diff --git a/detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml b/detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml index e89d86ee6d..6fb8eb7b87 100644 --- a/detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml +++ b/detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml @@ -90,4 +90,5 @@ tags: - Processes.parent_process_name - Processes.parent_process risk_score: 42 + risk_severity: medium security_domain: endpoint diff --git a/detections/endpoint/ssa___attempt_to_delete_services.yml b/detections/endpoint/ssa___attempt_to_delete_services.yml index 37a8db1a5c..ff67a74465 100644 --- a/detections/endpoint/ssa___attempt_to_delete_services.yml +++ b/detections/endpoint/ssa___attempt_to_delete_services.yml @@ -101,5 +101,5 @@ tags: - process - cmd_line risk_score: 36 - risk_severity: high + risk_severity: low security_domain: endpoint diff --git a/detections/endpoint/ssa___attempt_to_disable_services.yml b/detections/endpoint/ssa___attempt_to_disable_services.yml index 0fab7f851a..7b70b7e645 100644 --- a/detections/endpoint/ssa___attempt_to_disable_services.yml +++ b/detections/endpoint/ssa___attempt_to_disable_services.yml @@ -100,5 +100,5 @@ tags: - dest_user_id - process risk_score: 36 - risk_severity: medium + risk_severity: low security_domain: endpoint diff --git a/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml b/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml index 66c2efedba..8350b2a4c2 100644 --- a/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml @@ -91,5 +91,5 @@ tags: - process - cmd_line risk_score: 63 - risk_severity: low + risk_severity: medium security_domain: endpoint diff --git a/detections/endpoint/ssa___delete_a_net_user.yml b/detections/endpoint/ssa___delete_a_net_user.yml index 1398f6f0b3..2649950aeb 100644 --- a/detections/endpoint/ssa___delete_a_net_user.yml +++ b/detections/endpoint/ssa___delete_a_net_user.yml @@ -101,5 +101,5 @@ tags: - process - cmd_line risk_score: 49 - risk_severity: high + risk_severity: low security_domain: endpoint diff --git a/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml b/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml index a9754099bb..94b379cc7e 100644 --- a/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml +++ b/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml @@ -86,5 +86,5 @@ tags: - process - cmd_line risk_score: 35 - risk_severity: medium + risk_severity: low security_domain: endpoint diff --git a/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml b/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml index 7564406c0b..e3eb01fb36 100644 --- a/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml +++ b/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml @@ -81,5 +81,5 @@ tags: - dest_device_id - process risk_score: 70 - risk_severity: low + risk_severity: medium security_domain: endpoint diff --git a/detections/endpoint/ssa___detect_rclone_command_line_usage.yml b/detections/endpoint/ssa___detect_rclone_command_line_usage.yml index db3d3d22b6..9623b22be4 100644 --- a/detections/endpoint/ssa___detect_rclone_command_line_usage.yml +++ b/detections/endpoint/ssa___detect_rclone_command_line_usage.yml @@ -102,4 +102,5 @@ tags: - process - cmd_line risk_score: 35 + risk_severity: low security_domain: endpoint diff --git a/detections/endpoint/ssa___disable_net_user_account.yml b/detections/endpoint/ssa___disable_net_user_account.yml index 144f247d1f..f998a177bb 100644 --- a/detections/endpoint/ssa___disable_net_user_account.yml +++ b/detections/endpoint/ssa___disable_net_user_account.yml @@ -99,5 +99,5 @@ tags: - process - cmd_line risk_score: 49 - risk_severity: medium + risk_severity: low security_domain: endpoint diff --git a/detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml b/detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml index 77db823035..5e84a50e80 100644 --- a/detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml +++ b/detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml @@ -99,4 +99,5 @@ tags: - process - cmd_line risk_score: 72 + risk_severity: medium security_domain: endpoint diff --git a/detections/endpoint/ssa___excessive_number_of_office_files_copied.yml b/detections/endpoint/ssa___excessive_number_of_office_files_copied.yml index 35db99ed94..3bc28c58de 100644 --- a/detections/endpoint/ssa___excessive_number_of_office_files_copied.yml +++ b/detections/endpoint/ssa___excessive_number_of_office_files_copied.yml @@ -60,4 +60,5 @@ tags: - file_name - file_path risk_score: 72 + risk_severity: medium security_domain: endpoint diff --git a/detections/endpoint/ssa___fsutil_zeroing_file.yml b/detections/endpoint/ssa___fsutil_zeroing_file.yml index 3f5f349de7..ace76454f3 100644 --- a/detections/endpoint/ssa___fsutil_zeroing_file.yml +++ b/detections/endpoint/ssa___fsutil_zeroing_file.yml @@ -93,7 +93,7 @@ tags: - process - cmd_line risk_score: 54 - risk_severity: high + risk_severity: medium security_domain: endpoint dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/fsutil_file_zero/windows-security.log \ No newline at end of file diff --git a/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml b/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml index 4598573c3e..c91231282f 100644 --- a/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml +++ b/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml @@ -86,5 +86,5 @@ tags: - process - cmd_line risk_score: 35 - risk_severity: medium + risk_severity: low security_domain: endpoint diff --git a/detections/endpoint/ssa___high_file_deletion_frequency.yml b/detections/endpoint/ssa___high_file_deletion_frequency.yml index cf141cb98f..aacc8749a2 100644 --- a/detections/endpoint/ssa___high_file_deletion_frequency.yml +++ b/detections/endpoint/ssa___high_file_deletion_frequency.yml @@ -81,4 +81,5 @@ tags: - file_name - file_path risk_score: 72 + risk_severity: medium security_domain: endpoint diff --git a/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml b/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml index 0f1695edd8..39b7b83779 100644 --- a/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml +++ b/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml @@ -88,5 +88,5 @@ tags: - process - cmd_line risk_score: 35 - risk_severity: medium + risk_severity: low security_domain: endpoint diff --git a/detections/endpoint/ssa___potential_pass_the_token_or_hash_observed_at_the_destination_device.yml b/detections/endpoint/ssa___potential_pass_the_token_or_hash_observed_at_the_destination_device.yml index 2641b82626..d146cb2cf7 100644 --- a/detections/endpoint/ssa___potential_pass_the_token_or_hash_observed_at_the_destination_device.yml +++ b/detections/endpoint/ssa___potential_pass_the_token_or_hash_observed_at_the_destination_device.yml @@ -101,5 +101,5 @@ tags: - dest_device_id - authentication_method risk_score: 72 - risk_severity: high + risk_severity: medium security_domain: endpoint diff --git a/detections/endpoint/ssa___potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml b/detections/endpoint/ssa___potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml index c47ec3d479..34a2576e2e 100644 --- a/detections/endpoint/ssa___potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml +++ b/detections/endpoint/ssa___potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml @@ -105,5 +105,5 @@ tags: - origin_device_id - authentication_method risk_score: 64 - risk_severity: high + risk_severity: medium security_domain: endpoint diff --git a/detections/endpoint/ssa___resize_shadowstorage_volume.yml b/detections/endpoint/ssa___resize_shadowstorage_volume.yml index c966137cac..1d8c9d080d 100644 --- a/detections/endpoint/ssa___resize_shadowstorage_volume.yml +++ b/detections/endpoint/ssa___resize_shadowstorage_volume.yml @@ -99,5 +99,5 @@ tags: - process - cmd_line risk_score: 64 - risk_severity: high + risk_severity: medium security_domain: endpoint diff --git a/detections/endpoint/ssa___sdelete_application_execution.yml b/detections/endpoint/ssa___sdelete_application_execution.yml index add26adc2a..2c30657d9e 100644 --- a/detections/endpoint/ssa___sdelete_application_execution.yml +++ b/detections/endpoint/ssa___sdelete_application_execution.yml @@ -106,4 +106,5 @@ tags: - process_path - cmd_line risk_score: 42 + risk_severity: low security_domain: endpoint diff --git a/detections/endpoint/ssa___system_process_running_from_unexpected_location.yml b/detections/endpoint/ssa___system_process_running_from_unexpected_location.yml index f50ce8ee66..99061887dd 100644 --- a/detections/endpoint/ssa___system_process_running_from_unexpected_location.yml +++ b/detections/endpoint/ssa___system_process_running_from_unexpected_location.yml @@ -286,5 +286,5 @@ tags: - dest_user_id - process_path risk_score: 56 - risk_severity: low + risk_severity: medium security_domain: endpoint diff --git a/detections/endpoint/ssa___wbadmin_delete_system_backups.yml b/detections/endpoint/ssa___wbadmin_delete_system_backups.yml index f63ad31773..a0d95581ea 100644 --- a/detections/endpoint/ssa___wbadmin_delete_system_backups.yml +++ b/detections/endpoint/ssa___wbadmin_delete_system_backups.yml @@ -97,7 +97,7 @@ tags: - process - cmd_line risk_score: 15 - risk_severity: high + risk_severity: low security_domain: endpoint dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-security_bcdedit_wbadmin.log \ No newline at end of file diff --git a/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml b/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml index 09c5dad150..6447e89bbc 100644 --- a/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml +++ b/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml @@ -86,5 +86,5 @@ tags: - dest_user_id - process risk_score: 63 - risk_severity: high + risk_severity: medium security_domain: endpoint diff --git a/detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml b/detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml index b10b699ccd..8f9be39664 100644 --- a/detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml +++ b/detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml @@ -110,4 +110,5 @@ tags: - process - cmd_line risk_score: 80 + risk_severity: high security_domain: endpoint