admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
Bhavin Patel
2021-10-27 14:07:13 -07:00
committed by GitHub
parent d90ac44455 37574a6ff3
commit cc0b8909e0
661 changed files with 1905 additions and 6281 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bin/jinja2_templates/doc_detections_markdown.j2
+10 -8
View File
@@ -53,20 +53,21 @@ We have not been able to test, simulate or build datasets for it, use at your ow
- **ID**: {{ detection.id }}
{% if detection.mitre_attacks %}
#### ATT&CK
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
{% for attack in detection.mitre_attacks -%}
{% if attack.technique_id -%}
{%- set sub_technique = attack.technique_id.split('.') -%}{%- if sub_technique | length > 1 -%}
{% set sub_technique = attack.technique_id.split('.') -%}
{% if sub_technique | length > 1 -%}
| [{{ attack.technique_id }}](https://attack.mitre.org/techniques/{{sub_technique[0]}}/{{sub_technique[1]}}/) | {{ attack.technique }} | {{ attack.tactic|join(', ') }} |
{% else %}
{% else -%}
| [{{ attack.technique_id }}](https://attack.mitre.org/techniques/{{attack.technique_id}}/) | {{ attack.technique }} | {{ attack.tactic|join(', ') }} |
{% endif %}
{% endif %}
{% endif -%}
{% endif -%}
{% endfor %}
{% endif %}
{% endif -%}
#### Search
@@ -128,4 +129,5 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
* [{{dataset}}]({{ dataset }})
{% endfor %}
[*source*](https://github.com/splunk/security_content/tree/develop/detections/{% if detection.experimental is sameas true -%}experimental/{%- endif -%}{{detection.kind}}/{{ detection.name | lower | replace (" ", "_") }}.yml) \| *version*: **{{detection.version}}**
docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md
-2
View File
@@ -32,8 +32,6 @@ The search queries the authentication logs for assets that are categorized as ro
- **Author**: Bhavin Patel, Splunk
- **ID**: 104658f4-afdc-499e-9719-17243rr826f1
#### Search
```
docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md
-2
View File
@@ -34,8 +34,6 @@ By populating the organization's assets within the assets_by_str.csv, we wil
- **Author**: Bhavin Patel, Splunk
- **ID**: dcfd6b40-42f9-469d-a433-2e53f7489ff4
#### Search
```
docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md
-2
View File
@@ -31,8 +31,6 @@ This search looks for Windows endpoints that have not generated an event indicat
- **Author**: Bhavin Patel, Splunk
- **ID**: 1a77c08c-2f56-409c-a2d3-7d64617edd4f
#### Search
```
docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md
-2
View File
@@ -32,8 +32,6 @@ Attackers often use spaces as a means to obfuscate an attachment's file exte
- **Author**: David Dorsey, Splunk
- **ID**: 56e877a6-1455-4479-ada6-0550dc1e22f8
#### Search
```
docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md
+3 -10
View File
@@ -39,20 +39,13 @@ The search is used to identify attempts to use your DNS Infrastructure for DDoS
- **ID**: 8fa891f7-a533-4b3c-af85-5aa2e7c1f1eb
#### ATT&CK
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1498](https://attack.mitre.org/techniques/T1498/) | Network Denial of Service | Impact |
| [T1498.002](https://attack.mitre.org/techniques/T1498/002/) | Reflection Amplification | Impact |
#### Search
```
docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md
+3 -8
View File
@@ -36,17 +36,12 @@ This search looks for specific GET or HEAD requests to web servers that are indi
- **ID**: 104658f4-afdc-499e-9719-17243f982681
#### ATT&CK
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1082](https://attack.mitre.org/techniques/T1082/) | System Information Discovery | Discovery |
#### Search
```
docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md
-2
View File
@@ -32,8 +32,6 @@ This search is used to detect malicious HTTP requests crafted to exploit jmx-con
- **Author**: Bhavin Patel, Splunk
- **ID**: c8bff7a4-11ea-4416-a27d-c5bca472913d
#### Search
```
docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md
-2
View File
@@ -32,8 +32,6 @@ This search looks for Web requests to faux domains similar to the one that you w
- **Author**: David Dorsey, Splunk
- **ID**: 134da869-e264-4a8f-8d7e-fcd0ec88f301
#### Search
```
docs/_posts/2017-10-13-unusually_long_content-type_length.md
-2
View File
@@ -31,8 +31,6 @@ This search looks for unusually long strings in the Content-Type http header tha
- **Author**: Bhavin Patel, Splunk
- **ID**: 57a0a2bf-353f-40c1-84dc-29293f3c35b7
#### Search
```
docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md
-2
View File
@@ -32,8 +32,6 @@ This search looks for emails claiming to be sent from a domain similar to one th
- **Author**: David Dorsey, Splunk
- **ID**: b2ea1f38-3a3e-4b8a-9cf1-82760d86a6b8
#### Search
```
docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md
-2
View File
@@ -32,8 +32,6 @@ This search will detect spike in blocked outbound network connections originatin
- **Author**: Bhavin Patel, Splunk
- **ID**: ada0f278-84a8-46w1-a3f1-w32372d4bd53
#### Search
```
docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md
+3 -8
View File
@@ -36,17 +36,12 @@ This search looks for outbound ICMP packets with a packet size larger than 1,000
- **ID**: e9c102de-4d43-42a7-b1c8-8062ea297419
#### ATT&CK
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1095](https://attack.mitre.org/techniques/T1095/) | Non-Application Layer Protocol | Command And Control |
#### Search
```
docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md
+3 -8
View File
@@ -35,17 +35,12 @@ This search looks at S3 bucket-access logs and detects new or previously unseen
- **ID**: 2a9b80d3-6340-4345-b5ad-291bq3d0daq4
#### ATT&CK
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1530](https://attack.mitre.org/techniques/T1530/) | Data from Cloud Storage Object | Collection |
#### Search
```
docs/_posts/2018-10-12-cloud_compute_instance_created_with_previously_unseen_image.md
-2
View File
@@ -30,8 +30,6 @@ This search looks for cloud compute instances being created with previously unse
- **Author**: David Dorsey, Splunk
- **ID**: bc24922d-987c-4645-b288-f8c73ec194c4
#### Search
```
docs/_posts/2018-10-23-wmi_permanent_event_subscription.md
+3 -8
View File
@@ -35,17 +35,12 @@ This search looks for the creation of WMI permanent event subscriptions.
- **ID**: 71bfdb13-f200-4c6c-b2c9-a2e07adf437d
#### ATT&CK
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1047](https://attack.mitre.org/techniques/T1047/) | Windows Management Instrumentation | Execution |
#### Search
```
docs/_posts/2018-10-23-wmi_temporary_event_subscription.md
+3 -8
View File
@@ -35,17 +35,12 @@ This search looks for the creation of WMI temporary event subscriptions.
- **ID**: 38cbd42c-1098-41bb-99cf-9d6d2b296d83
#### ATT&CK
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1047](https://attack.mitre.org/techniques/T1047/) | Windows Management Instrumentation | Execution |
#### Search
```
docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md
+3 -8
View File
@@ -35,17 +35,12 @@ This search detects users creating spikes in API activity related to deletion of
- **ID**: ad12w478-84a8-4641-a3w1-e32372q4bd53
#### ATT&CK
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1530](https://attack.mitre.org/techniques/T1530/) | Data from Cloud Storage Object | Collection |
#### Search
```
docs/_posts/2018-12-03-remote_wmi_command_attempt.md
+3 -8
View File
@@ -34,17 +34,12 @@ The following analytic identifies usage of `wmic.exe` spawning a local or remote
- **ID**: 272df6de-61f1-4784-877c-1fbc3e2d0838
#### ATT&CK
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1047](https://attack.mitre.org/techniques/T1047/) | Windows Management Instrumentation | Execution |
#### Search
```
docs/_posts/2018-12-03-usn_journal_deletion.md
+3 -8
View File
@@ -34,17 +34,12 @@ The fsutil.exe application is a legitimate Windows utility used to perform tasks
- **ID**: b6e0ff70-b122-4227-9368-4cf322ab43c3
#### ATT&CK
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1070](https://attack.mitre.org/techniques/T1070/) | Indicator Removal on Host | Defense Evasion |
#### Search
```
docs/_posts/2018-12-06-suspicious_java_classes.md
-2
View File
@@ -31,8 +31,6 @@ This search looks for suspicious Java classes that are often used to exploit rem
- **Author**: Jose Hernandez, Splunk
- **ID**: if1fea6da-3c86-4c1d-b255-fc3b2781a491
#### Search
```
docs/_posts/2018-12-14-file_with_samsam_extension.md
-2
View File
@@ -30,8 +30,6 @@ The search looks for file writes with extensions consistent with a SamSam ransom
- **Author**: Rico Valdez, Splunk
- **ID**: 02c6cfc2-ae66-4735-bfc7-6291da834cbf
#### Search
```
docs/_posts/2018-12-14-samsam_test_file_write.md
+3 -8
View File
@@ -34,17 +34,12 @@ The search looks for a file named "test.txt" written to the windows syst
- **ID**: 493a879d-519d-428f-8f57-a06a0fdc107e
#### ATT&CK
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1486](https://attack.mitre.org/techniques/T1486/) | Data Encrypted for Impact | Impact |
#### Search
```
docs/_posts/2019-01-25-processes_tapping_keyboard_events.md
-2
View File
@@ -31,8 +31,6 @@ This search looks for processes in an MacOS system that is tapping keyboard even
- **Author**: Jose Hernandez, Splunk
- **ID**: 2a371608-331d-4034-ae2c-21dda8f1d0ec
#### Search
```
docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md
+3 -8
View File
@@ -36,17 +36,12 @@ This search looks for suspicious processes on all systems labeled as web servers
- **ID**: ec3b7601-689a-4463-94e0-c9f45638efb9
#### ATT&CK
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1082](https://attack.mitre.org/techniques/T1082/) | System Information Discovery | Discovery |
#### Search
```
docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md
-2
View File
@@ -31,8 +31,6 @@ Command lines that are extremely long may be indicative of malicious activity on
- **Author**: Rico Valdez, Splunk
- **ID**: 57edaefa-a73b-45e5-bbae-f39c1473f941
#### Search
```
docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md
+3 -10
View File
@@ -36,20 +36,13 @@ This search looks for reading lsass memory consistent with credential dumping.
- **ID**: 2c365e57-4414-4540-8dc0-73ab10729996
#### ATT&CK
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1003.001](https://attack.mitre.org/techniques/T1003/001/) | LSASS Memory | Credential Access |
| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access |
#### Search
```
docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md
+3 -10
View File
@@ -36,20 +36,13 @@ This search looks for reading loaded Images unique to credential dumping with Mi
- **ID**: 29e307ba-40af-4ab2-91b2-3c6b392bbba0
#### ATT&CK
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1003.001](https://attack.mitre.org/techniques/T1003/001/) | LSASS Memory | Credential Access |
| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access |
#### Search
```
docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md
+3 -10
View File
@@ -36,20 +36,13 @@ Detect memory dumping of the LSASS process.
- **ID**: fb4c31b0-13e8-4155-8aa5-24de4b8d6717
#### ATT&CK
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1003.001](https://attack.mitre.org/techniques/T1003/001/) | LSASS Memory | Credential Access |
| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access |
#### Search
```
docs/_posts/2019-12-06-create_remote_thread_into_lsass.md
+3 -10
View File
@@ -36,20 +36,13 @@ Detect remote thread creation into LSASS consistent with credential dumping.
- **ID**: 67d4dbef-9564-4699-8da8-03a151529edc
#### ATT&CK
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1003.001](https://attack.mitre.org/techniques/T1003/001/) | LSASS Memory | Credential Access |
| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access |
#### Search
```
docs/_posts/2019-12-10-creation_of_shadow_copy.md
+3 -10
View File
@@ -37,20 +37,13 @@ Monitor for signs that Vssadmin or Wmic has been used to create a shadow copy.
- **ID**: eb120f5f-b879-4a63-97c1-93352b5df844
#### ATT&CK
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1003.003](https://attack.mitre.org/techniques/T1003/003/) | NTDS | Credential Access |
| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access |
#### Search
```
docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md
+3 -10
View File
@@ -39,20 +39,13 @@ This search allows you to identify DNS requests that are unusually large for the
- **ID**: 85fbcfe8-9718-4911-adf6-7000d077a3a9
#### ATT&CK
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1071.004](https://attack.mitre.org/techniques/T1071/004/) | DNS | Command And Control |
| [T1071](https://attack.mitre.org/techniques/T1071/) | Application Layer Protocol | Command And Control |
#### Search
```
docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md
+3 -10
View File
@@ -36,20 +36,13 @@ Detect the hands on keyboard behavior of Windows Task Manager creating a process
- **ID**: b2fbe95a-9c62-4c12-8a29-24b97e84c0cd
#### ATT&CK
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1003.001](https://attack.mitre.org/techniques/T1003/001/) | LSASS Memory | Credential Access |
| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access |
#### Search
```
docs/_posts/2020-02-07-macos_-_re-opened_applications.md
-2
View File
@@ -33,8 +33,6 @@ This search looks for processes referencing the plist files that determine which
- **Author**: Jamie Windley, Splunk
- **ID**: 40bb64f9-f619-4e3d-8732-328d40377c4b
#### Search
```
docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md
+3 -8
View File
@@ -34,17 +34,12 @@ This searches show information on uploaded containers including source user, ima
- **ID**: f0f70b40-f7ad-489d-9905-23d149da8099
#### ATT&CK
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1525](https://attack.mitre.org/techniques/T1525/) | Implant Internal Image | Persistence |
#### Search
```
docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md
+3 -10
View File
@@ -37,20 +37,13 @@ Detect the usage of comsvcs.dll for dumping the lsass process.
- **ID**: 8943b567-f14d-4ee8-a0bb-2121d4ce3184
#### ATT&CK
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1003.001](https://attack.mitre.org/techniques/T1003/001/) | LSASS Memory | Credential Access |
| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access |
#### Search
```
docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md
+3 -8
View File
@@ -37,17 +37,12 @@ This search looks for child processes of spoolsv.exe. This activity is associate
- **ID**: aa0c4aeb-5b18-41c4-8c07-f1442d7599df
#### ATT&CK
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1068](https://attack.mitre.org/techniques/T1068/) | Exploitation for Privilege Escalation | Privilege Escalation |
#### Search
```
docs/_posts/2020-03-16-detect_rare_executables.md
-2
View File
@@ -34,8 +34,6 @@ This search will return a table of rare processes, the names of the systems runn
- **Author**: Bhavin Patel, Splunk
- **ID**: 44fddcb2-8d3b-454c-874e-7c6de5a4f7ac
#### Search
```
docs/_posts/2020-03-16-process_execution_via_wmi.md
+3 -8
View File
@@ -34,17 +34,12 @@ The following analytic identifies `WmiPrvSE.exe` spawning a process. This typica
- **ID**: 24869767-8579-485d-9a4f-d9ddfd8f0cac
#### ATT&CK
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1047](https://attack.mitre.org/techniques/T1047/) | Windows Management Instrumentation | Execution |
#### Search
```
docs/_posts/2020-03-16-script_execution_via_wmi.md
+3 -8
View File
@@ -34,17 +34,12 @@ This search looks for scripts launched via WMI.
- **ID**: aa73f80d-d728-4077-b226-81ea0c8be589
#### ATT&CK
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1047](https://attack.mitre.org/techniques/T1047/) | Windows Management Instrumentation | Execution |
#### Search
```
docs/_posts/2020-03-16-spike_in_file_writes.md
-2
View File
@@ -31,8 +31,6 @@ The search looks for a sharp increase in the number of files written to a partic
- **Author**: David Dorsey, Splunk
- **ID**: fdb0f805-74e4-4539-8c00-618927333aae
#### Search
```
docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md
+3 -8
View File
@@ -35,17 +35,12 @@ This search provides information of unauthenticated requests via user agent, and
- **ID**: 294c4686-63dd-4fe6-93a2-ca807626704a
#### ATT&CK
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1526](https://attack.mitre.org/techniques/T1526/) | Cloud Service Discovery | Discovery |
#### Search
```
docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md
+3 -8
View File
@@ -35,17 +35,12 @@ This search provides detection information on unauthenticated requests against K
- **ID**: dbfca1dd-b8e5-4ba4-be0e-e565e5d62002
#### ATT&CK
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1526](https://attack.mitre.org/techniques/T1526/) | Cloud Service Discovery | Discovery |
#### Search
```
docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md
+3 -8
View File
@@ -34,17 +34,12 @@ This search looks for child processes spawned by zoom.exe or zoom.us that has no
- **ID**: e91bd102-d630-4e76-ab73-7e3ba22c5961
#### ATT&CK
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1068](https://attack.mitre.org/techniques/T1068/) | Exploitation for Privilege Escalation | Privilege Escalation |
#### Search
```
docs/_posts/2020-05-28-aws_cross_account_activity_from_previously_unseen_account.md
-2
View File
@@ -31,8 +31,6 @@ This search looks for AssumeRole events where an IAM role in a different account
- **Author**: Rico Valdez, Splunk
- **ID**: 21193641-cb96-4a2c-a707-d9b9a7f7792b
#### Search
```
docs/_posts/2020-05-28-detect_aws_console_login_by_new_user.md
-2
View File
@@ -31,8 +31,6 @@ This search looks for AWS CloudTrail events wherein a console login event by a u
- **Author**: Rico Valdez, Splunk
- **ID**: bc91a8cd-35e7-4bb2-6140-e756cc46fd71
#### Search
```
docs/_posts/2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md
-2
View File
@@ -31,8 +31,6 @@ This search provides information on anonymous Kubectl calls with IP, verb namesp
- **Author**: Rod Soto, Splunk
- **ID**: 042a3d32-8318-4763-9679-09db2644a8f2
#### Search
```
docs/_posts/2020-07-03-detect_path_interception_by_creation_of_program_exe.md
+3 -10
View File
@@ -41,20 +41,13 @@ The detection Detect Path Interception By Creation Of program exe is detecting t
- **ID**: c77162d3-f93c-45cc-80c8-22f6v5264g9f
#### ATT&CK
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1574.009](https://attack.mitre.org/techniques/T1574/009/) | Path Interception by Unquoted Path | Persistence, Privilege Escalation, Defense Evasion |
| [T1574](https://attack.mitre.org/techniques/T1574/) | Hijack Execution Flow | Persistence, Privilege Escalation, Defense Evasion |
#### Search
```
docs/_posts/2020-07-06-short_lived_windows_accounts.md
+3 -10
View File
@@ -36,20 +36,13 @@ This search detects accounts that were created and deleted in a short time perio
- **ID**: b25f6f62-0782-43c1-b403-083231ffd97d
#### ATT&CK
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1136.001](https://attack.mitre.org/techniques/T1136/001/) | Local Account | Persistence |
| [T1136](https://attack.mitre.org/techniques/T1136/) | Create Account | Persistence |
#### Search
```
docs/_posts/2020-07-06-windows_event_log_cleared.md
+3 -10
View File
@@ -36,20 +36,13 @@ The following analytic utilizes Windows Security Event ID 1102 or System log eve
- **ID**: ad517544-aff9-4c96-bd99-d6eb43bfbb6a
#### ATT&CK
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1070](https://attack.mitre.org/techniques/T1070/) | Indicator Removal on Host | Defense Evasion |
| [T1070.001](https://attack.mitre.org/techniques/T1070/001/) | Clear Windows Event Logs | Defense Evasion |
#### Search
```
docs/_posts/2020-07-07-remote_desktop_network_traffic.md
+3 -10
View File
@@ -39,20 +39,13 @@ This search looks for network traffic on TCP/3389, the default port used by remo
- **ID**: 272b8407-842d-4b3d-bead-a704584003d3
#### ATT&CK
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1021.001](https://attack.mitre.org/techniques/T1021/001/) | Remote Desktop Protocol | Lateral Movement |
| [T1021](https://attack.mitre.org/techniques/T1021/) | Remote Services | Lateral Movement |
#### Search
```
docs/_posts/2020-07-08-detect_new_local_admin_account.md
+3 -10
View File
@@ -37,20 +37,13 @@ This search looks for newly created accounts that have been elevated to local ad
- **ID**: b25f6f62-0712-43c1-b203-083231ffd97d
#### ATT&CK
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1136.001](https://attack.mitre.org/techniques/T1136/001/) | Local Account | Persistence |
| [T1136](https://attack.mitre.org/techniques/T1136/) | Create Account | Persistence |
#### Search
```
docs/_posts/2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md
+3 -8
View File
@@ -35,17 +35,12 @@ This search provides information of unauthenticated requests via user agent, and
- **ID**: 19b53215-4a16-405b-8087-9e6acf619842
#### ATT&CK
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1526](https://attack.mitre.org/techniques/T1526/) | Cloud Service Discovery | Discovery |
#### Search
```
docs/_posts/2020-07-21-attempt_to_stop_security_service.md
+3 -10
View File
@@ -38,20 +38,13 @@ This search looks for attempts to stop security-related services on the endpoint
- **ID**: c8e349c6-b97c-486e-8949-bd7bcd1f3910
#### ATT&CK
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion |
| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
#### Search
```
docs/_posts/2020-07-21-detect_excessive_user_account_lockouts.md
+3 -10
View File
@@ -42,20 +42,13 @@ This search detects user accounts that have been locked out a relatively high nu
- **ID**: 95a7f9a5-6096-437e-a19e-86f42ac609bd
#### ATT&CK
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access |
| [T1078.003](https://attack.mitre.org/techniques/T1078/003/) | Local Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access |
#### Search
```
docs/_posts/2020-07-21-detect_outbound_smb_traffic.md
+3 -10
View File
@@ -40,20 +40,13 @@ This search looks for outbound SMB connections made by hosts within your network
- **ID**: 7f5fb3e1-4209-414-90db-0ec21b936378
#### ATT&CK
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1071.002](https://attack.mitre.org/techniques/T1071/002/) | File Transfer Protocols | Command And Control |
| [T1071](https://attack.mitre.org/techniques/T1071/) | Application Layer Protocol | Command And Control |
#### Search
```
docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md
+3 -10
View File
@@ -39,20 +39,13 @@ This search looks for execution of process `outlook.exe` where the process is wr
- **ID**: a51bfe1a-94f0-4822-b1e4-16ae10145893
#### ATT&CK
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1566](https://attack.mitre.org/techniques/T1566/) | Phishing | Initial Access |
| [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access |
#### Search
```
docs/_posts/2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md
+3 -10
View File
@@ -37,20 +37,13 @@ This search looks for the execution of the cscript.exe or wscript.exe processes,
- **ID**: b89919ed-fe5f-492c-b139-95dbb162039e
#### ATT&CK
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution |
| [T1059.003](https://attack.mitre.org/techniques/T1059/003/) | Windows Command Shell | Execution |
#### Search
```
docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md
+3 -8
View File
@@ -38,17 +38,12 @@ This search looks for specific command-line arguments that may indicate the exec
- **ID**: 1297fb80-f42a-4q4a-9c8b-78c061417cf6
#### ATT&CK
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1072](https://attack.mitre.org/techniques/T1072/) | Software Deployment Tools | Execution, Lateral Movement |
#### Search
```
docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md
+3 -10
View File
@@ -39,20 +39,13 @@ The search looks at the change-analysis data model and detects email files creat
- **ID**: ee18ed37-0802-4268-9435-b3b91aaa18xx
#### ATT&CK
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1114](https://attack.mitre.org/techniques/T1114/) | Email Collection | Collection |
| [T1114.001](https://attack.mitre.org/techniques/T1114/001/) | Local Email Collection | Collection |
#### Search
```
docs/_posts/2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md
+3 -10
View File
@@ -39,20 +39,13 @@ This search looks for an increase of data transfers from your email server to yo
- **ID**: 7f5fb3e1-4209-4914-90db-0ec21b556378
#### ATT&CK
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1114](https://attack.mitre.org/techniques/T1114/) | Email Collection | Collection |
| [T1114.002](https://attack.mitre.org/techniques/T1114/002/) | Remote Email Collection | Collection |
#### Search
```
docs/_posts/2020-07-21-excessive_dns_failures.md
+3 -10
View File
@@ -39,20 +39,13 @@ This search identifies DNS query failures by counting the number of DNS response
- **ID**: 104658f4-afdc-499e-9719-17243f9826f1
#### ATT&CK
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1071.004](https://attack.mitre.org/techniques/T1071/004/) | DNS | Command And Control |
| [T1071](https://attack.mitre.org/techniques/T1071/) | Application Layer Protocol | Command And Control |
#### Search
```
docs/_posts/2020-07-21-first_time_seen_running_windows_service.md
+3 -10
View File
@@ -39,20 +39,13 @@ This search looks for the first and last time a Windows service is seen running
- **ID**: 823136f2-d755-4b6d-ae04-372b486a5808
#### ATT&CK
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1569](https://attack.mitre.org/techniques/T1569/) | System Services | Execution |
| [T1569.002](https://attack.mitre.org/techniques/T1569/002/) | Service Execution | Execution |
#### Search
```
docs/_posts/2020-07-21-hiding_files_and_directories_with_attrib_exe.md
+3 -10
View File
@@ -37,20 +37,13 @@ Attackers leverage an existing Windows binary, attrib.exe, to mark specific as h
- **ID**: c77162d3-f93c-45cc-80c8-22f6b5264g9f
#### ATT&CK
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1222](https://attack.mitre.org/techniques/T1222/) | File and Directory Permissions Modification | Defense Evasion |
| [T1222.001](https://attack.mitre.org/techniques/T1222/001/) | Windows File and Directory Permissions Modification | Defense Evasion |
#### Search
```
docs/_posts/2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md
+3 -10
View File
@@ -39,20 +39,13 @@ This search looks for an increase of data transfers from your email server to yo
- **ID**: 7f5fb3e1-4209-4914-90db-0ec21b556368
#### ATT&CK
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1114.002](https://attack.mitre.org/techniques/T1114/002/) | Remote Email Collection | Collection |
| [T1114](https://attack.mitre.org/techniques/T1114/) | Email Collection | Collection |
#### Search
```
docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md
+3 -10
View File
@@ -38,20 +38,13 @@ This search looks for PowerShell processes started with parameters used to bypas
- **ID**: 9be56c82-b1cc-4318-87eb-d138afaaca39
#### ATT&CK
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution |
| [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution |
#### Search
```
docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md
+3 -10
View File
@@ -43,20 +43,13 @@ This search detects Okta login failures due to bad credentials for multiple user
- **ID**: 19cba45f-cad3-4032-8911-0c09e0444552
#### ATT&CK
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access |
| [T1078.001](https://attack.mitre.org/techniques/T1078/001/) | Default Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access |
#### Search
```
docs/_posts/2020-07-21-okta_account_lockout_events.md
+3 -10
View File
@@ -43,20 +43,13 @@ Detect Okta user lockout events
- **ID**: 62b70968-a0a5-4724-8ac4-67871e6f544d
#### ATT&CK
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access |
| [T1078.001](https://attack.mitre.org/techniques/T1078/001/) | Default Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access |
#### Search
```
docs/_posts/2020-07-21-okta_failed_sso_attempts.md
+3 -10
View File
@@ -43,20 +43,13 @@ Detect failed Okta SSO events
- **ID**: 371a6545-2618-4032-ad84-93386b8698c5
#### ATT&CK
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access |
| [T1078.001](https://attack.mitre.org/techniques/T1078/001/) | Default Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access |
#### Search
```
docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md
+3 -10
View File
@@ -43,20 +43,13 @@ This search detects logins from the same user from different cities in a 24 hour
- **ID**: 7594fa07-9f34-4d01-81cc-d6af6a5db9e8
#### ATT&CK
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access |
| [T1078.001](https://attack.mitre.org/techniques/T1078/001/) | Default Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access |
#### Search
```
docs/_posts/2020-07-21-overwriting_accessibility_binaries.md
+3 -10
View File
@@ -39,20 +39,13 @@ Microsoft Windows contains accessibility features that can be launched with a ke
- **ID**: 13c2f6c3-10c5-4deb-9ba1-7c4460ebe4ae
#### ATT&CK
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1546](https://attack.mitre.org/techniques/T1546/) | Event Triggered Execution | Privilege Escalation, Persistence |
| [T1546.008](https://attack.mitre.org/techniques/T1546/008/) | Accessibility Features | Privilege Escalation, Persistence |
#### Search
```
docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md
+3 -8
View File
@@ -37,17 +37,12 @@ This search looks for network traffic defined by port and transport layer protoc
- **ID**: ce5a0962-849f-4720-a678-753fe6674479
#### ATT&CK
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1048](https://attack.mitre.org/techniques/T1048/) | Exfiltration Over Alternative Protocol | Exfiltration |
#### Search
```
docs/_posts/2020-07-21-protocol_or_port_mismatch.md
+3 -10
View File
@@ -39,20 +39,13 @@ This search looks for network traffic on common ports where a higher layer proto
- **ID**: 54dc1265-2f74-4b6d-b30d-49eb506a31b3
#### ATT&CK
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1048.003](https://attack.mitre.org/techniques/T1048/003/) | Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol | Exfiltration |
| [T1048](https://attack.mitre.org/techniques/T1048/) | Exfiltration Over Alternative Protocol | Exfiltration |
#### Search
```
docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md
+3 -10
View File
@@ -40,20 +40,13 @@ This search looks for RDP application network traffic and filters any source/des
- **ID**: a98727cc-286b-4ff2-b898-41df64695923
#### ATT&CK
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1021.001](https://attack.mitre.org/techniques/T1021/001/) | Remote Desktop Protocol | Lateral Movement |
| [T1021](https://attack.mitre.org/techniques/T1021/) | Remote Services | Lateral Movement |
#### Search
```
docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md
+3 -10
View File
@@ -39,20 +39,13 @@ This search looks for the remote desktop process mstsc.exe running on systems up
- **ID**: f5939373-8054-40ad-8c64-cec478a22a4a
#### ATT&CK
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1021.001](https://attack.mitre.org/techniques/T1021/001/) | Remote Desktop Protocol | Lateral Movement |
| [T1021](https://attack.mitre.org/techniques/T1021/) | Remote Services | Lateral Movement |
#### Search
```
docs/_posts/2020-07-21-sc_exe_manipulating_windows_services.md
+3 -10
View File
@@ -39,20 +39,13 @@ This search looks for arguments to sc.exe indicating the creation or modificatio
- **ID**: f0c693d8-2a89-4ce7-80b4-98fea4c3ea6d
#### ATT&CK
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1543.003](https://attack.mitre.org/techniques/T1543/003/) | Windows Service | Persistence, Privilege Escalation |
| [T1543](https://attack.mitre.org/techniques/T1543/) | Create or Modify System Process | Persistence, Privilege Escalation |
#### Search
```
docs/_posts/2020-07-21-schtasks_scheduling_job_on_remote_system.md
+3 -10
View File
@@ -41,20 +41,13 @@ This search looks for flags passed to schtasks.exe on the command-line that indi
- **ID**: 1297fb80-f42a-4b4a-9c8a-88c066237cf6
#### ATT&CK
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1053.005](https://attack.mitre.org/techniques/T1053/005/) | Scheduled Task | Execution, Persistence, Privilege Escalation |
| [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation |
#### Search
```
docs/_posts/2020-07-21-sql_injection_with_long_urls.md
+3 -8
View File
@@ -36,17 +36,12 @@ This search looks for long URLs that have several SQL commands visible within th
- **ID**: e0aad4cf-0790-423b-8328-7564d0d938f9
#### ATT&CK
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1190](https://attack.mitre.org/techniques/T1190/) | Exploit Public-Facing Application | Initial Access |
#### Search
```
docs/_posts/2020-07-22-smb_traffic_spike.md
+3 -10
View File
@@ -39,20 +39,13 @@ This search looks for spikes in the number of Server Message Block (SMB) traffic
- **ID**: 7f5fb3e1-4209-4914-90db-0ec21b936378
#### ATT&CK
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1021.002](https://attack.mitre.org/techniques/T1021/002/) | SMB/Windows Admin Shares | Lateral Movement |
| [T1021](https://attack.mitre.org/techniques/T1021/) | Remote Services | Lateral Movement |
#### Search
```
docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md
+3 -10
View File
@@ -39,20 +39,13 @@ This search uses the Machine Learning Toolkit (MLTK) to identify spikes in the n
- **ID**: d25773ba-9ad8-48d1-858e-07ad0bbeb828
#### ATT&CK
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1021.002](https://attack.mitre.org/techniques/T1021/002/) | SMB/Windows Admin Shares | Lateral Movement |
| [T1021](https://attack.mitre.org/techniques/T1021/) | Remote Services | Lateral Movement |
#### Search
```
docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md
+3 -10
View File
@@ -39,20 +39,13 @@ This search looks for emails that have attachments with suspicious file extensio
- **ID**: 473bd65f-06ca-4dfe-a2b8-ba04ab4a0084
#### ATT&CK
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access |
| [T1566](https://attack.mitre.org/techniques/T1566/) | Phishing | Initial Access |
#### Search
```
docs/_posts/2020-07-22-suspicious_reg_exe_process.md
+3 -8
View File
@@ -34,17 +34,12 @@ This search looks for reg.exe being launched from a command prompt not started b
- **ID**: a6b3ab4e-dd77-4213-95fa-fc94701995e0
#### ATT&CK
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion |
#### Search
```
docs/_posts/2020-07-22-suspicious_writes_to_windows_recycle_bin.md
+3 -8
View File
@@ -32,17 +32,12 @@ This search detects writes to the recycle bin by a process other than explorer.e
- **ID**: b5541828-8ffd-4070-9d95-b3da4de924cb
#### ATT&CK
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1036](https://attack.mitre.org/techniques/T1036/) | Masquerading | Defense Evasion |
#### Search
```
docs/_posts/2020-07-22-tor_traffic.md
+3 -10
View File
@@ -39,20 +39,13 @@ This search looks for network traffic identified as The Onion Router (TOR), a be
- **ID**: ea688274-9c06-4473-b951-e4cb7a5d7a45
#### ATT&CK
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1071](https://attack.mitre.org/techniques/T1071/) | Application Layer Protocol | Command And Control |
| [T1071.001](https://attack.mitre.org/techniques/T1071/001/) | Web Protocols | Command And Control |
#### Search
```
docs/_posts/2020-07-22-unload_sysmon_filter_driver.md
+3 -10
View File
@@ -37,20 +37,13 @@ Attackers often disable security tools to avoid detection. This search looks for
- **ID**: c77162d3-f93c-45cc-80c8-22f665664g9f
#### ATT&CK
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion |
| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
#### Search
```
docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md
+3 -8
View File
@@ -38,17 +38,12 @@ This search provides detection of an user attaching itself to a different role t
- **ID**: 88fc31dd-f331-448c-9856-d3d51dd5d3a1
#### ATT&CK
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access |
#### Search
```
docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md
+3 -8
View File
@@ -38,17 +38,12 @@ This search provides detection of accounts creating permanent keys. Permanent ke
- **ID**: 12d6d713-3cb4-4ffc-a064-1dca3d1cca01
#### ATT&CK
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access |
#### Search
```
docs/_posts/2020-07-27-aws_detect_role_creation.md
+3 -8
View File
@@ -38,17 +38,12 @@ This search provides detection of role creation by IAM users. Role creation is a
- **ID**: 5f04081e-ddee-4353-afe4-504f288de9ad
#### ATT&CK
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access |
#### Search
```
docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md
+3 -8
View File
@@ -38,17 +38,12 @@ This search provides detection of suspicious use of sts:AssumeRole. These tokens
- **ID**: 8e565314-b6a2-46d8-9f05-1a34a176a662
#### ATT&CK
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access |
#### Search
```
docs/_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md
+3 -8
View File
@@ -36,17 +36,12 @@ This search provides detection of suspicious use of sts:GetSessionToken. These t
- **ID**: 85d7b35f-b8b5-4b01-916f-29b81e7a0551
#### ATT&CK
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1550](https://attack.mitre.org/techniques/T1550/) | Use Alternate Authentication Material | Defense Evasion, Lateral Movement |
#### Search
```
docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md
+3 -8
View File
@@ -36,17 +36,12 @@ This search detects SIGRed via Splunk Stream.
- **ID**: babd8d10-d073-11ea-87d0-0242ac130003
#### ATT&CK
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1203](https://attack.mitre.org/techniques/T1203/) | Exploitation for Client Execution | Execution |
#### Search
```
docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md
+3 -8
View File
@@ -37,17 +37,12 @@ This search detects SIGRed via Zeek DNS and Zeek Conn data.
- **ID**: c5c622e4-d073-11ea-87d0-0242ac130003
#### ATT&CK
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1203](https://attack.mitre.org/techniques/T1203/) | Exploitation for Client Execution | Execution |
#### Search
```
docs/_posts/2020-07-29-cloud_instance_modified_by_previously_unseen_user.md
+3 -10
View File
@@ -43,20 +43,13 @@ This search looks for cloud instances being modified by users who have not previ
- **ID**: 7fb15084-b14e-405a-bd61-a6de15a40722
#### ATT&CK
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1078.004](https://attack.mitre.org/techniques/T1078/004/) | Cloud Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access |
| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access |
#### Search
```
docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md
+3 -8
View File
@@ -36,17 +36,12 @@ This search detects remote code exploit attempts on F5 BIG-IP, BIG-IQ, and Traff
- **ID**: 810e4dbc-d46e-11ea-87d0-0242ac130003
#### ATT&CK
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1190](https://attack.mitre.org/techniques/T1190/) | Exploit Public-Facing Application | Initial Access |
#### Search
```
docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md
+3 -8
View File
@@ -35,17 +35,12 @@ This search looks for GCP PubSub events where a user has created an open/public
- **ID**: f6ea3466-d6bb-11ea-87d0-0242ac130003
#### ATT&CK
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1530](https://attack.mitre.org/techniques/T1530/) | Data from Cloud Storage Object | Collection |
#### Search
```
docs/_posts/2020-08-10-detect_gcp_storage_access_from_a_new_ip.md
+3 -8
View File
@@ -35,17 +35,12 @@ This search looks at GCP Storage bucket-access logs and detects new or previousl
- **ID**: ccc3246a-daa1-11ea-87d0-0242ac130022
#### ATT&CK
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1530](https://attack.mitre.org/techniques/T1530/) | Data from Cloud Storage Object | Collection |
#### Search
```
docs/_posts/2020-08-11-detect_arp_poisoning.md
+3 -16
View File
@@ -48,28 +48,15 @@ By enabling Dynamic ARP Inspection as a Layer 2 Security measure on the organiza
- **ID**: b44bebd6-bd39-467b-9321-73971bcd7aac
#### ATT&CK
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1200](https://attack.mitre.org/techniques/T1200/) | Hardware Additions | Initial Access |
| [T1498](https://attack.mitre.org/techniques/T1498/) | Network Denial of Service | Impact |
| [T1557](https://attack.mitre.org/techniques/T1557/) | Man-in-the-Middle | Credential Access, Collection |
| [T1557.002](https://attack.mitre.org/techniques/T1557/002/) | ARP Cache Poisoning | Credential Access, Collection |
#### Search
```
docs/_posts/2020-08-11-detect_rogue_dhcp_server.md
+3 -14
View File
@@ -44,25 +44,14 @@ By enabling DHCP Snooping as a Layer 2 Security measure on the organization'
- **ID**: 6e1ada88-7a0d-4ac1-92c6-03d354686079
#### ATT&CK
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1200](https://attack.mitre.org/techniques/T1200/) | Hardware Additions | Initial Access |
| [T1498](https://attack.mitre.org/techniques/T1498/) | Network Denial of Service | Impact |
| [T1557](https://attack.mitre.org/techniques/T1557/) | Man-in-the-Middle | Credential Access, Collection |
#### Search
```
docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_ip_address.md
+3 -8
View File
@@ -37,17 +37,12 @@ This search looks for cloud provisioning activities from previously unseen IP ad
- **ID**: f86a8ec9-b042-45eb-92f4-e9ed1d781078
#### ATT&CK
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access |
#### Search
```
docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_region.md
+3 -8
View File
@@ -37,17 +37,12 @@ This search looks for cloud provisioning activities from previously unseen regio
- **ID**: 5aba1860-9617-4af9-b19d-aecac16fe4f2
#### ATT&CK
| ID | Technique | Tactic |
| ----------- | ----------- |--------------- |
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- | ----------- |
| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access |
#### Search
```

Some files were not shown because too many files have changed in this diff Show More