diff --git a/detections/experimental/application/email_files_written_outside_of_the_outlook_directory.yml b/detections/experimental/application/email_files_written_outside_of_the_outlook_directory.yml index a0d01cce1e..2560a04e05 100644 --- a/detections/experimental/application/email_files_written_outside_of_the_outlook_directory.yml +++ b/detections/experimental/application/email_files_written_outside_of_the_outlook_directory.yml @@ -34,6 +34,7 @@ tags: kill_chain_phases: - Actions on Objectives mitre_attack_id: + - T1114 - T1114.001 product: - Splunk Enterprise diff --git a/detections/experimental/application/email_servers_sending_high_volume_traffic_to_hosts.yml b/detections/experimental/application/email_servers_sending_high_volume_traffic_to_hosts.yml index 6d87cd4cc5..9f1eaa1358 100644 --- a/detections/experimental/application/email_servers_sending_high_volume_traffic_to_hosts.yml +++ b/detections/experimental/application/email_servers_sending_high_volume_traffic_to_hosts.yml @@ -44,6 +44,7 @@ tags: kill_chain_phases: - Actions on Objectives mitre_attack_id: + - T1114 - T1114.002 nist: - PR.PT diff --git a/detections/experimental/application/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml b/detections/experimental/application/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml index 85daab2383..f89ee5ec99 100644 --- a/detections/experimental/application/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml +++ b/detections/experimental/application/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml @@ -27,6 +27,7 @@ tags: cis20: - CIS 16 mitre_attack_id: + - T1078 - T1078.001 nist: - DE.CM diff --git a/detections/experimental/application/okta_account_lockout_events.yml b/detections/experimental/application/okta_account_lockout_events.yml index 2adb262cc1..6d2455f41e 100644 --- a/detections/experimental/application/okta_account_lockout_events.yml +++ b/detections/experimental/application/okta_account_lockout_events.yml @@ -22,6 +22,7 @@ tags: cis20: - CIS 16 mitre_attack_id: + - T1078 - T1078.001 nist: - DE.CM diff --git a/detections/experimental/application/okta_failed_sso_attempts.yml b/detections/experimental/application/okta_failed_sso_attempts.yml index 4f62292be1..8320933efa 100644 --- a/detections/experimental/application/okta_failed_sso_attempts.yml +++ b/detections/experimental/application/okta_failed_sso_attempts.yml @@ -22,6 +22,7 @@ tags: cis20: - CIS 16 mitre_attack_id: + - T1078 - T1078.001 nist: - DE.CM diff --git a/detections/experimental/application/okta_user_logins_from_multiple_cities.yml b/detections/experimental/application/okta_user_logins_from_multiple_cities.yml index a394023881..11c9c14ff6 100644 --- a/detections/experimental/application/okta_user_logins_from_multiple_cities.yml +++ b/detections/experimental/application/okta_user_logins_from_multiple_cities.yml @@ -28,6 +28,7 @@ tags: cis20: - CIS 16 mitre_attack_id: + - T1078 - T1078.001 nist: - DE.CM diff --git a/detections/experimental/application/suspicious_email_attachment_extensions.yml b/detections/experimental/application/suspicious_email_attachment_extensions.yml index b4633adfe4..b489386194 100644 --- a/detections/experimental/application/suspicious_email_attachment_extensions.yml +++ b/detections/experimental/application/suspicious_email_attachment_extensions.yml @@ -40,6 +40,7 @@ tags: - Delivery mitre_attack_id: - T1566.001 + - T1566 nist: - DE.AE - PR.IP diff --git a/detections/experimental/cloud/abnormally_high_cloud_instances_destroyed.yml b/detections/experimental/cloud/abnormally_high_cloud_instances_destroyed.yml index e703c4b3e0..5f5357037d 100644 --- a/detections/experimental/cloud/abnormally_high_cloud_instances_destroyed.yml +++ b/detections/experimental/cloud/abnormally_high_cloud_instances_destroyed.yml @@ -39,6 +39,7 @@ tags: - Actions on Objectives mitre_attack_id: - T1078.004 + - T1078 nist: - DE.DP - DE.AE diff --git a/detections/experimental/cloud/abnormally_high_cloud_instances_launched.yml b/detections/experimental/cloud/abnormally_high_cloud_instances_launched.yml index 8397f01576..fdaff07d65 100644 --- a/detections/experimental/cloud/abnormally_high_cloud_instances_launched.yml +++ b/detections/experimental/cloud/abnormally_high_cloud_instances_launched.yml @@ -40,6 +40,7 @@ tags: - Actions on Objectives mitre_attack_id: - T1078.004 + - T1078 nist: - DE.DP - DE.AE diff --git a/detections/experimental/cloud/high_number_of_login_failures_from_a_single_source.yml b/detections/experimental/cloud/high_number_of_login_failures_from_a_single_source.yml index 73bfbbd7e2..5632c3731f 100644 --- a/detections/experimental/cloud/high_number_of_login_failures_from_a_single_source.yml +++ b/detections/experimental/cloud/high_number_of_login_failures_from_a_single_source.yml @@ -26,6 +26,7 @@ tags: - Actions on Objectives mitre_attack_id: - T1110.001 + - T1110 nist: - DE.DP - DE.AE diff --git a/detections/experimental/endpoint/detect_outlook_exe_writing_a_zip_file.yml b/detections/experimental/endpoint/detect_outlook_exe_writing_a_zip_file.yml index 8dd0134931..e70d615a84 100644 --- a/detections/experimental/endpoint/detect_outlook_exe_writing_a_zip_file.yml +++ b/detections/experimental/endpoint/detect_outlook_exe_writing_a_zip_file.yml @@ -41,6 +41,7 @@ tags: - Installation - Actions on Objectives mitre_attack_id: + - T1566 - T1566.001 nist: - ID.AM diff --git a/detections/experimental/endpoint/exchange_powershell_module_usage.yml b/detections/experimental/endpoint/exchange_powershell_module_usage.yml index 778cc62a5c..d987ac2c27 100644 --- a/detections/experimental/endpoint/exchange_powershell_module_usage.yml +++ b/detections/experimental/endpoint/exchange_powershell_module_usage.yml @@ -48,6 +48,7 @@ tags: - Exploitation message: Local user discovery enumeration using PowerShell on $dest$ by $user$ mitre_attack_id: + - T1059 - T1059.001 observable: - name: dest diff --git a/detections/experimental/endpoint/first_time_seen_running_windows_service.yml b/detections/experimental/endpoint/first_time_seen_running_windows_service.yml index e4db3b752f..0f221b05c8 100644 --- a/detections/experimental/endpoint/first_time_seen_running_windows_service.yml +++ b/detections/experimental/endpoint/first_time_seen_running_windows_service.yml @@ -37,6 +37,7 @@ tags: - Installation - Actions on Objectives mitre_attack_id: + - T1569 - T1569.002 nist: - ID.AM diff --git a/detections/experimental/endpoint/print_processor_registry_autostart.yml b/detections/experimental/endpoint/print_processor_registry_autostart.yml index dab28eac10..abb4c83034 100644 --- a/detections/experimental/endpoint/print_processor_registry_autostart.yml +++ b/detections/experimental/endpoint/print_processor_registry_autostart.yml @@ -37,6 +37,7 @@ tags: - Exploitation mitre_attack_id: - T1547.012 + - T1547 product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/experimental/endpoint/remote_desktop_process_running_on_system.yml b/detections/experimental/endpoint/remote_desktop_process_running_on_system.yml index cdd2a5433d..512846226c 100644 --- a/detections/experimental/endpoint/remote_desktop_process_running_on_system.yml +++ b/detections/experimental/endpoint/remote_desktop_process_running_on_system.yml @@ -38,6 +38,7 @@ tags: - Actions on Objectives mitre_attack_id: - T1021.001 + - T1021 nist: - DE.AE - PR.AC diff --git a/detections/experimental/endpoint/suspicious_plistbuddy_usage.yml b/detections/experimental/endpoint/suspicious_plistbuddy_usage.yml index f5f6319585..aa11b87cab 100644 --- a/detections/experimental/endpoint/suspicious_plistbuddy_usage.yml +++ b/detections/experimental/endpoint/suspicious_plistbuddy_usage.yml @@ -54,6 +54,7 @@ tags: - Actions on Objectives mitre_attack_id: - T1543.001 + - T1543 product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/experimental/endpoint/suspicious_plistbuddy_usage_via_osquery.yml b/detections/experimental/endpoint/suspicious_plistbuddy_usage_via_osquery.yml index 89642145e4..88e0be8d4e 100644 --- a/detections/experimental/endpoint/suspicious_plistbuddy_usage_via_osquery.yml +++ b/detections/experimental/endpoint/suspicious_plistbuddy_usage_via_osquery.yml @@ -49,6 +49,7 @@ tags: - Actions on Objectives mitre_attack_id: - T1543.001 + - T1543 product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/experimental/network/detect_arp_poisoning.yml b/detections/experimental/network/detect_arp_poisoning.yml index 613adbe10f..e6a11d65d8 100644 --- a/detections/experimental/network/detect_arp_poisoning.yml +++ b/detections/experimental/network/detect_arp_poisoning.yml @@ -37,6 +37,7 @@ tags: mitre_attack_id: - T1200 - T1498 + - T1557 - T1557.002 nist: - ID.AM diff --git a/detections/experimental/network/detect_ipv6_network_infrastructure_threats.yml b/detections/experimental/network/detect_ipv6_network_infrastructure_threats.yml index 418a0cb16a..edcb6b026a 100644 --- a/detections/experimental/network/detect_ipv6_network_infrastructure_threats.yml +++ b/detections/experimental/network/detect_ipv6_network_infrastructure_threats.yml @@ -48,6 +48,7 @@ tags: mitre_attack_id: - T1200 - T1498 + - T1557 - T1557.002 nist: - ID.AM diff --git a/detections/experimental/network/detect_outbound_smb_traffic.yml b/detections/experimental/network/detect_outbound_smb_traffic.yml index 1d7072fd2d..ac78f31672 100644 --- a/detections/experimental/network/detect_outbound_smb_traffic.yml +++ b/detections/experimental/network/detect_outbound_smb_traffic.yml @@ -50,6 +50,7 @@ tags: - Command and Control mitre_attack_id: - T1071.002 + - T1071 nist: - DE.CM product: diff --git a/detections/experimental/network/detect_port_security_violation.yml b/detections/experimental/network/detect_port_security_violation.yml index 178f235bf4..8192b5d516 100644 --- a/detections/experimental/network/detect_port_security_violation.yml +++ b/detections/experimental/network/detect_port_security_violation.yml @@ -47,6 +47,7 @@ tags: mitre_attack_id: - T1200 - T1498 + - T1557 - T1557.002 nist: - ID.AM diff --git a/detections/experimental/network/detect_software_download_to_network_device.yml b/detections/experimental/network/detect_software_download_to_network_device.yml index 7e4b4d3055..3f0c9dfe91 100644 --- a/detections/experimental/network/detect_software_download_to_network_device.yml +++ b/detections/experimental/network/detect_software_download_to_network_device.yml @@ -40,6 +40,7 @@ tags: - Delivery mitre_attack_id: - T1542.005 + - T1542 nist: - ID.AM - PR.DS diff --git a/detections/experimental/network/detect_traffic_mirroring.yml b/detections/experimental/network/detect_traffic_mirroring.yml index 341c3a929b..61e09c25b5 100644 --- a/detections/experimental/network/detect_traffic_mirroring.yml +++ b/detections/experimental/network/detect_traffic_mirroring.yml @@ -38,6 +38,7 @@ tags: - Actions on Objectives mitre_attack_id: - T1200 + - T1020 - T1498 - T1020.001 nist: diff --git a/detections/experimental/network/dns_query_length_outliers___mltk.yml b/detections/experimental/network/dns_query_length_outliers___mltk.yml index 03f5388f72..31cdbc34f6 100644 --- a/detections/experimental/network/dns_query_length_outliers___mltk.yml +++ b/detections/experimental/network/dns_query_length_outliers___mltk.yml @@ -60,6 +60,7 @@ tags: - Command and Control mitre_attack_id: - T1071.004 + - T1071 nist: - PR.PT - DE.AE diff --git a/detections/experimental/network/excessive_dns_failures.yml b/detections/experimental/network/excessive_dns_failures.yml index c2d8316ce3..cb94803ee8 100644 --- a/detections/experimental/network/excessive_dns_failures.yml +++ b/detections/experimental/network/excessive_dns_failures.yml @@ -34,6 +34,7 @@ tags: - Command and Control mitre_attack_id: - T1071.004 + - T1071 nist: - PR.PT - DE.AE diff --git a/detections/experimental/network/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml b/detections/experimental/network/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml index 7cfb188bc5..5aa0990151 100644 --- a/detections/experimental/network/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml +++ b/detections/experimental/network/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml @@ -44,6 +44,7 @@ tags: - Actions on Objectives mitre_attack_id: - T1114.002 + - T1114 nist: - PR.PT - DE.CM diff --git a/detections/experimental/network/large_volume_of_dns_any_queries.yml b/detections/experimental/network/large_volume_of_dns_any_queries.yml index cb209f823c..2e0b991cb7 100644 --- a/detections/experimental/network/large_volume_of_dns_any_queries.yml +++ b/detections/experimental/network/large_volume_of_dns_any_queries.yml @@ -27,6 +27,7 @@ tags: kill_chain_phases: - Actions on Objectives mitre_attack_id: + - T1498 - T1498.002 nist: - PR.PT diff --git a/detections/experimental/network/protocol_or_port_mismatch.yml b/detections/experimental/network/protocol_or_port_mismatch.yml index a20dc93a0f..b322fb9b11 100644 --- a/detections/experimental/network/protocol_or_port_mismatch.yml +++ b/detections/experimental/network/protocol_or_port_mismatch.yml @@ -38,6 +38,7 @@ tags: - Command and Control mitre_attack_id: - T1048.003 + - T1048 nist: - DE.AE - PR.AC diff --git a/detections/experimental/network/remote_desktop_network_bruteforce.yml b/detections/experimental/network/remote_desktop_network_bruteforce.yml index 5b09dc86c4..5994b5c9fa 100644 --- a/detections/experimental/network/remote_desktop_network_bruteforce.yml +++ b/detections/experimental/network/remote_desktop_network_bruteforce.yml @@ -34,6 +34,7 @@ tags: - Delivery mitre_attack_id: - T1021.001 + - T1021 nist: - DE.AE - PR.AC diff --git a/detections/experimental/network/remote_desktop_network_traffic.yml b/detections/experimental/network/remote_desktop_network_traffic.yml index 52b3cf7198..a3148b01dd 100644 --- a/detections/experimental/network/remote_desktop_network_traffic.yml +++ b/detections/experimental/network/remote_desktop_network_traffic.yml @@ -42,6 +42,7 @@ tags: - Actions on Objectives mitre_attack_id: - T1021.001 + - T1021 nist: - DE.AE - PR.AC diff --git a/detections/experimental/network/smb_traffic_spike.yml b/detections/experimental/network/smb_traffic_spike.yml index baa84760a4..a62819f41c 100644 --- a/detections/experimental/network/smb_traffic_spike.yml +++ b/detections/experimental/network/smb_traffic_spike.yml @@ -34,6 +34,7 @@ tags: - Actions on Objectives mitre_attack_id: - T1021.002 + - T1021 nist: - DE.CM product: diff --git a/detections/experimental/network/smb_traffic_spike___mltk.yml b/detections/experimental/network/smb_traffic_spike___mltk.yml index 3964f2025d..cd37b1f69a 100644 --- a/detections/experimental/network/smb_traffic_spike___mltk.yml +++ b/detections/experimental/network/smb_traffic_spike___mltk.yml @@ -55,6 +55,7 @@ tags: - Actions on Objectives mitre_attack_id: - T1021.002 + - T1021 nist: - DE.CM product: diff --git a/detections/experimental/network/tor_traffic.yml b/detections/experimental/network/tor_traffic.yml index 9365a50b95..3bafb42c04 100644 --- a/detections/experimental/network/tor_traffic.yml +++ b/detections/experimental/network/tor_traffic.yml @@ -34,6 +34,7 @@ tags: kill_chain_phases: - Command and Control mitre_attack_id: + - T1071 - T1071.001 nist: - DE.AE diff --git a/detections/network/dns_query_length_with_high_standard_deviation.yml b/detections/network/dns_query_length_with_high_standard_deviation.yml index 7104cb9a50..105b215693 100644 --- a/detections/network/dns_query_length_with_high_standard_deviation.yml +++ b/detections/network/dns_query_length_with_high_standard_deviation.yml @@ -43,6 +43,7 @@ tags: query in host $host$ mitre_attack_id: - T1048.003 + - T1048 nist: - PR.PT - DE.AE diff --git a/detections/network/multiple_archive_files_http_post_traffic.yml b/detections/network/multiple_archive_files_http_post_traffic.yml index 94df920e8f..5fb5ffc2ba 100644 --- a/detections/network/multiple_archive_files_http_post_traffic.yml +++ b/detections/network/multiple_archive_files_http_post_traffic.yml @@ -49,6 +49,7 @@ tags: 4form_data$ in uri path $uri_path$ mitre_attack_id: - T1048.003 + - T1048 observable: - name: uri_path type: UriPath diff --git a/detections/network/plain_http_post_exfiltrated_data.yml b/detections/network/plain_http_post_exfiltrated_data.yml index 359dcbdc1b..3716f34a17 100644 --- a/detections/network/plain_http_post_exfiltrated_data.yml +++ b/detections/network/plain_http_post_exfiltrated_data.yml @@ -39,6 +39,7 @@ tags: $form_data$ in uri path $uri_path$ mitre_attack_id: - T1048.003 + - T1048 observable: - name: uri_path type: UriPath