time_offset = 3600 +latest_time_offset = 3600 [savedsearch://ESCU - Domain Certificate Investigation] type = investigation explanation = none how_to_implement = To successfully implement this phantom playbook, you must integrate Enterprise Security with Phantom. Configure this playbook in the correlation search `Detect DNS requests to Phishing Sites leveraging EvilGinx2` ,as an adaptive response action. known_false_positives = None at this time -earliest_time_offset = 86400 -latest_time_offset = 86400 +earliest_time_offset = 3600 +latest_time_offset = 3600 [savedsearch://ESCU - Excessive Account Lockouts Enrichment And Response] type = investigation explanation = none how_to_implement = Import playbook into phantom known_false_positives = None at this time -earliest_time_offset = 1209600 -latest_time_offset = 0 +earliest_time_offset = 3600 +latest_time_offset = 3600 [savedsearch://ESCU - Get All AWS Activity From City] type = investigation