diff --git a/bin/content_changer.py b/bin/content_changer.py new file mode 100644 index 0000000000..69e1cddb07 --- /dev/null +++ b/bin/content_changer.py @@ -0,0 +1,75 @@ +import glob +import yaml +import sys +import re +import argparse + +from os import path + + +def load_objects(file_path, REPO_PATH): + files = [] + manifest_files = path.join(path.expanduser(REPO_PATH), file_path) + for file in sorted(glob.glob(manifest_files)): + files.append(load_file(file)) + return files + + +def load_file(file_path): + with open(file_path, 'r', encoding="utf-8") as stream: + try: + file = list(yaml.safe_load_all(stream))[0] + except yaml.YAMLError as exc: + print(exc) + sys.exit("ERROR: reading {0}".format(file_path)) + return file + + +def load_content(old_project): + stories = load_objects("stories/*.yml", old_project) + macros = load_objects("macros/*.yml", old_project) + lookups = load_objects("lookups/*.yml", old_project) + baselines = load_objects("baselines/*.yml", old_project) + responses = load_objects("responses/*.yml", old_project) + response_tasks = load_objects("response_tasks/*.yml", old_project) + deployments = load_objects("deployments/*.yml", old_project) + + # process all detections + detections = [] + detections = load_objects("detections/*/*.yml", old_project) + detections.extend(load_objects("detections/*/*/*.yml", old_project)) + + #print(len(detections)) + + return detections, stories, macros, lookups, baselines, responses, response_tasks, deployments + + +def add_required_field(detections, new_project): + #for detection in detections: + matches = re.findall(r'(?[^\s]*)=', detections[0]) + for match in matches: + print(match) + + +def main(new_project, old_project, change): + + detections, stories, macros, lookups, baselines, responses, response_tasks, deployments = load_content(old_project) + + if change == "add_required_field": + add_required_field(detections, new_project) + + +if __name__ == "__main__": + + parser = argparse.ArgumentParser(description="applies security content changes to the whole project") + parser.add_argument("-np", "--new_project", required=True, help="the security content project to write the new configs in to") + parser.add_argument("-op", "--old_project", required=True, help="the security content project to read the files from") + parser.add_argument("-c", "--change", required=True, help="the name of your change") + + # parse them + args = parser.parse_args() + new_project = args.new_project + old_project = args.old_project + change = args.change + + main(new_project, old_project, change) diff --git a/bin/jinja2_templates/detection.j2 b/bin/jinja2_templates/detection.j2 index b4b366a8c9..fe3cd6ce85 100644 --- a/bin/jinja2_templates/detection.j2 +++ b/bin/jinja2_templates/detection.j2 @@ -31,3 +31,5 @@ tags: {% for product in products -%} - {{product}} {% endfor -%} + required_fields: + - _time \ No newline at end of file diff --git a/bin/validate.py b/bin/validate.py index 15dfad5b0e..e314029aac 100644 --- a/bin/validate.py +++ b/bin/validate.py @@ -79,6 +79,7 @@ def validate_objects(REPO_PATH, objects, verbose): for object in objects['detections']: if object['type'] == 'batch': errors = errors + validate_detection_search(object, objects['macros']) + errors = errors + validate_fields(object) for object in objects['baselines']: errors = errors + validate_baseline_search(object, objects['macros']) @@ -88,6 +89,21 @@ def validate_objects(REPO_PATH, objects, verbose): return errors +def validate_fields(object): + errors = [] + + if 'tags' in object: + + # check if required_fields is present + if 'required_fields' not in object['tags']: + errors.append("ERROR: a `required_fields` tag is required for object: %s" % object['name']) + + if 'security_domain' not in object['tags']: + errors.append("ERROR: a `security_domain` tag is required for object: %s" % object['name']) + + return errors + + def validate_standard_fields(object, uuids): errors = [] diff --git a/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml b/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml index c1ff376df3..06fd6b105a 100644 --- a/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml +++ b/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml @@ -46,6 +46,11 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - All_Changes.command + - All_Changes.user + - All_Changes.status risk_object: user risk_object_type: user risk_score: 25 diff --git a/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml b/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml index d0d3e0896f..4aa1e3f506 100644 --- a/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml +++ b/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml @@ -47,6 +47,12 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - All_Changes.command + - All_Changes.object_category + - All_Changes.status + - All_Changes.user risk_object: user risk_object_type: user risk_score: 25 diff --git a/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml b/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml index 031dc0314f..c665a5fac0 100644 --- a/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml +++ b/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml @@ -50,6 +50,13 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Authentication.signature + - Authentication.vendor_account + - Authentication.user + - Authentication.user_role + - Authentication.src risk_object: user risk_object_type: user risk_score: 15 diff --git a/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml b/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml index a4908609fa..13b68bb5cf 100644 --- a/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml +++ b/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml @@ -38,4 +38,12 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - eventName + - eventSource + - eventID + - awsRegion + - requestParameters.policy + - userIdentity.principalId security_domain: threat diff --git a/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml b/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml index 4d6aa650a2..1e41b38fcb 100644 --- a/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml +++ b/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml @@ -33,4 +33,13 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - eventName + - requestParameters.x-amz-server-side-encryption + - requestParameters.bucketName + - requestParameters.x-amz-copy-source + - requestParameters.key + - userAgent + - region security_domain: threat diff --git a/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml b/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml index d7139b27ac..83225223b0 100644 --- a/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml +++ b/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml @@ -44,6 +44,18 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - eventName + - requestParameters.ruleAction + - requestParameters.egress + - requestParameters.aclProtocol + - requestParameters.portRange.to + - requestParameters.portRange.from + - requestParameters.cidrBlock + - userName + - userIdentity.principalId + - userAgent risk_object: userName risk_object_type: user risk_score: 10 diff --git a/detections/cloud/aws_network_access_control_list_deleted.yml b/detections/cloud/aws_network_access_control_list_deleted.yml index 8e46d7d836..2316056954 100644 --- a/detections/cloud/aws_network_access_control_list_deleted.yml +++ b/detections/cloud/aws_network_access_control_list_deleted.yml @@ -40,6 +40,14 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - eventName + - requestParameters.egress + - userName + - userIdentity.principalId + - src + - userAgent risk_object: userName risk_object_type: user risk_score: 5 diff --git a/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml b/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml index 12cbf5c08b..8779e8b718 100644 --- a/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml +++ b/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml @@ -40,4 +40,14 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - eventName + - requestParameters.principalArn + - requestParameters.roleArn + - requestParameters.roleSessionName + - recipientAccountId + - responseElements.issuer + - sourceIPAddress + - userAgent security_domain: threat diff --git a/detections/cloud/aws_saml_update_identity_provider.yml b/detections/cloud/aws_saml_update_identity_provider.yml index dcb2dc6493..fafce5a632 100644 --- a/detections/cloud/aws_saml_update_identity_provider.yml +++ b/detections/cloud/aws_saml_update_identity_provider.yml @@ -36,4 +36,13 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - eventName + - eventType + - requestParameters.sAMLProviderArn + - userIdentity.sessionContext.sessionIssuer.arn + - sourceIPAddress + - userIdentity.accessKeyId + - userIdentity.principalId security_domain: threat diff --git a/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml b/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml index 6df67d5086..6e4aee9e77 100644 --- a/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml +++ b/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml @@ -44,6 +44,13 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - All_Changes.user + - All_Changes.user_type + - All_Changes.status + - All_Changes.command + - All_Changes.object risk_object: user risk_object_type: user risk_score: 25 diff --git a/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml b/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml index 3d7badf4fb..6d8f20e18d 100644 --- a/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml +++ b/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml @@ -42,6 +42,12 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - All_Changes.object + - All_Changes.action + - All_Changes.user + - All_Changes.vendor_region risk_object: user risk_object_type: user risk_score: 20 diff --git a/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml b/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml index 978fde7bf0..5181900d57 100644 --- a/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml +++ b/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml @@ -48,6 +48,12 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - All_Changes.object_id + - All_Changes.action + - All_Changes.vendor_region + - All_Changes.user risk_object: user risk_object_type: user risk_score: 20 diff --git a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml index d0929d8ea7..068b7651d9 100644 --- a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml +++ b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml @@ -43,6 +43,12 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - All_Changes.object_id + - All_Changes.action + - All_Changes.Instance_Changes.image_id + - All_Changes.user risk_object: user risk_object_type: user risk_score: 20 diff --git a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml index 4aeac30448..30e8096950 100644 --- a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml +++ b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml @@ -43,6 +43,12 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - All_Changes.object_id + - All_Changes.action + - All_Changes.Instance_Changes.instance_type + - All_Changes.user risk_object: user risk_object_type: user risk_score: 20 diff --git a/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml b/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml index aa780adff6..810320d61c 100644 --- a/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml +++ b/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml @@ -43,6 +43,14 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - All_Changes.object_id + - All_Changes.command + - All_Changes.action + - All_Changes.change_type + - All_Changes.status + - All_Changes.user risk_object: user risk_object_type: user risk_score: 10 diff --git a/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml b/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml index 8c643b706c..aa1b0b25d6 100644 --- a/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml +++ b/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml @@ -58,6 +58,14 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - All_Changes.action + - All_Changes.status + - All_Changes.src + - All_Changes.user + - All_Changes.object + - All_Changes.command risk_object: user risk_object_type: user risk_score: 10 diff --git a/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml b/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml index fbb48af47f..daa8caf0d3 100644 --- a/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml +++ b/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml @@ -58,6 +58,14 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - All_Changes.action + - All_Changes.status + - All_Changes.src + - All_Changes.user + - All_Changes.object + - All_Changes.command risk_object: user risk_object_type: user risk_score: 5 diff --git a/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml b/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml index e509bcbc4a..b96889ae17 100644 --- a/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml +++ b/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml @@ -57,6 +57,14 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - All_Changes.object_id + - All_Changes.action + - All_Changes.status + - All_Changes.src + - All_Changes.user + - All_Changes.command risk_object: user risk_object_type: user risk_score: 5 diff --git a/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml b/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml index 20f142f9ab..41446e109c 100644 --- a/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml +++ b/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml @@ -58,6 +58,14 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - All_Changes.action + - All_Changes.status + - All_Changes.src + - All_Changes.user + - All_Changes.object + - All_Changes.command risk_object: user risk_object_type: user risk_score: 5 diff --git a/detections/cloud/detect_aws_console_login_by_new_user.yml b/detections/cloud/detect_aws_console_login_by_new_user.yml index 0aafdb8a6d..22b17e8a28 100644 --- a/detections/cloud/detect_aws_console_login_by_new_user.yml +++ b/detections/cloud/detect_aws_console_login_by_new_user.yml @@ -48,6 +48,10 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Authentication.signature + - Authentication.user risk_object: user risk_object_type: user risk_score: 30 diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml index f1da78bdcd..bb25888484 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml @@ -56,6 +56,11 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Authentication.signature + - Authentication.user + - Authentication.src risk_object: user risk_object_type: user risk_score: 5 diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml index 49329e47c4..fd6b5eb1b2 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml @@ -56,6 +56,11 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Authentication.signature + - Authentication.user + - Authentication.src risk_object: user risk_object_type: user risk_score: 5 diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml index 965ab4d574..a87c40ec8d 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml @@ -56,6 +56,11 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Authentication.signature + - Authentication.user + - Authentication.src risk_object: user risk_object_type: user risk_score: 5 diff --git a/detections/cloud/detect_new_open_s3_buckets.yml b/detections/cloud/detect_new_open_s3_buckets.yml index 7de7edd00e..edfa3321b1 100644 --- a/detections/cloud/detect_new_open_s3_buckets.yml +++ b/detections/cloud/detect_new_open_s3_buckets.yml @@ -43,6 +43,16 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - eventSource + - eventName + - requestParameters.bucketName + - userName + - userIdentity.principalId + - userAgent + - uri + - permission risk_object: src risk_object_type: system risk_score: 20 diff --git a/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml b/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml index 83af071e38..f7fcd7be69 100644 --- a/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml +++ b/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml @@ -44,6 +44,19 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - eventSource + - eventName + - requestParameters.accessControlList.x-amz-grant-read-acp + - requestParameters.accessControlList.x-amz-grant-write + - requestParameters.accessControlList.x-amz-grant-write-acp + - requestParameters.accessControlList.x-amz-grant-full-control + - requestParameters.bucketName + - userName + - userIdentity.principalId + - userAgent + - bucketName risk_object: src risk_object_type: system risk_score: 20 diff --git a/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml b/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml index f5081516f4..31fe5591f0 100644 --- a/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml +++ b/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml @@ -36,4 +36,13 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Resources{}.Type + - Title + - Types{} + - vendor_account + - vendor_region + - severity + - dest security_domain: network diff --git a/detections/cloud/o365_add_app_role_assignment_grant_user.yml b/detections/cloud/o365_add_app_role_assignment_grant_user.yml index 216d2d9ccd..7ead7f5ed4 100644 --- a/detections/cloud/o365_add_app_role_assignment_grant_user.yml +++ b/detections/cloud/o365_add_app_role_assignment_grant_user.yml @@ -36,4 +36,13 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Workload + - Operation + - Actor{}.ID + - Actor{}.Type + - ActorIpAddress + - dest + - ResultStatus security_domain: threat diff --git a/detections/cloud/o365_added_service_principal.yml b/detections/cloud/o365_added_service_principal.yml index 02c1ab2d47..ab9b6d5504 100644 --- a/detections/cloud/o365_added_service_principal.yml +++ b/detections/cloud/o365_added_service_principal.yml @@ -39,4 +39,13 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Workload + - signature + - Actor{}.ID + - ModifiedProperties{}.Name + - ModifiedProperties{}.NewValue + - Target{}.ID + - ActorIpAddress security_domain: threat diff --git a/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml b/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml index 068ee74a67..aa8da9e19c 100644 --- a/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml +++ b/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml @@ -39,4 +39,16 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - signature + - ModifiedProperties{}.Name + - ModifiedProperties{}.NewValue + - ModifiedProperties{}.OldValue + - user + - vendor_product + - vendor_account + - status + - user_id + - action security_domain: threat diff --git a/detections/cloud/o365_disable_mfa.yml b/detections/cloud/o365_disable_mfa.yml index 6f2bafe120..609709daf6 100644 --- a/detections/cloud/o365_disable_mfa.yml +++ b/detections/cloud/o365_disable_mfa.yml @@ -32,4 +32,13 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Operation + - UserType + - user + - status + - signature + - dest + - ResultStatus security_domain: threat diff --git a/detections/cloud/o365_excessive_authentication_failures_alert.yml b/detections/cloud/o365_excessive_authentication_failures_alert.yml index 7bed02ff02..4b74f9b26f 100644 --- a/detections/cloud/o365_excessive_authentication_failures_alert.yml +++ b/detections/cloud/o365_excessive_authentication_failures_alert.yml @@ -33,4 +33,12 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Workload + - UserAuthenticationMethod + - status + - UserAgent + - src_ip + - user security_domain: threat diff --git a/detections/cloud/o365_excessive_sso_logon_errors.yml b/detections/cloud/o365_excessive_sso_logon_errors.yml index cb3a984dda..1fcf85f297 100644 --- a/detections/cloud/o365_excessive_sso_logon_errors.yml +++ b/detections/cloud/o365_excessive_sso_logon_errors.yml @@ -34,4 +34,11 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Workload + - LogonError + - ActorIpAddress + - UserAgent + - UserId security_domain: threat diff --git a/detections/cloud/o365_new_federated_domain_added.yml b/detections/cloud/o365_new_federated_domain_added.yml index 9de591d753..0e656e7e1b 100644 --- a/detections/cloud/o365_new_federated_domain_added.yml +++ b/detections/cloud/o365_new_federated_domain_added.yml @@ -38,4 +38,14 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Workload + - Operation + - Parameters{}.Value + - ObjectId + - OrganizationName + - OriginatingServer + - UserId + - UserKey security_domain: threat diff --git a/detections/cloud/o365_pst_export_alert.yml b/detections/cloud/o365_pst_export_alert.yml index ff9b4fdc02..420be7017e 100644 --- a/detections/cloud/o365_pst_export_alert.yml +++ b/detections/cloud/o365_pst_export_alert.yml @@ -33,4 +33,12 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Category + - Name + - Source + - Severity + - AlertEntityId + - Operation security_domain: threat diff --git a/detections/cloud/o365_suspicious_admin_email_forwarding.yml b/detections/cloud/o365_suspicious_admin_email_forwarding.yml index 0b68dd9f0f..f418add03f 100644 --- a/detections/cloud/o365_suspicious_admin_email_forwarding.yml +++ b/detections/cloud/o365_suspicious_admin_email_forwarding.yml @@ -35,4 +35,8 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Operation + - Parameters security_domain: threat diff --git a/detections/cloud/o365_suspicious_rights_delegation.yml b/detections/cloud/o365_suspicious_rights_delegation.yml index 7c149be71d..f0c22f923a 100644 --- a/detections/cloud/o365_suspicious_rights_delegation.yml +++ b/detections/cloud/o365_suspicious_rights_delegation.yml @@ -35,4 +35,8 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Operation + - Parameters security_domain: threat diff --git a/detections/cloud/o365_suspicious_user_email_forwarding.yml b/detections/cloud/o365_suspicious_user_email_forwarding.yml index 11df462b65..a4ec07f404 100644 --- a/detections/cloud/o365_suspicious_user_email_forwarding.yml +++ b/detections/cloud/o365_suspicious_user_email_forwarding.yml @@ -35,4 +35,8 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Operation + - Parameters security_domain: threat diff --git a/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml b/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml index 04a951ed8e..a44431f914 100644 --- a/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml +++ b/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml @@ -42,6 +42,11 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - eventName + - errorCode + - userName risk_object: userName risk_object_type: user risk_score: 40 diff --git a/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml b/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml index 1f65472313..973b6ebad2 100644 --- a/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml +++ b/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml @@ -38,6 +38,11 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - eventName + - errorCode + - src_user risk_object: src_usr risk_object_type: user risk_score: 10 diff --git a/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml b/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml index 3a96f41ae8..4f88ebd63b 100644 --- a/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml +++ b/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml @@ -42,4 +42,9 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - eventName + - errorCode + - userName security_domain: network diff --git a/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml b/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml index da395bc609..1e39f9d453 100644 --- a/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml +++ b/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml @@ -37,4 +37,9 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - eventName + - errorCode + - src_user security_domain: network diff --git a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_city.yml b/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_city.yml index cd02a37e25..2118ac34bf 100644 --- a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_city.yml +++ b/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_city.yml @@ -50,6 +50,10 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - eventName + - sourceIPAddress risk_object: user risk_object_type: user risk_score: 25 diff --git a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_country.yml b/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_country.yml index 97a40cd24b..31db418f11 100644 --- a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_country.yml +++ b/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_country.yml @@ -51,4 +51,8 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - eventName + - sourceIPAddress security_domain: endpoint diff --git a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_ip_address.yml b/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_ip_address.yml index d143b96e1c..406eb9da21 100644 --- a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_ip_address.yml +++ b/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_ip_address.yml @@ -48,4 +48,8 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - eventName + - sourceIPAddress security_domain: endpoint diff --git a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_region.yml b/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_region.yml index ed27f7f87a..d941969ac2 100644 --- a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_region.yml +++ b/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_region.yml @@ -50,4 +50,8 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - eventName + - sourceIPAddress security_domain: endpoint diff --git a/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml b/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml index 20ba2b6cd7..e41a79e878 100644 --- a/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml +++ b/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml @@ -51,4 +51,9 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - DNS.dest + - DNS.message_type + - DNS.src security_domain: network diff --git a/detections/deprecated/cloud_network_access_control_list_deleted.yml b/detections/deprecated/cloud_network_access_control_list_deleted.yml index 5dad492a18..84f2ff7b20 100644 --- a/detections/deprecated/cloud_network_access_control_list_deleted.yml +++ b/detections/deprecated/cloud_network_access_control_list_deleted.yml @@ -36,4 +36,14 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - eventName + - userIdentity.arn + - errorMessage + - errorCode + - userAgent + - src + - userName + - arn security_domain: network diff --git a/detections/deprecated/detect_api_activity_from_users_without_mfa.yml b/detections/deprecated/detect_api_activity_from_users_without_mfa.yml index 4946cd844b..cd95f9a83d 100644 --- a/detections/deprecated/detect_api_activity_from_users_without_mfa.yml +++ b/detections/deprecated/detect_api_activity_from_users_without_mfa.yml @@ -58,6 +58,13 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - userIdentity.sessionContext.attributes.mfaAuthenticated + - eventName + - userIdentity.arn + - userIdentity.type + - user risk_object: user risk_object_type: user risk_score: 10 diff --git a/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml b/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml index 8fe8f9abfb..3a59991581 100644 --- a/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml +++ b/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml @@ -65,6 +65,12 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - errorCode + - userName + - eventName + - user risk_object: user risk_object_type: user risk_score: 15 diff --git a/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml b/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml index 5119da220a..722b63aa43 100644 --- a/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml +++ b/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml @@ -58,4 +58,11 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - DNS.answer + - DNS.dest + - DNS.src + - DNS.query + - host security_domain: network diff --git a/detections/deprecated/detect_long_dns_txt_record_response.yml b/detections/deprecated/detect_long_dns_txt_record_response.yml index a8027e9689..026ad019d8 100644 --- a/detections/deprecated/detect_long_dns_txt_record_response.yml +++ b/detections/deprecated/detect_long_dns_txt_record_response.yml @@ -51,4 +51,11 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - DNS.message_type + - DNS.record_type + - DNS.src + - DNS.dest + - DNS.answer security_domain: network diff --git a/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml b/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml index 2311ab170e..1d34c5a20d 100644 --- a/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml +++ b/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml @@ -45,4 +45,11 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - signature_id + - Process_Name + - Message + - dest + - Process_ID security_domain: access diff --git a/detections/deprecated/detect_new_api_calls_from_user_roles.yml b/detections/deprecated/detect_new_api_calls_from_user_roles.yml index 6fb8d2bae1..c8a4bd7227 100644 --- a/detections/deprecated/detect_new_api_calls_from_user_roles.yml +++ b/detections/deprecated/detect_new_api_calls_from_user_roles.yml @@ -40,6 +40,13 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - eventType + - errorCode + - userIdentity.type + - userName + - eventName risk_object: user risk_object_type: user risk_score: 5 diff --git a/detections/deprecated/detect_new_user_aws_console_login.yml b/detections/deprecated/detect_new_user_aws_console_login.yml index d3b28f5d3b..0de1dbc9be 100644 --- a/detections/deprecated/detect_new_user_aws_console_login.yml +++ b/detections/deprecated/detect_new_user_aws_console_login.yml @@ -43,4 +43,8 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - eventName + - userIdentity.arn security_domain: network diff --git a/detections/deprecated/detect_spike_in_aws_api_activity.yml b/detections/deprecated/detect_spike_in_aws_api_activity.yml index 963b8cf9df..572e1e230d 100644 --- a/detections/deprecated/detect_spike_in_aws_api_activity.yml +++ b/detections/deprecated/detect_spike_in_aws_api_activity.yml @@ -69,6 +69,10 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - eventType + - userIdentity.arn risk_object: user risk_object_type: user risk_score: 10 diff --git a/detections/deprecated/detect_spike_in_network_acl_activity.yml b/detections/deprecated/detect_spike_in_network_acl_activity.yml index 5af6a6f8a9..4d19b4af1b 100644 --- a/detections/deprecated/detect_spike_in_network_acl_activity.yml +++ b/detections/deprecated/detect_spike_in_network_acl_activity.yml @@ -54,6 +54,9 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - userIdentity.arn risk_object: user risk_object_type: user risk_score: 20 diff --git a/detections/deprecated/detect_spike_in_security_group_activity.yml b/detections/deprecated/detect_spike_in_security_group_activity.yml index 5ef191c32c..503b9bc21c 100644 --- a/detections/deprecated/detect_spike_in_security_group_activity.yml +++ b/detections/deprecated/detect_spike_in_security_group_activity.yml @@ -54,6 +54,9 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - serIdentity.arn risk_object: user risk_object_type: user risk_score: 5 diff --git a/detections/deprecated/detect_usb_device_insertion.yml b/detections/deprecated/detect_usb_device_insertion.yml index de91cb7658..fddee07dca 100644 --- a/detections/deprecated/detect_usb_device_insertion.yml +++ b/detections/deprecated/detect_usb_device_insertion.yml @@ -42,4 +42,10 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - All_Changes.result + - All_Changes.result_id + - All_Changes.src_priority + - All_Changes.dest security_domain: endpoint diff --git a/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml b/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml index 6159f55813..46dcb034f5 100644 --- a/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml +++ b/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml @@ -51,4 +51,10 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Web.url + - Web.status + - Web.src + - Web.dest security_domain: network diff --git a/detections/deprecated/detection_of_dns_tunnels.yml b/detections/deprecated/detection_of_dns_tunnels.yml index 026ff56776..3c1cfcd137 100644 --- a/detections/deprecated/detection_of_dns_tunnels.yml +++ b/detections/deprecated/detection_of_dns_tunnels.yml @@ -59,4 +59,10 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - DNS.query + - DNS.message_type + - DNS.src_category + - DNS.src security_domain: network diff --git a/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml b/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml index f469b44e0f..413985b621 100644 --- a/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml +++ b/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml @@ -45,4 +45,10 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - DNS.dest_category + - DNS.src_category + - DNS.src + - DNS.dest security_domain: network diff --git a/detections/experimental/network/dns_record_changed.yml b/detections/deprecated/dns_record_changed.yml similarity index 96% rename from detections/experimental/network/dns_record_changed.yml rename to detections/deprecated/dns_record_changed.yml index 4815f3310d..1ae1bb5436 100644 --- a/detections/experimental/network/dns_record_changed.yml +++ b/detections/deprecated/dns_record_changed.yml @@ -57,4 +57,11 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - DNS.record_type + - DNS.answer + - DNS.src + - DNS.message_type + - DNS.query security_domain: network diff --git a/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml b/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml index 007b8365b1..ee2c7b47b4 100644 --- a/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml +++ b/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml @@ -39,6 +39,10 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - errorCode + - userIdentity.arn risk_object: user risk_object_type: user risk_score: 5 diff --git a/detections/deprecated/ec2_instance_started_in_previously_unseen_region.yml b/detections/deprecated/ec2_instance_started_in_previously_unseen_region.yml index 650c4b7ded..10a4686f8c 100644 --- a/detections/deprecated/ec2_instance_started_in_previously_unseen_region.yml +++ b/detections/deprecated/ec2_instance_started_in_previously_unseen_region.yml @@ -41,6 +41,9 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - awsRegion risk_object: src risk_object_type: system risk_score: 10 diff --git a/detections/deprecated/ec2_instance_started_with_previously_unseen_ami.yml b/detections/deprecated/ec2_instance_started_with_previously_unseen_ami.yml index f3f035632a..c9fa5990db 100644 --- a/detections/deprecated/ec2_instance_started_with_previously_unseen_ami.yml +++ b/detections/deprecated/ec2_instance_started_with_previously_unseen_ami.yml @@ -39,4 +39,9 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - eventName + - errorCode + - requestParameters.instancesSet.items{}.imageId security_domain: endpoint diff --git a/detections/deprecated/ec2_instance_started_with_previously_unseen_instance_type.yml b/detections/deprecated/ec2_instance_started_with_previously_unseen_instance_type.yml index 96f2384d72..a9c9e06fbe 100644 --- a/detections/deprecated/ec2_instance_started_with_previously_unseen_instance_type.yml +++ b/detections/deprecated/ec2_instance_started_with_previously_unseen_instance_type.yml @@ -39,4 +39,9 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - eventName + - errorCode + - requestParameters.instanceType security_domain: endpoint diff --git a/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml b/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml index 9174162343..68af827e53 100644 --- a/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml +++ b/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml @@ -40,4 +40,9 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - eventName + - errorCode + - userIdentity.arn security_domain: endpoint diff --git a/detections/deprecated/execution_of_file_with_spaces_before_extension.yml b/detections/deprecated/execution_of_file_with_spaces_before_extension.yml index e55b5629a0..f9215be5f8 100644 --- a/detections/deprecated/execution_of_file_with_spaces_before_extension.yml +++ b/detections/deprecated/execution_of_file_with_spaces_before_extension.yml @@ -39,4 +39,11 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process_path + - Processes.process + - Processes.dest + - Processes.user + - Processes.process_name security_domain: endpoint diff --git a/detections/deprecated/extended_period_without_successful_netbackup_backups.yml b/detections/deprecated/extended_period_without_successful_netbackup_backups.yml index f6f4bd3b06..caf098e553 100644 --- a/detections/deprecated/extended_period_without_successful_netbackup_backups.yml +++ b/detections/deprecated/extended_period_without_successful_netbackup_backups.yml @@ -31,4 +31,8 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - MESSAGE + - COMPUTERNAME security_domain: endpoint diff --git a/detections/deprecated/first_time_seen_command_line_argument.yml b/detections/deprecated/first_time_seen_command_line_argument.yml index 4346379bcd..9fdae531d6 100644 --- a/detections/deprecated/first_time_seen_command_line_argument.yml +++ b/detections/deprecated/first_time_seen_command_line_argument.yml @@ -59,4 +59,10 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.parent_process_name + - Processes.dest security_domain: endpoint diff --git a/detections/experimental/cloud/gcp_detect_accounts_with_high_risk_roles_by_project.yml b/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml similarity index 83% rename from detections/experimental/cloud/gcp_detect_accounts_with_high_risk_roles_by_project.yml rename to detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml index 417e2f1a2c..1caf56a2a5 100644 --- a/detections/experimental/cloud/gcp_detect_accounts_with_high_risk_roles_by_project.yml +++ b/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml @@ -36,4 +36,12 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - data.protoPayload.request.policy.bindings{}.role + - data.resource.type data.protoPayload.authenticationInfo.principalEmail + - data.protoPayload.authorizationInfo{}.permission + - data.protoPayload.authorizationInfo{}.resource + - data.protoPayload.response.bindings{}.role + - data.protoPayload.response.bindings{}.members{} security_domain: threat diff --git a/detections/experimental/cloud/gcp_detect_high_risk_permissions_by_resource_and_account.yml b/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml similarity index 83% rename from detections/experimental/cloud/gcp_detect_high_risk_permissions_by_resource_and_account.yml rename to detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml index e6f2d562b9..5192b24b8a 100644 --- a/detections/experimental/cloud/gcp_detect_high_risk_permissions_by_resource_and_account.yml +++ b/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml @@ -35,4 +35,12 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - data.protoPayload.authorizationInfo{}.permission + - data.protoPayload.requestMetadata.callerIp + - data.protoPayload.authenticationInfo.principalEmail + - data.protoPayload.authorizationInfo{}.permission + - data.protoPayload.response.bindings{}.members{} + - data.resource.labels.project_id security_domain: threat diff --git a/detections/experimental/cloud/gcp_detect_oauth_token_abuse.yml b/detections/deprecated/gcp_detect_oauth_token_abuse.yml similarity index 98% rename from detections/experimental/cloud/gcp_detect_oauth_token_abuse.yml rename to detections/deprecated/gcp_detect_oauth_token_abuse.yml index 78040c1056..b00d94adbe 100644 --- a/detections/experimental/cloud/gcp_detect_oauth_token_abuse.yml +++ b/detections/deprecated/gcp_detect_oauth_token_abuse.yml @@ -31,4 +31,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time security_domain: threat diff --git a/detections/deprecated/gcp_gcr_container_uploaded.yml b/detections/deprecated/gcp_gcr_container_uploaded.yml index 7285447e7e..711e60e6d8 100644 --- a/detections/deprecated/gcp_gcr_container_uploaded.yml +++ b/detections/deprecated/gcp_gcr_container_uploaded.yml @@ -31,4 +31,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time security_domain: threat diff --git a/detections/experimental/cloud/gcp_kubernetes_cluster_scan_detection.yml b/detections/deprecated/gcp_kubernetes_cluster_scan_detection.yml similarity index 98% rename from detections/experimental/cloud/gcp_kubernetes_cluster_scan_detection.yml rename to detections/deprecated/gcp_kubernetes_cluster_scan_detection.yml index 87ac299a8f..427070b055 100644 --- a/detections/experimental/cloud/gcp_kubernetes_cluster_scan_detection.yml +++ b/detections/deprecated/gcp_kubernetes_cluster_scan_detection.yml @@ -35,4 +35,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time security_domain: threat diff --git a/detections/deprecated/identify_new_user_accounts.yml b/detections/deprecated/identify_new_user_accounts.yml index d061e8349b..33b9a0d89d 100644 --- a/detections/deprecated/identify_new_user_accounts.yml +++ b/detections/deprecated/identify_new_user_accounts.yml @@ -33,4 +33,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time security_domain: access diff --git a/detections/experimental/cloud/kubernetes_aws_detect_most_active_service_accounts_by_pod.yml b/detections/deprecated/kubernetes_aws_detect_most_active_service_accounts_by_pod.yml similarity index 97% rename from detections/experimental/cloud/kubernetes_aws_detect_most_active_service_accounts_by_pod.yml rename to detections/deprecated/kubernetes_aws_detect_most_active_service_accounts_by_pod.yml index 6db594f667..55e8a31a82 100644 --- a/detections/experimental/cloud/kubernetes_aws_detect_most_active_service_accounts_by_pod.yml +++ b/detections/deprecated/kubernetes_aws_detect_most_active_service_accounts_by_pod.yml @@ -25,4 +25,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time security_domain: threat diff --git a/detections/experimental/cloud/kubernetes_aws_detect_rbac_authorizations_by_account.yml b/detections/deprecated/kubernetes_aws_detect_rbac_authorizations_by_account.yml similarity index 97% rename from detections/experimental/cloud/kubernetes_aws_detect_rbac_authorizations_by_account.yml rename to detections/deprecated/kubernetes_aws_detect_rbac_authorizations_by_account.yml index eb823b8f5b..5e85bb0cfe 100644 --- a/detections/experimental/cloud/kubernetes_aws_detect_rbac_authorizations_by_account.yml +++ b/detections/deprecated/kubernetes_aws_detect_rbac_authorizations_by_account.yml @@ -27,4 +27,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time security_domain: threat diff --git a/detections/experimental/cloud/kubernetes_aws_detect_sensitive_object_access.yml b/detections/deprecated/kubernetes_aws_detect_sensitive_object_access.yml similarity index 97% rename from detections/experimental/cloud/kubernetes_aws_detect_sensitive_object_access.yml rename to detections/deprecated/kubernetes_aws_detect_sensitive_object_access.yml index 53741c5860..21d05cd904 100644 --- a/detections/experimental/cloud/kubernetes_aws_detect_sensitive_object_access.yml +++ b/detections/deprecated/kubernetes_aws_detect_sensitive_object_access.yml @@ -26,4 +26,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time security_domain: threat diff --git a/detections/experimental/cloud/kubernetes_aws_detect_sensitive_role_access.yml b/detections/deprecated/kubernetes_aws_detect_sensitive_role_access.yml similarity index 97% rename from detections/experimental/cloud/kubernetes_aws_detect_sensitive_role_access.yml rename to detections/deprecated/kubernetes_aws_detect_sensitive_role_access.yml index 26deca7fd1..8bb7952bbb 100644 --- a/detections/experimental/cloud/kubernetes_aws_detect_sensitive_role_access.yml +++ b/detections/deprecated/kubernetes_aws_detect_sensitive_role_access.yml @@ -26,4 +26,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time security_domain: threat diff --git a/detections/experimental/cloud/kubernetes_aws_detect_service_accounts_forbidden_failure_access.yml b/detections/deprecated/kubernetes_aws_detect_service_accounts_forbidden_failure_access.yml similarity index 97% rename from detections/experimental/cloud/kubernetes_aws_detect_service_accounts_forbidden_failure_access.yml rename to detections/deprecated/kubernetes_aws_detect_service_accounts_forbidden_failure_access.yml index 36a83160fb..488e619708 100644 --- a/detections/experimental/cloud/kubernetes_aws_detect_service_accounts_forbidden_failure_access.yml +++ b/detections/deprecated/kubernetes_aws_detect_service_accounts_forbidden_failure_access.yml @@ -27,4 +27,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time security_domain: threat diff --git a/detections/experimental/cloud/kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace.yml b/detections/deprecated/kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace.yml similarity index 97% rename from detections/experimental/cloud/kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace.yml rename to detections/deprecated/kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace.yml index df72e536e1..8b4707c633 100644 --- a/detections/experimental/cloud/kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace.yml +++ b/detections/deprecated/kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace.yml @@ -27,4 +27,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time security_domain: threat diff --git a/detections/experimental/cloud/kubernetes_azure_detect_rbac_authorization_by_account.yml b/detections/deprecated/kubernetes_azure_detect_rbac_authorization_by_account.yml similarity index 97% rename from detections/experimental/cloud/kubernetes_azure_detect_rbac_authorization_by_account.yml rename to detections/deprecated/kubernetes_azure_detect_rbac_authorization_by_account.yml index be00530427..db726194d5 100644 --- a/detections/experimental/cloud/kubernetes_azure_detect_rbac_authorization_by_account.yml +++ b/detections/deprecated/kubernetes_azure_detect_rbac_authorization_by_account.yml @@ -27,4 +27,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time security_domain: threat diff --git a/detections/experimental/cloud/kubernetes_azure_detect_sensitive_object_access.yml b/detections/deprecated/kubernetes_azure_detect_sensitive_object_access.yml similarity index 97% rename from detections/experimental/cloud/kubernetes_azure_detect_sensitive_object_access.yml rename to detections/deprecated/kubernetes_azure_detect_sensitive_object_access.yml index de93ee2c4f..168e7ec286 100644 --- a/detections/experimental/cloud/kubernetes_azure_detect_sensitive_object_access.yml +++ b/detections/deprecated/kubernetes_azure_detect_sensitive_object_access.yml @@ -26,4 +26,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time security_domain: threat diff --git a/detections/experimental/cloud/kubernetes_azure_detect_sensitive_role_access.yml b/detections/deprecated/kubernetes_azure_detect_sensitive_role_access.yml similarity index 97% rename from detections/experimental/cloud/kubernetes_azure_detect_sensitive_role_access.yml rename to detections/deprecated/kubernetes_azure_detect_sensitive_role_access.yml index fe1a6e62b9..a450da0f61 100644 --- a/detections/experimental/cloud/kubernetes_azure_detect_sensitive_role_access.yml +++ b/detections/deprecated/kubernetes_azure_detect_sensitive_role_access.yml @@ -26,4 +26,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time security_domain: threat diff --git a/detections/experimental/cloud/kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml b/detections/deprecated/kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml similarity index 97% rename from detections/experimental/cloud/kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml rename to detections/deprecated/kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml index c46ac27650..a962c9e318 100644 --- a/detections/experimental/cloud/kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml +++ b/detections/deprecated/kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml @@ -26,4 +26,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time security_domain: threat diff --git a/detections/experimental/cloud/kubernetes_azure_detect_suspicious_kubectl_calls.yml b/detections/deprecated/kubernetes_azure_detect_suspicious_kubectl_calls.yml similarity index 98% rename from detections/experimental/cloud/kubernetes_azure_detect_suspicious_kubectl_calls.yml rename to detections/deprecated/kubernetes_azure_detect_suspicious_kubectl_calls.yml index 2fa956e69c..b21d8953f7 100644 --- a/detections/experimental/cloud/kubernetes_azure_detect_suspicious_kubectl_calls.yml +++ b/detections/deprecated/kubernetes_azure_detect_suspicious_kubectl_calls.yml @@ -29,4 +29,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time security_domain: threat diff --git a/detections/experimental/cloud/kubernetes_azure_pod_scan_fingerprint.yml b/detections/deprecated/kubernetes_azure_pod_scan_fingerprint.yml similarity index 97% rename from detections/experimental/cloud/kubernetes_azure_pod_scan_fingerprint.yml rename to detections/deprecated/kubernetes_azure_pod_scan_fingerprint.yml index 3c337e5e26..1a1776bef7 100644 --- a/detections/experimental/cloud/kubernetes_azure_pod_scan_fingerprint.yml +++ b/detections/deprecated/kubernetes_azure_pod_scan_fingerprint.yml @@ -26,4 +26,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time security_domain: threat diff --git a/detections/experimental/cloud/kubernetes_azure_scan_fingerprint.yml b/detections/deprecated/kubernetes_azure_scan_fingerprint.yml similarity index 97% rename from detections/experimental/cloud/kubernetes_azure_scan_fingerprint.yml rename to detections/deprecated/kubernetes_azure_scan_fingerprint.yml index 287d0e96a1..3ef3d1e31b 100644 --- a/detections/experimental/cloud/kubernetes_azure_scan_fingerprint.yml +++ b/detections/deprecated/kubernetes_azure_scan_fingerprint.yml @@ -28,4 +28,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time security_domain: threat diff --git a/detections/experimental/cloud/kubernetes_gcp_detect_RBAC_authorizations_by_account.yml b/detections/deprecated/kubernetes_gcp_detect_RBAC_authorizations_by_account.yml similarity index 97% rename from detections/experimental/cloud/kubernetes_gcp_detect_RBAC_authorizations_by_account.yml rename to detections/deprecated/kubernetes_gcp_detect_RBAC_authorizations_by_account.yml index acfbad5842..98d69d6283 100644 --- a/detections/experimental/cloud/kubernetes_gcp_detect_RBAC_authorizations_by_account.yml +++ b/detections/deprecated/kubernetes_gcp_detect_RBAC_authorizations_by_account.yml @@ -27,4 +27,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time security_domain: threat diff --git a/detections/experimental/cloud/kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml b/detections/deprecated/kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml similarity index 97% rename from detections/experimental/cloud/kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml rename to detections/deprecated/kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml index df859c23a8..1a86f1d5af 100644 --- a/detections/experimental/cloud/kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml +++ b/detections/deprecated/kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml @@ -27,4 +27,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time security_domain: threat diff --git a/detections/experimental/cloud/kubernetes_gcp_detect_sensitive_object_access.yml b/detections/deprecated/kubernetes_gcp_detect_sensitive_object_access.yml similarity index 97% rename from detections/experimental/cloud/kubernetes_gcp_detect_sensitive_object_access.yml rename to detections/deprecated/kubernetes_gcp_detect_sensitive_object_access.yml index 4c37d551b2..5059a9a42c 100644 --- a/detections/experimental/cloud/kubernetes_gcp_detect_sensitive_object_access.yml +++ b/detections/deprecated/kubernetes_gcp_detect_sensitive_object_access.yml @@ -27,4 +27,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time security_domain: threat diff --git a/detections/experimental/cloud/kubernetes_gcp_detect_sensitive_role_access.yml b/detections/deprecated/kubernetes_gcp_detect_sensitive_role_access.yml similarity index 97% rename from detections/experimental/cloud/kubernetes_gcp_detect_sensitive_role_access.yml rename to detections/deprecated/kubernetes_gcp_detect_sensitive_role_access.yml index aa3b1e3cac..fb918d9303 100644 --- a/detections/experimental/cloud/kubernetes_gcp_detect_sensitive_role_access.yml +++ b/detections/deprecated/kubernetes_gcp_detect_sensitive_role_access.yml @@ -27,4 +27,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time security_domain: threat diff --git a/detections/experimental/cloud/kubernetes_gcp_detect_service_accounts_forbidden_failure_access.yml b/detections/deprecated/kubernetes_gcp_detect_service_accounts_forbidden_failure_access.yml similarity index 98% rename from detections/experimental/cloud/kubernetes_gcp_detect_service_accounts_forbidden_failure_access.yml rename to detections/deprecated/kubernetes_gcp_detect_service_accounts_forbidden_failure_access.yml index a05269a924..e848982a7b 100644 --- a/detections/experimental/cloud/kubernetes_gcp_detect_service_accounts_forbidden_failure_access.yml +++ b/detections/deprecated/kubernetes_gcp_detect_service_accounts_forbidden_failure_access.yml @@ -29,4 +29,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time security_domain: threat diff --git a/detections/experimental/cloud/kubernetes_gcp_detect_suspicious_kubectl_calls.yml b/detections/deprecated/kubernetes_gcp_detect_suspicious_kubectl_calls.yml similarity index 97% rename from detections/experimental/cloud/kubernetes_gcp_detect_suspicious_kubectl_calls.yml rename to detections/deprecated/kubernetes_gcp_detect_suspicious_kubectl_calls.yml index 7123237ecf..77ff7ccb53 100644 --- a/detections/experimental/cloud/kubernetes_gcp_detect_suspicious_kubectl_calls.yml +++ b/detections/deprecated/kubernetes_gcp_detect_suspicious_kubectl_calls.yml @@ -28,4 +28,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time security_domain: threat diff --git a/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml b/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml index f25d7f22f3..d3bdd8e440 100644 --- a/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml +++ b/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml @@ -48,4 +48,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time security_domain: endpoint diff --git a/detections/deprecated/monitor_dns_for_brand_abuse.yml b/detections/deprecated/monitor_dns_for_brand_abuse.yml index 192b397281..f3b89c7900 100644 --- a/detections/deprecated/monitor_dns_for_brand_abuse.yml +++ b/detections/deprecated/monitor_dns_for_brand_abuse.yml @@ -31,4 +31,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time security_domain: network diff --git a/detections/deprecated/open_redirect_in_splunk_web.yml b/detections/deprecated/open_redirect_in_splunk_web.yml index 4de972c878..1cf9106cdf 100644 --- a/detections/deprecated/open_redirect_in_splunk_web.yml +++ b/detections/deprecated/open_redirect_in_splunk_web.yml @@ -32,4 +32,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time security_domain: network diff --git a/detections/deprecated/osquery_pack___coldroot_detection.yml b/detections/deprecated/osquery_pack___coldroot_detection.yml index 67af959905..d7b3bb164b 100644 --- a/detections/deprecated/osquery_pack___coldroot_detection.yml +++ b/detections/deprecated/osquery_pack___coldroot_detection.yml @@ -34,4 +34,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time security_domain: threat diff --git a/detections/deprecated/processes_created_by_netsh.yml b/detections/deprecated/processes_created_by_netsh.yml index 6194f8d3d8..af8ee13d4b 100644 --- a/detections/deprecated/processes_created_by_netsh.yml +++ b/detections/deprecated/processes_created_by_netsh.yml @@ -43,4 +43,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time security_domain: endpoint diff --git a/detections/deprecated/prohibited_software_on_endpoint.yml b/detections/deprecated/prohibited_software_on_endpoint.yml index d1b4ad4cef..04449d9dd2 100644 --- a/detections/deprecated/prohibited_software_on_endpoint.yml +++ b/detections/deprecated/prohibited_software_on_endpoint.yml @@ -43,4 +43,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _times security_domain: endpoint diff --git a/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml b/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml index b2c90e57cd..c3634ec5be 100644 --- a/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml +++ b/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml @@ -39,4 +39,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time security_domain: endpoint diff --git a/detections/deprecated/remote_registry_key_modifications.yml b/detections/deprecated/remote_registry_key_modifications.yml index 34afa2b49b..323901d3e9 100644 --- a/detections/deprecated/remote_registry_key_modifications.yml +++ b/detections/deprecated/remote_registry_key_modifications.yml @@ -36,4 +36,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time security_domain: endpoint diff --git a/detections/deprecated/remote_wmi_command_attempt.yml b/detections/deprecated/remote_wmi_command_attempt.yml index 69fb12d968..62d8a331fc 100644 --- a/detections/deprecated/remote_wmi_command_attempt.yml +++ b/detections/deprecated/remote_wmi_command_attempt.yml @@ -42,4 +42,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time security_domain: endpoint diff --git a/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml b/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml index 2890ec3d5d..5ba28b1a4b 100644 --- a/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml +++ b/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml @@ -38,4 +38,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time security_domain: endpoint diff --git a/detections/experimental/application/spectre_and_meltdown_vulnerable_systems.yml b/detections/deprecated/spectre_and_meltdown_vulnerable_systems.yml similarity index 97% rename from detections/experimental/application/spectre_and_meltdown_vulnerable_systems.yml rename to detections/deprecated/spectre_and_meltdown_vulnerable_systems.yml index e68543b314..3ff5a0f3f4 100644 --- a/detections/experimental/application/spectre_and_meltdown_vulnerable_systems.yml +++ b/detections/deprecated/spectre_and_meltdown_vulnerable_systems.yml @@ -33,4 +33,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time security_domain: endpoint diff --git a/detections/deprecated/splunk_enterprise_information_disclosure.yml b/detections/deprecated/splunk_enterprise_information_disclosure.yml index 41267e544d..0545af8fbe 100644 --- a/detections/deprecated/splunk_enterprise_information_disclosure.yml +++ b/detections/deprecated/splunk_enterprise_information_disclosure.yml @@ -39,4 +39,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time security_domain: network diff --git a/detections/deprecated/suspicious_changes_to_file_associations.yml b/detections/deprecated/suspicious_changes_to_file_associations.yml index 5fd3eea554..047d9fb62f 100644 --- a/detections/deprecated/suspicious_changes_to_file_associations.yml +++ b/detections/deprecated/suspicious_changes_to_file_associations.yml @@ -45,4 +45,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time security_domain: endpoint diff --git a/detections/experimental/application/suspicious_email___uba_anomaly.yml b/detections/deprecated/suspicious_email___uba_anomaly.yml similarity index 98% rename from detections/experimental/application/suspicious_email___uba_anomaly.yml rename to detections/deprecated/suspicious_email___uba_anomaly.yml index 55ce9bdb67..8bf169bd00 100644 --- a/detections/experimental/application/suspicious_email___uba_anomaly.yml +++ b/detections/deprecated/suspicious_email___uba_anomaly.yml @@ -41,4 +41,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time security_domain: threat diff --git a/detections/deprecated/suspicious_file_write.yml b/detections/deprecated/suspicious_file_write.yml index 1645800eae..b32734e8ec 100644 --- a/detections/deprecated/suspicious_file_write.yml +++ b/detections/deprecated/suspicious_file_write.yml @@ -42,4 +42,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time security_domain: endpoint diff --git a/detections/deprecated/suspicious_writes_to_system_volume_information.yml b/detections/deprecated/suspicious_writes_to_system_volume_information.yml index 6008e6015c..6f23bee208 100644 --- a/detections/deprecated/suspicious_writes_to_system_volume_information.yml +++ b/detections/deprecated/suspicious_writes_to_system_volume_information.yml @@ -32,4 +32,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time security_domain: endpoint diff --git a/detections/deprecated/uncommon_processes_on_endpoint.yml b/detections/deprecated/uncommon_processes_on_endpoint.yml index 2613179677..4d67853005 100644 --- a/detections/deprecated/uncommon_processes_on_endpoint.yml +++ b/detections/deprecated/uncommon_processes_on_endpoint.yml @@ -39,4 +39,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time security_domain: endpoint diff --git a/detections/deprecated/unsigned_image_loaded_by_lsass.yml b/detections/deprecated/unsigned_image_loaded_by_lsass.yml index 605f07b9ca..72dfffd0d3 100644 --- a/detections/deprecated/unsigned_image_loaded_by_lsass.yml +++ b/detections/deprecated/unsigned_image_loaded_by_lsass.yml @@ -38,4 +38,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time security_domain: endpoint diff --git a/detections/deprecated/unsuccessful_netbackup_backups.yml b/detections/deprecated/unsuccessful_netbackup_backups.yml index 9ba02a3e78..e4df48fe26 100644 --- a/detections/deprecated/unsuccessful_netbackup_backups.yml +++ b/detections/deprecated/unsuccessful_netbackup_backups.yml @@ -29,4 +29,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time security_domain: endpoint diff --git a/detections/deprecated/web_fraud___account_harvesting.yml b/detections/deprecated/web_fraud___account_harvesting.yml index 01cad47d36..15bc5d8ab6 100644 --- a/detections/deprecated/web_fraud___account_harvesting.yml +++ b/detections/deprecated/web_fraud___account_harvesting.yml @@ -51,4 +51,9 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - http_content_type + - uri + - cookie security_domain: threat diff --git a/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml b/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml index 9a82fac2eb..976958cd73 100644 --- a/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml +++ b/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml @@ -47,4 +47,8 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - http_content_type + - cookie security_domain: threat diff --git a/detections/deprecated/web_fraud___password_sharing_across_accounts.yml b/detections/deprecated/web_fraud___password_sharing_across_accounts.yml index e80e2f4b1f..f2a5f59b56 100644 --- a/detections/deprecated/web_fraud___password_sharing_across_accounts.yml +++ b/detections/deprecated/web_fraud___password_sharing_across_accounts.yml @@ -37,4 +37,8 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - http_content_type + - uri security_domain: threat diff --git a/detections/deprecated/windows_connhost_exe_force_flag.yml b/detections/deprecated/windows_connhost_exe_force_flag.yml index b0918d7154..28cf5d9213 100644 --- a/detections/deprecated/windows_connhost_exe_force_flag.yml +++ b/detections/deprecated/windows_connhost_exe_force_flag.yml @@ -39,4 +39,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time security_domain: endpoint diff --git a/detections/deprecated/windows_hosts_file_modification.yml b/detections/deprecated/windows_hosts_file_modification.yml index fb19326498..d33d175546 100644 --- a/detections/deprecated/windows_hosts_file_modification.yml +++ b/detections/deprecated/windows_hosts_file_modification.yml @@ -41,4 +41,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time security_domain: endpoint diff --git a/detections/endpoint/access_lsass_memory_for_dump_creation.yml b/detections/endpoint/access_lsass_memory_for_dump_creation.yml index 8e56001e02..eadbd405d5 100644 --- a/detections/endpoint/access_lsass_memory_for_dump_creation.yml +++ b/detections/endpoint/access_lsass_memory_for_dump_creation.yml @@ -40,4 +40,13 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - EventCode + - TargetImage + - CallTrace + - Computer + - TargetProcessId + - SourceImage + - SourceProcessId security_domain: endpoint diff --git a/detections/endpoint/any_powershell_downloadfile.yml b/detections/endpoint/any_powershell_downloadfile.yml index abd2124747..0b101b66c7 100644 --- a/detections/endpoint/any_powershell_downloadfile.yml +++ b/detections/endpoint/any_powershell_downloadfile.yml @@ -41,3 +41,14 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + security_domain: endpoint + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process_id + - Processes.parent_process_id \ No newline at end of file diff --git a/detections/endpoint/any_powershell_downloadstring.yml b/detections/endpoint/any_powershell_downloadstring.yml index 336a43c111..b1b4202ac0 100644 --- a/detections/endpoint/any_powershell_downloadstring.yml +++ b/detections/endpoint/any_powershell_downloadstring.yml @@ -43,3 +43,14 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + security_domain: endpoint + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process_id + - Processes.parent_process_id \ No newline at end of file diff --git a/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml b/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml index 6b85704d5b..0f93f1c1b7 100644 --- a/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml +++ b/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml @@ -45,4 +45,10 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process + - Processes.process_name + - Processes.parent_process + - Processes.user security_domain: endpoint diff --git a/detections/endpoint/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml b/detections/endpoint/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml index ad7f47f99e..1bd7e82992 100644 --- a/detections/endpoint/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml +++ b/detections/endpoint/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml @@ -46,4 +46,10 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Registry.registry_path + - Registry.registry_key_name + - Registry.registry_value_name + - Registry.dest security_domain: endpoint diff --git a/detections/endpoint/attempt_to_stop_security_service.yml b/detections/endpoint/attempt_to_stop_security_service.yml index aeda81bccd..d20d1cc89a 100644 --- a/detections/endpoint/attempt_to_stop_security_service.yml +++ b/detections/endpoint/attempt_to_stop_security_service.yml @@ -52,4 +52,10 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.dest + - Processes.user security_domain: endpoint diff --git a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml index 073111e911..2858b9f883 100644 --- a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml @@ -42,4 +42,9 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.dest security_domain: endpoint diff --git a/detections/endpoint/batch_file_write_to_system32.yml b/detections/endpoint/batch_file_write_to_system32.yml index 831414fdba..c5ce575bf0 100644 --- a/detections/endpoint/batch_file_write_to_system32.yml +++ b/detections/endpoint/batch_file_write_to_system32.yml @@ -46,4 +46,10 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Filesystem.dest + - Filesystem.file_name + - Filesystem.user + - Filesystem.file_path security_domain: endpoint diff --git a/detections/endpoint/bcdedit_failure_recovery_modification.yml b/detections/endpoint/bcdedit_failure_recovery_modification.yml index 9677362866..505506d6dd 100644 --- a/detections/endpoint/bcdedit_failure_recovery_modification.yml +++ b/detections/endpoint/bcdedit_failure_recovery_modification.yml @@ -41,4 +41,11 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.parent_process_name + - Processes.dest + - Processes.user security_domain: endpoint diff --git a/detections/endpoint/certutil_exe_certificate_extraction.yml b/detections/endpoint/certutil_exe_certificate_extraction.yml index ec5e0c3d65..f26bdc96b6 100644 --- a/detections/endpoint/certutil_exe_certificate_extraction.yml +++ b/detections/endpoint/certutil_exe_certificate_extraction.yml @@ -33,4 +33,10 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process + - Processes.process_name + - Processes.parent_process + - Processes.user security_domain: endpoint diff --git a/detections/endpoint/cobalt_strike_named_pipes.yml b/detections/endpoint/cobalt_strike_named_pipes.yml index 9f72971f72..79999603b7 100644 --- a/detections/endpoint/cobalt_strike_named_pipes.yml +++ b/detections/endpoint/cobalt_strike_named_pipes.yml @@ -56,4 +56,12 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - EventID + - PipeName + - Computer + - process_name + - process_path + - process_id security_domain: endpoint diff --git a/detections/endpoint/common_ransomware_extensions.yml b/detections/endpoint/common_ransomware_extensions.yml index 175837e008..c538968c1b 100644 --- a/detections/endpoint/common_ransomware_extensions.yml +++ b/detections/endpoint/common_ransomware_extensions.yml @@ -57,4 +57,10 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Filesystem.user + - Filesystem.dest + - Filesystem.file_path + - Filesystem.file_name security_domain: endpoint diff --git a/detections/endpoint/common_ransomware_notes.yml b/detections/endpoint/common_ransomware_notes.yml index a5804398ae..1f553a2cff 100644 --- a/detections/endpoint/common_ransomware_notes.yml +++ b/detections/endpoint/common_ransomware_notes.yml @@ -43,4 +43,10 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Filesystem.user + - Filesystem.dest + - Filesystem.file_path + - Filesystem.file_name security_domain: endpoint diff --git a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml index a5ce2ba435..84f445454c 100644 --- a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml +++ b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml @@ -44,4 +44,11 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.dest security_domain: endpoint diff --git a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml index e6a41509ee..e397763cf0 100644 --- a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml +++ b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml @@ -43,4 +43,11 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.user + - Processes.parent_process + - Processs.process_name + - Processes.process + - Processes.dest security_domain: endpoint diff --git a/detections/endpoint/create_remote_thread_into_lsass.yml b/detections/endpoint/create_remote_thread_into_lsass.yml index f169cc8f10..d2e325f42f 100644 --- a/detections/endpoint/create_remote_thread_into_lsass.yml +++ b/detections/endpoint/create_remote_thread_into_lsass.yml @@ -40,4 +40,12 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - EventID + - TargetImage + - Computer + - EventCode + - TargetImage + - TargetProcessId security_domain: endpoint diff --git a/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml b/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml index 40d59d147a..97bc078628 100644 --- a/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml +++ b/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml @@ -46,4 +46,11 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - EventID + - process_name + - TargetFilename + - Computer + - object_category security_domain: endpoint diff --git a/detections/endpoint/creation_of_shadow_copy.yml b/detections/endpoint/creation_of_shadow_copy.yml index 351f023936..7b2fdfb622 100644 --- a/detections/endpoint/creation_of_shadow_copy.yml +++ b/detections/endpoint/creation_of_shadow_copy.yml @@ -43,4 +43,13 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_id + - Processes.parent_process_id security_domain: endpoint diff --git a/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml b/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml index 4beda2d029..a61e3fdb17 100644 --- a/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml +++ b/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml @@ -39,4 +39,10 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.user + - Processes.dest security_domain: endpoint diff --git a/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml b/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml index 19a4843bc4..7653ea932e 100644 --- a/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml +++ b/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml @@ -42,4 +42,13 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_id + - Processes.parent_process_id security_domain: endpoint diff --git a/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml b/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml index 120f0c6a62..3a7d2528de 100644 --- a/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml +++ b/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml @@ -40,4 +40,13 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_id + - Processes.parent_process_id security_domain: endpoint diff --git a/detections/endpoint/deleting_shadow_copies.yml b/detections/endpoint/deleting_shadow_copies.yml index 30bc424e63..3edefd7369 100644 --- a/detections/endpoint/deleting_shadow_copies.yml +++ b/detections/endpoint/deleting_shadow_copies.yml @@ -48,4 +48,12 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process + - Processes.parent_process + - Processes.process_name + - Processes.user + - Processes.parent_process_name + - Processes.dest security_domain: endpoint diff --git a/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml b/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml index 059103aaf6..27c04e1afd 100644 --- a/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml +++ b/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml @@ -41,4 +41,12 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - EventCode + - Logon_Type + - Logon_Process + - WorkstationName + - user + - dest security_domain: access diff --git a/detections/endpoint/detect_computer_changed_with_anonymous_account.yml b/detections/endpoint/detect_computer_changed_with_anonymous_account.yml index acc30daf08..2cd5d2de88 100644 --- a/detections/endpoint/detect_computer_changed_with_anonymous_account.yml +++ b/detections/endpoint/detect_computer_changed_with_anonymous_account.yml @@ -37,4 +37,11 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - EventCode + - TargetUserName + - LogonType + - TargetDomainName + - user security_domain: endpoint diff --git a/detections/endpoint/detect_credential_dumping_through_lsass_access.yml b/detections/endpoint/detect_credential_dumping_through_lsass_access.yml index 731bfccaa9..2c29b0c714 100644 --- a/detections/endpoint/detect_credential_dumping_through_lsass_access.yml +++ b/detections/endpoint/detect_credential_dumping_through_lsass_access.yml @@ -47,4 +47,14 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - EventCode + - TargetImage + - GrantedAccess + - Computer + - SourceImage + - SourceProcessId + - TargetImage + - TargetProcessId security_domain: endpoint diff --git a/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml b/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml index 042c679c5f..1c1581db8c 100644 --- a/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml +++ b/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml @@ -49,4 +49,10 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - All_Changes.user + - nodename + - All_Changes.result + - All_Changes.dest security_domain: access diff --git a/detections/endpoint/detect_excessive_user_account_lockouts.yml b/detections/endpoint/detect_excessive_user_account_lockouts.yml index d2cc17c408..087893be3e 100644 --- a/detections/endpoint/detect_excessive_user_account_lockouts.yml +++ b/detections/endpoint/detect_excessive_user_account_lockouts.yml @@ -38,4 +38,9 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - All_Changes.result + - nodename + - All_Changes.user security_domain: access diff --git a/detections/endpoint/detect_html_help_renamed.yml b/detections/endpoint/detect_html_help_renamed.yml index 22253f2252..80bb170475 100644 --- a/detections/endpoint/detect_html_help_renamed.yml +++ b/detections/endpoint/detect_html_help_renamed.yml @@ -50,4 +50,14 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - EventID + - OriginalFileName + - process_name + - Computer + - User + - parent_process_name + - process_path + - CommandLine security_domain: endpoint diff --git a/detections/endpoint/detect_html_help_spawn_child_process.yml b/detections/endpoint/detect_html_help_spawn_child_process.yml index cc5e047ef1..979134d257 100644 --- a/detections/endpoint/detect_html_help_spawn_child_process.yml +++ b/detections/endpoint/detect_html_help_spawn_child_process.yml @@ -53,4 +53,14 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.parent_process_name + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id security_domain: endpoint diff --git a/detections/endpoint/detect_html_help_url_in_command_line.yml b/detections/endpoint/detect_html_help_url_in_command_line.yml index 794e909fe2..f7cf29ee5f 100644 --- a/detections/endpoint/detect_html_help_url_in_command_line.yml +++ b/detections/endpoint/detect_html_help_url_in_command_line.yml @@ -55,4 +55,13 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_id + - Processes.parent_process_id security_domain: endpoint diff --git a/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml b/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml index 93e7d38421..484268fc4a 100644 --- a/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml +++ b/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml @@ -57,4 +57,12 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_id security_domain: endpoint diff --git a/detections/endpoint/detect_mimikatz_using_loaded_images.yml b/detections/endpoint/detect_mimikatz_using_loaded_images.yml index bb4b888db7..5ee8a925ef 100644 --- a/detections/endpoint/detect_mimikatz_using_loaded_images.yml +++ b/detections/endpoint/detect_mimikatz_using_loaded_images.yml @@ -44,6 +44,13 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - EventCode + - ImageLoaded + - ProcessId + - Computer + - Image security_domain: endpoint automated_detection_testing: passed dataset: diff --git a/detections/endpoint/detect_mshta_inline_hta_execution.yml b/detections/endpoint/detect_mshta_inline_hta_execution.yml index 1418a13549..cf0143c90f 100644 --- a/detections/endpoint/detect_mshta_inline_hta_execution.yml +++ b/detections/endpoint/detect_mshta_inline_hta_execution.yml @@ -47,4 +47,12 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process + - Processes.parent_process + - Processes.user + - Processes.process_name + - Processes.parent_process_name + - Processes.dest security_domain: endpoint diff --git a/detections/endpoint/detect_mshta_renamed.yml b/detections/endpoint/detect_mshta_renamed.yml index 1138be6148..93edaffde7 100644 --- a/detections/endpoint/detect_mshta_renamed.yml +++ b/detections/endpoint/detect_mshta_renamed.yml @@ -43,5 +43,15 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - EventID + - OriginalFileName + - process_name + - Computer + - User + - parent_process_name + - process_path + - CommandLine security_domain: endpoint automated_detection_testing: passed diff --git a/detections/endpoint/detect_mshta_url_in_command_line.yml b/detections/endpoint/detect_mshta_url_in_command_line.yml index 7d03e42ed7..26183d67d0 100644 --- a/detections/endpoint/detect_mshta_url_in_command_line.yml +++ b/detections/endpoint/detect_mshta_url_in_command_line.yml @@ -48,4 +48,11 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process + - Processes.parent_process + - Processes.process_name + - Processes.user + - Processes.dest security_domain: endpoint diff --git a/detections/endpoint/detect_new_local_admin_account.yml b/detections/endpoint/detect_new_local_admin_account.yml index 571d3cb8b4..3475b05b9f 100644 --- a/detections/endpoint/detect_new_local_admin_account.yml +++ b/detections/endpoint/detect_new_local_admin_account.yml @@ -42,4 +42,10 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - EventCode + - Group_Name + - member_id + - dest security_domain: access diff --git a/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml b/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml index 6124939409..858e19dd19 100644 --- a/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml +++ b/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml @@ -11,7 +11,7 @@ description: 'The detection Detect Path Interception By Creation Of program exe privilege escalation. ' search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=services.exe - by Processes.user Processes.process_name Processes.process Processes.dest index + by Processes.user Processes.process_name Processes.process Processes.dest | `drop_dm_object_name(Processes)` | rex field=process "^.*?\\\\(?[^\\\\]*\.(?:exe|bat|com|ps1))" | eval process_name = lower(process_name) | eval service_process = lower(service_process) | where process_name != service_process | `security_content_ctime(firstTime)` | @@ -44,4 +44,11 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.parent_process_name + - Processes.user + - Processes.process_name + - Processes.process + - Processes.dest security_domain: endpoint diff --git a/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml b/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml index c1e2159084..cf874d103c 100644 --- a/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml +++ b/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml @@ -47,4 +47,11 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process + - Processes.parent_process + - Processes.dest + - Processes.process_name + - Processes.user security_domain: endpoint diff --git a/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml b/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml index 71d6cfae28..c75e68cbec 100644 --- a/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml +++ b/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml @@ -45,4 +45,11 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process + - Processes.process_name + - Processes.parent_process_name + - Processes.dest + - Processes.user security_domain: endpoint diff --git a/detections/endpoint/detect_psexec_with_accepteula_flag.yml b/detections/endpoint/detect_psexec_with_accepteula_flag.yml index 361ac30475..464e574aba 100644 --- a/detections/endpoint/detect_psexec_with_accepteula_flag.yml +++ b/detections/endpoint/detect_psexec_with_accepteula_flag.yml @@ -51,4 +51,10 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process + - Processes.process_name + - Processes.dest + - Processes.parent_process_name security_domain: endpoint diff --git a/detections/endpoint/detect_regasm_spawning_a_process.yml b/detections/endpoint/detect_regasm_spawning_a_process.yml index a00804b246..b98d0fe9f8 100644 --- a/detections/endpoint/detect_regasm_spawning_a_process.yml +++ b/detections/endpoint/detect_regasm_spawning_a_process.yml @@ -50,4 +50,13 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.parent_process_name + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process + - Processes.process_id + - Processes.parent_process_id security_domain: endpoint diff --git a/detections/endpoint/detect_regasm_with_network_connection.yml b/detections/endpoint/detect_regasm_with_network_connection.yml index 0af1359b18..cb935b0f85 100644 --- a/detections/endpoint/detect_regasm_with_network_connection.yml +++ b/detections/endpoint/detect_regasm_with_network_connection.yml @@ -50,4 +50,14 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - EventID + - dest_ip + - process_name + - Computer + - User + - src_ip + - dest_host + - dest_ip security_domain: endpoint diff --git a/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml b/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml index 96ca12e9ba..37cce4746c 100644 --- a/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml +++ b/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml @@ -47,4 +47,16 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - EventID + - process_name + - OriginalFileName + - CommandLine + - dest + - User + - ParentImage + - ParentCommandLine + - process_path + - Computer security_domain: endpoint diff --git a/detections/endpoint/detect_regsvcs_spawning_a_process.yml b/detections/endpoint/detect_regsvcs_spawning_a_process.yml index bf9ff231cd..852c8379c1 100644 --- a/detections/endpoint/detect_regsvcs_spawning_a_process.yml +++ b/detections/endpoint/detect_regsvcs_spawning_a_process.yml @@ -49,4 +49,14 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.parent_process_name + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id security_domain: endpoint diff --git a/detections/endpoint/detect_regsvcs_with_network_connection.yml b/detections/endpoint/detect_regsvcs_with_network_connection.yml index 8201d1ffea..f58d167364 100644 --- a/detections/endpoint/detect_regsvcs_with_network_connection.yml +++ b/detections/endpoint/detect_regsvcs_with_network_connection.yml @@ -50,4 +50,13 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - EventID + - dest_ip + - process_name + - Computer + - User + - src_ip + - dest_host security_domain: Endpoint diff --git a/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml b/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml index bb3be4d732..47bbffd0a1 100644 --- a/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml +++ b/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml @@ -47,4 +47,17 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - EventID + - process_name + - OriginalFileName + - CommandLine + - dest + - User + - ParentImage + - ParentCommandLine + - OriginalFileName + - process_path + - Computer security_domain: endpoint diff --git a/detections/endpoint/detect_regsvr32_application_control_bypass.yml b/detections/endpoint/detect_regsvr32_application_control_bypass.yml index 94ebb6d16a..038b0495f4 100644 --- a/detections/endpoint/detect_regsvr32_application_control_bypass.yml +++ b/detections/endpoint/detect_regsvr32_application_control_bypass.yml @@ -54,4 +54,13 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_id + - Processes.parent_process_id security_domain: endpoint diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml b/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml index 5c0b460a46..ededc6777c 100644 --- a/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml +++ b/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml @@ -51,4 +51,10 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.user + - Processes.dest security_domain: endpoint diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml b/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml index 274bf9990e..ef478ee546 100644 --- a/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml +++ b/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml @@ -51,4 +51,10 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process + - Processes.process_name + - Processes.user + - Processes.dest security_domain: endpoint diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml b/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml index 442b6b21b4..03925c4d56 100644 --- a/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml +++ b/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml @@ -51,4 +51,10 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process + - Processes.process_name + - Processes.user + - Processes.dest security_domain: endpoint diff --git a/detections/endpoint/detect_rundll32_inline_hta_execution.yml b/detections/endpoint/detect_rundll32_inline_hta_execution.yml index 6b047592f2..56418cd2fc 100644 --- a/detections/endpoint/detect_rundll32_inline_hta_execution.yml +++ b/detections/endpoint/detect_rundll32_inline_hta_execution.yml @@ -50,4 +50,12 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process + - Processes.process_name + - Processes.user + - Processes.dest + - Processes.parent_process_name + - Processes.parent_process security_domain: endpoint diff --git a/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml b/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml index d2323a96f4..a437f2bc42 100644 --- a/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml +++ b/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml @@ -43,4 +43,12 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process + - Processes.parent_process_name + - Processes.process_name + - Processes.parent_process + - Processes.user + - Processes.dest security_domain: endpoint diff --git a/detections/endpoint/disabling_remote_user_account_control.yml b/detections/endpoint/disabling_remote_user_account_control.yml index 42a31fc477..7983188c01 100644 --- a/detections/endpoint/disabling_remote_user_account_control.yml +++ b/detections/endpoint/disabling_remote_user_account_control.yml @@ -42,4 +42,12 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Registry.registry_path + - Registry.registry_value_name + - Registry.dest + - Registry.registry_key_name + - Registry.user + - Registry.action security_domain: endpoint diff --git a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml index 800a9204dc..94140f45e3 100644 --- a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml +++ b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml @@ -43,4 +43,10 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.user + - Processes.dest security_domain: endpoint diff --git a/detections/endpoint/dump_lsass_via_procdump.yml b/detections/endpoint/dump_lsass_via_procdump.yml index c0cd0d7d6d..8a49c832ac 100644 --- a/detections/endpoint/dump_lsass_via_procdump.yml +++ b/detections/endpoint/dump_lsass_via_procdump.yml @@ -52,4 +52,10 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.user + - Processes.dest security_domain: endpoint diff --git a/detections/endpoint/dump_lsass_via_procdump_rename.yml b/detections/endpoint/dump_lsass_via_procdump_rename.yml index a1de6284dc..cf666556d2 100644 --- a/detections/endpoint/dump_lsass_via_procdump_rename.yml +++ b/detections/endpoint/dump_lsass_via_procdump_rename.yml @@ -49,4 +49,12 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - OriginalFileName + - process_name + - EventID + - CommandLine + - Computer + - parent_process_name security_domain: endpoint diff --git a/detections/endpoint/eventvwr_uac_bypass.yml b/detections/endpoint/eventvwr_uac_bypass.yml index 01299e4d3a..44bf6fb1f5 100644 --- a/detections/endpoint/eventvwr_uac_bypass.yml +++ b/detections/endpoint/eventvwr_uac_bypass.yml @@ -41,3 +41,11 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + security_domain: endpoint + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name \ No newline at end of file diff --git a/detections/endpoint/execution_of_file_with_multiple_extensions.yml b/detections/endpoint/execution_of_file_with_multiple_extensions.yml index 633473b006..4f8ff42723 100644 --- a/detections/endpoint/execution_of_file_with_multiple_extensions.yml +++ b/detections/endpoint/execution_of_file_with_multiple_extensions.yml @@ -43,4 +43,10 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process + - Processes.dest + - Processes.user + - Processes.parent_process security_domain: endpoint diff --git a/detections/endpoint/file_with_samsam_extension.yml b/detections/endpoint/file_with_samsam_extension.yml index 1f28151793..95afab45cc 100644 --- a/detections/endpoint/file_with_samsam_extension.yml +++ b/detections/endpoint/file_with_samsam_extension.yml @@ -40,4 +40,10 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Filesystem.user + - Filesystem.dest + - Filesystem.file_path + - Filesystem.file_name security_domain: endpoint diff --git a/detections/endpoint/first_time_seen_child_process_of_zoom.yml b/detections/endpoint/first_time_seen_child_process_of_zoom.yml index ed2f96bb2f..60eac8677a 100644 --- a/detections/endpoint/first_time_seen_child_process_of_zoom.yml +++ b/detections/endpoint/first_time_seen_child_process_of_zoom.yml @@ -52,4 +52,13 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.parent_process_name + - Processes.parent_process_id + - Processes.process_name + - Processes.process + - Processes.parent_process_name + - Processes.process_id + - Processes.dest security_domain: endpoint diff --git a/detections/endpoint/fodhelper_uac_bypass.yml b/detections/endpoint/fodhelper_uac_bypass.yml index 27205556e1..75aa255280 100644 --- a/detections/endpoint/fodhelper_uac_bypass.yml +++ b/detections/endpoint/fodhelper_uac_bypass.yml @@ -50,3 +50,14 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + security_domain: endpoint + required_fields: + - _time + - Processes.parent_process_name + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id diff --git a/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml b/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml index 04875404b5..072f27287d 100644 --- a/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml +++ b/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml @@ -43,4 +43,11 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process + - Processes.process_name + - Processes.parent_process + - Processes.user + - Processes.dest security_domain: endpoint diff --git a/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml b/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml index 68e3409ef1..2ccaa299d6 100644 --- a/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml +++ b/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml @@ -38,4 +38,12 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - EventCode + - Ticket_Options + - Ticket_Encryption_Type + - dest + - service + - service_id security_domain: endpoint diff --git a/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml b/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml index 97a7eecbe2..ffebd2f670 100644 --- a/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml +++ b/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml @@ -53,4 +53,11 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process + - Processes.process_name + - Processes.user + - Processes.parent_process_name + - Processes.dest security_domain: endpoint diff --git a/detections/endpoint/malicious_powershell_process___encoded_command.yml b/detections/endpoint/malicious_powershell_process___encoded_command.yml index d0716dd22c..962b5bcb15 100644 --- a/detections/endpoint/malicious_powershell_process___encoded_command.yml +++ b/detections/endpoint/malicious_powershell_process___encoded_command.yml @@ -47,4 +47,12 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.user + - Processes.parent_process_name + - Processes.dest + - Processes.process_id security_domain: endpoint diff --git a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml index f1d66ed880..2446a119a8 100644 --- a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml +++ b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml @@ -50,4 +50,12 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process_id + - Processes.parent_process_id + - Processes.process + - Processes.process_name + - Processes.user + - Processes.dest security_domain: endpoint diff --git a/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml b/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml index 84b9ad0d70..9da3b6a47f 100644 --- a/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml +++ b/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml @@ -48,4 +48,12 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process + - Processes.parent_process + - Processes.process_name + - Processes.user + - Processes.parent_process_name + - Processes.dest security_domain: endpoint diff --git a/detections/endpoint/monitor_registry_keys_for_print_monitors.yml b/detections/endpoint/monitor_registry_keys_for_print_monitors.yml index 28370f53e5..836a01c18d 100644 --- a/detections/endpoint/monitor_registry_keys_for_print_monitors.yml +++ b/detections/endpoint/monitor_registry_keys_for_print_monitors.yml @@ -47,4 +47,12 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Registry.action + - Registry.registry_path + - Registry.dest + - Registry.registry_key_name + - Registry.user + - Registry.registry_value_name security_domain: endpoint diff --git a/detections/endpoint/nishang_powershelltcponeline.yml b/detections/endpoint/nishang_powershelltcponeline.yml index b35f2e8efa..7ae48ef35d 100644 --- a/detections/endpoint/nishang_powershelltcponeline.yml +++ b/detections/endpoint/nishang_powershelltcponeline.yml @@ -43,3 +43,14 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + security_domain: endpoint + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process_id + - Processes.parent_process_id \ No newline at end of file diff --git a/detections/endpoint/nltest_domain_trust_discovery.yml b/detections/endpoint/nltest_domain_trust_discovery.yml index 86d04768fb..e6e45673e1 100644 --- a/detections/endpoint/nltest_domain_trust_discovery.yml +++ b/detections/endpoint/nltest_domain_trust_discovery.yml @@ -50,4 +50,13 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_id + - Processes.parent_process_id security_domain: endpoint diff --git a/detections/endpoint/ntdsutil_export_ntds.yml b/detections/endpoint/ntdsutil_export_ntds.yml index cca6984d5d..1acf0ca3c6 100644 --- a/detections/endpoint/ntdsutil_export_ntds.yml +++ b/detections/endpoint/ntdsutil_export_ntds.yml @@ -55,4 +55,13 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_id + - Processes.parent_process_id security_domain: endpoint diff --git a/detections/endpoint/overwriting_accessibility_binaries.yml b/detections/endpoint/overwriting_accessibility_binaries.yml index f7d474c40e..f61e5c188d 100644 --- a/detections/endpoint/overwriting_accessibility_binaries.yml +++ b/detections/endpoint/overwriting_accessibility_binaries.yml @@ -45,4 +45,10 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Filesystem.dest + - Filesystem.file_path + - Filesystem.file_name + - Filesystem.dest security_domain: endpoint diff --git a/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml b/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml index 0fb2843236..bd62631195 100644 --- a/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml +++ b/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml @@ -50,4 +50,13 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Filesystem.file_name + - Filesystem.file_path + - Filesystem.process_id + - Filesystem.file_name + - Filesystem.file_path + - Filesystem.file_hash + - Filesystem.user security_domain: network diff --git a/detections/endpoint/process_execution_via_wmi.yml b/detections/endpoint/process_execution_via_wmi.yml index 1de8f1b1ed..56fa715b55 100644 --- a/detections/endpoint/process_execution_via_wmi.yml +++ b/detections/endpoint/process_execution_via_wmi.yml @@ -41,4 +41,11 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process + - Processes.parent_process_name + - Processes.user + - Processes.dest + - Processes.process_name security_domain: endpoint diff --git a/detections/endpoint/processes_launching_netsh.yml b/detections/endpoint/processes_launching_netsh.yml index 885bcbb14d..b82217f196 100644 --- a/detections/endpoint/processes_launching_netsh.yml +++ b/detections/endpoint/processes_launching_netsh.yml @@ -45,4 +45,12 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_name + - Processes.user + - Processes.dest security_domain: endpoint diff --git a/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml b/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml index 75a4f307c7..a37c5aea78 100644 --- a/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml +++ b/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml @@ -51,4 +51,12 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.parent_process_name + - Processes.user + - Processes.process + - Processes.process_id + - Processes.dest security_domain: endpoint diff --git a/detections/endpoint/registry_keys_for_creating_shim_databases.yml b/detections/endpoint/registry_keys_for_creating_shim_databases.yml index 08e0a43252..33f0d5de1f 100644 --- a/detections/endpoint/registry_keys_for_creating_shim_databases.yml +++ b/detections/endpoint/registry_keys_for_creating_shim_databases.yml @@ -41,4 +41,10 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.dest + - Registry.user security_domain: endpoint diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index 4fd1b76902..9bef6ba923 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -53,4 +53,10 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.dest + - Registry.user security_domain: endpoint diff --git a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml index 3eb1f7ebcb..970bc182ac 100644 --- a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml +++ b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml @@ -46,4 +46,10 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Registry.registry_path + - Registry.registry_key_name + - Registry.dest + - Registry.user security_domain: endpoint diff --git a/detections/endpoint/remote_process_instantiation_via_wmi.yml b/detections/endpoint/remote_process_instantiation_via_wmi.yml index 8730f187a9..74922eb617 100644 --- a/detections/endpoint/remote_process_instantiation_via_wmi.yml +++ b/detections/endpoint/remote_process_instantiation_via_wmi.yml @@ -47,4 +47,11 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.parent_process_name + - Processes.dest + - Processes.user security_domain: endpoint diff --git a/detections/endpoint/rundll_loading_dll_by_ordinal.yml b/detections/endpoint/rundll_loading_dll_by_ordinal.yml index 365530006f..7e143128e2 100644 --- a/detections/endpoint/rundll_loading_dll_by_ordinal.yml +++ b/detections/endpoint/rundll_loading_dll_by_ordinal.yml @@ -44,4 +44,11 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.parent_process_name + - Processes.process + - Processes.dest + - Processes.user security_domain: endpoint diff --git a/detections/endpoint/ryuk_test_files_detected.yml b/detections/endpoint/ryuk_test_files_detected.yml index 2b3e7386f4..73ccf05ea2 100644 --- a/detections/endpoint/ryuk_test_files_detected.yml +++ b/detections/endpoint/ryuk_test_files_detected.yml @@ -38,4 +38,9 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Filesystem.file_path + - Filesystem.dest + - Filesystem.user security_domain: endpoint diff --git a/detections/endpoint/ryuk_wake_on_lan_command.yml b/detections/endpoint/ryuk_wake_on_lan_command.yml index d2e36fb012..e06b51dfe5 100644 --- a/detections/endpoint/ryuk_wake_on_lan_command.yml +++ b/detections/endpoint/ryuk_wake_on_lan_command.yml @@ -43,4 +43,16 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + security_domain: endpoint automated_detection_testing: passed + required_fields: + - _time + - Processes.process + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + diff --git a/detections/endpoint/samsam_test_file_write.yml b/detections/endpoint/samsam_test_file_write.yml index 19c7c97446..98742610b0 100644 --- a/detections/endpoint/samsam_test_file_write.yml +++ b/detections/endpoint/samsam_test_file_write.yml @@ -39,4 +39,10 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Filesystem.user + - Filesystem.dest + - Filesystem.file_name + - Filesystem.file_path security_domain: endpoint diff --git a/detections/endpoint/sc_exe_manipulating_windows_services.yml b/detections/endpoint/sc_exe_manipulating_windows_services.yml index 87b24c5fd9..5449991567 100644 --- a/detections/endpoint/sc_exe_manipulating_windows_services.yml +++ b/detections/endpoint/sc_exe_manipulating_windows_services.yml @@ -51,4 +51,11 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.parent_process_name + - Processes.dest + - Processes.user security_domain: endpoint diff --git a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml index d6fa8d8dca..7291e4a0dd 100644 --- a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml +++ b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml @@ -42,4 +42,12 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process + - Processes.parent_process + - Processes.process_name + - Processes.user + - Processes.parent_process_name + - Processes.dest security_domain: endpoint diff --git a/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml b/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml index 7619cc7187..449d8add05 100644 --- a/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml +++ b/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml @@ -43,4 +43,11 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.parent_process_name + - Processes.dest + - Processes.user security_domain: endpoint diff --git a/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml b/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml index c6c443a99e..86ffdcc0d3 100644 --- a/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml +++ b/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml @@ -40,4 +40,11 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process + - Processes.process_name + - Processes.parent_process_name + - Processes.dest + - Processes.user security_domain: endpoint diff --git a/detections/endpoint/script_execution_via_wmi.yml b/detections/endpoint/script_execution_via_wmi.yml index f871561958..572bca9e10 100644 --- a/detections/endpoint/script_execution_via_wmi.yml +++ b/detections/endpoint/script_execution_via_wmi.yml @@ -41,4 +41,9 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.user + - Processes.dest security_domain: endpoint diff --git a/detections/endpoint/shim_database_file_creation.yml b/detections/endpoint/shim_database_file_creation.yml index 942141552a..6858157758 100644 --- a/detections/endpoint/shim_database_file_creation.yml +++ b/detections/endpoint/shim_database_file_creation.yml @@ -42,4 +42,10 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Filesystem.file_hash + - Filesystem.file_path + - Filesystem.file_name + - Filesystem.dest security_domain: endpoint diff --git a/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml b/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml index 0ab6149713..59318c5087 100644 --- a/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml +++ b/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml @@ -42,4 +42,10 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.parent_process_name + - Processes.dest + - Processes.user security_domain: endpoint diff --git a/detections/endpoint/short_lived_windows_accounts.yml b/detections/endpoint/short_lived_windows_accounts.yml index 01b6224326..81a9ef2239 100644 --- a/detections/endpoint/short_lived_windows_accounts.yml +++ b/detections/endpoint/short_lived_windows_accounts.yml @@ -40,4 +40,9 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - All_Changes.result_id + - All_Changes.user + - All_Changes.dest security_domain: access diff --git a/detections/endpoint/single_letter_process_on_endpoint.yml b/detections/endpoint/single_letter_process_on_endpoint.yml index b9e1602470..826f6d6855 100644 --- a/detections/endpoint/single_letter_process_on_endpoint.yml +++ b/detections/endpoint/single_letter_process_on_endpoint.yml @@ -42,4 +42,10 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.process + - Processes.process_name security_domain: endpoint diff --git a/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml b/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml index fe283c8a88..64385dc431 100644 --- a/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml +++ b/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml @@ -39,3 +39,15 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + security_domain: endpoint + required_fields: + - _time + - EventID + - process_name + - OriginalFileName + - CommandLine + - dest + - User + - ParentImage + - ParentCommandLine + - process_path diff --git a/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml b/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml index ebea7f91fd..b2e29f2172 100644 --- a/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml +++ b/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml @@ -39,3 +39,15 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + security_domain: endpoint + required_fields: + - _time + - EventID + - process_name + - OriginalFileName + - CommandLine + - dest + - User + - ParentImage + - ParentCommandLine + - process_path diff --git a/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml b/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml index 023502c92a..7d73514a9f 100644 --- a/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml +++ b/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml @@ -46,4 +46,14 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - EventID + - OriginalFileName + - process_name + - Computer + - User + - parent_process_name + - process_path + - CommandLine security_domain: endpoint diff --git a/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml b/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml index 24cdd929a4..5eefa64853 100644 --- a/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml +++ b/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml @@ -43,4 +43,11 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.dest + - Processes.parent_process + - Processes.user security_domain: endpoint diff --git a/detections/endpoint/suspicious_msbuild_path.yml b/detections/endpoint/suspicious_msbuild_path.yml index d10bb10c39..88151d4d33 100644 --- a/detections/endpoint/suspicious_msbuild_path.yml +++ b/detections/endpoint/suspicious_msbuild_path.yml @@ -49,4 +49,12 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.process_path + - Processes.dest + - Processes.parent_process + - Processes.user security_domain: endpoint diff --git a/detections/endpoint/suspicious_msbuild_rename.yml b/detections/endpoint/suspicious_msbuild_rename.yml index 83b0a7f78b..f5f30f1a77 100644 --- a/detections/endpoint/suspicious_msbuild_rename.yml +++ b/detections/endpoint/suspicious_msbuild_rename.yml @@ -46,4 +46,14 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - EventID + - OriginalFileName + - process_name + - Computer + - User + - parent_process_name + - process_path + - CommandLine security_domain: endpoint diff --git a/detections/endpoint/suspicious_msbuild_spawn.yml b/detections/endpoint/suspicious_msbuild_spawn.yml index 76fea9f03c..fbfc02af18 100644 --- a/detections/endpoint/suspicious_msbuild_spawn.yml +++ b/detections/endpoint/suspicious_msbuild_spawn.yml @@ -47,4 +47,12 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.parent_process_name + - Processes.dest + - Processes.parent_process + - Processes.user security_domain: endpoint diff --git a/detections/endpoint/suspicious_mshta_child_process.yml b/detections/endpoint/suspicious_mshta_child_process.yml index 5a9df018d5..9d75f7b3d7 100644 --- a/detections/endpoint/suspicious_mshta_child_process.yml +++ b/detections/endpoint/suspicious_mshta_child_process.yml @@ -49,4 +49,12 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.parent_process_name + - Processes.dest + - Processes.parent_process + - Processes.user security_domain: endpoint diff --git a/detections/endpoint/suspicious_mshta_spawn.yml b/detections/endpoint/suspicious_mshta_spawn.yml index 1b379e204f..d3d9a537ce 100644 --- a/detections/endpoint/suspicious_mshta_spawn.yml +++ b/detections/endpoint/suspicious_mshta_spawn.yml @@ -45,4 +45,12 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.parent_process_name + - Processes.dest + - Processes.parent_process + - Processes.user security_domain: endpoint diff --git a/detections/endpoint/suspicious_reg_exe_process.yml b/detections/endpoint/suspicious_reg_exe_process.yml index 0ac5e11eae..d90df61adc 100644 --- a/detections/endpoint/suspicious_reg_exe_process.yml +++ b/detections/endpoint/suspicious_reg_exe_process.yml @@ -49,4 +49,13 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.parent_process_name + - Processes.process_name + - Processes.user + - Processes.parent_process_name + - Processes.dest + - Processes.process_id + - Processes.parent_process_id security_domain: endpoint diff --git a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml index c0e07b6608..6d00c6edeb 100644 --- a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml +++ b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml @@ -50,4 +50,14 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process + - Processes.process_id + - Processes.parent_process_id security_domain: endpoint diff --git a/detections/endpoint/suspicious_rundll32_dllregisterserver.yml b/detections/endpoint/suspicious_rundll32_dllregisterserver.yml index cf186d2108..efceda4b73 100644 --- a/detections/endpoint/suspicious_rundll32_dllregisterserver.yml +++ b/detections/endpoint/suspicious_rundll32_dllregisterserver.yml @@ -53,4 +53,13 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_id + - Processes.parent_process_id security_domain: endpoint diff --git a/detections/endpoint/suspicious_rundll32_rename.yml b/detections/endpoint/suspicious_rundll32_rename.yml index 86a5d478f8..c1946a3499 100644 --- a/detections/endpoint/suspicious_rundll32_rename.yml +++ b/detections/endpoint/suspicious_rundll32_rename.yml @@ -47,4 +47,14 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - EventID + - OriginalFileName + - process_name + - Computer + - User + - parent_process_name + - process_path + - CommandLine security_domain: endpoint diff --git a/detections/endpoint/suspicious_rundll32_startw.yml b/detections/endpoint/suspicious_rundll32_startw.yml index 7ea978a948..b5846eae39 100644 --- a/detections/endpoint/suspicious_rundll32_startw.yml +++ b/detections/endpoint/suspicious_rundll32_startw.yml @@ -53,4 +53,13 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_id + - Processes.parent_process_id security_domain: endpoint diff --git a/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml b/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml index e448aace4e..94dba2d4ef 100644 --- a/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml +++ b/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml @@ -48,4 +48,15 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - EventID + - process_name + - OriginalFileName + - CommandLine + - dest + - User + - ParentImage + - ParentCommandLine + - process_path security_domain: endpoint diff --git a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml index 203ad7e335..d22fd3f2f2 100644 --- a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml +++ b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml @@ -43,3 +43,14 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + security_domain: endpoint + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process_id + - Processes.parent_process_id \ No newline at end of file diff --git a/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml b/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml index fc3148bd25..741098d141 100644 --- a/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml +++ b/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml @@ -39,3 +39,15 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + security_domain: endpoint + required_fields: + - _time + - EventID + - process_name + - OriginalFileName + - CommandLine + - dest + - User + - ParentImage + - ParentCommandLine + - process_path \ No newline at end of file diff --git a/detections/endpoint/suspicious_wevtutil_usage.yml b/detections/endpoint/suspicious_wevtutil_usage.yml index d38a7b7e54..3b0d69d03f 100644 --- a/detections/endpoint/suspicious_wevtutil_usage.yml +++ b/detections/endpoint/suspicious_wevtutil_usage.yml @@ -51,4 +51,11 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process + - Processes.process_name + - Processes.parent_process_name + - Processes.dest + - Processes.user security_domain: endpoint diff --git a/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml b/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml index 6336a4a2c5..e6e52c0c47 100644 --- a/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml +++ b/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml @@ -40,4 +40,15 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Filesystem.file_path + - Filesystem.file_name + - Filesystem.process_id + - Filesystem.dest + - Processes.user + - Processes.process_name + - Processes.parent_process_name + - Processes.process_id + - Processes.dest security_domain: endpoint diff --git a/detections/endpoint/system_information_discovery_detection.yml b/detections/endpoint/system_information_discovery_detection.yml index 7ccc22413b..55304c3f96 100644 --- a/detections/endpoint/system_information_discovery_detection.yml +++ b/detections/endpoint/system_information_discovery_detection.yml @@ -42,4 +42,10 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process + - Processes.user + - Processes.process_name + - Processes.dest security_domain: endpoint diff --git a/detections/endpoint/system_processes_run_from_unexpected_locations.yml b/detections/endpoint/system_processes_run_from_unexpected_locations.yml index 7d96db24b9..832c8ad50a 100644 --- a/detections/endpoint/system_processes_run_from_unexpected_locations.yml +++ b/detections/endpoint/system_processes_run_from_unexpected_locations.yml @@ -41,4 +41,13 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process_path + - Processes.user + - Processes.dest + - Processes.process_name + - Processes.process_id + - Processes.parent_process_name + - Processes.process_hash security_domain: endpoint diff --git a/detections/endpoint/unified_messaging_service_spawning_a_process.yml b/detections/endpoint/unified_messaging_service_spawning_a_process.yml index facd55a9e5..e0f00bf3ed 100644 --- a/detections/endpoint/unified_messaging_service_spawning_a_process.yml +++ b/detections/endpoint/unified_messaging_service_spawning_a_process.yml @@ -45,4 +45,14 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + security_domain: endpoint + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_id + - Processes.parent_process_id automated_detection_testing: passed diff --git a/detections/endpoint/unload_sysmon_filter_driver.yml b/detections/endpoint/unload_sysmon_filter_driver.yml index 051223669f..766fd5d2fd 100644 --- a/detections/endpoint/unload_sysmon_filter_driver.yml +++ b/detections/endpoint/unload_sysmon_filter_driver.yml @@ -43,4 +43,12 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_name + - Processes.dest + - Processes.user security_domain: endpoint diff --git a/detections/endpoint/unusually_long_command_line.yml b/detections/endpoint/unusually_long_command_line.yml index f7d114d917..9cecb80c5c 100644 --- a/detections/endpoint/unusually_long_command_line.yml +++ b/detections/endpoint/unusually_long_command_line.yml @@ -42,4 +42,10 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.user + - Processes.dest + - Processes.process_name + - Processes.process security_domain: endpoint diff --git a/detections/endpoint/usn_journal_deletion.yml b/detections/endpoint/usn_journal_deletion.yml index b0a5d88e99..d994117bba 100644 --- a/detections/endpoint/usn_journal_deletion.yml +++ b/detections/endpoint/usn_journal_deletion.yml @@ -49,4 +49,12 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process + - Processes.parent_process + - Processes.process_name + - Processes.user + - Processes.parent_process_name + - Processes.dest security_domain: endpoint diff --git a/detections/endpoint/w3wp_spawning_shell.yml b/detections/endpoint/w3wp_spawning_shell.yml index 8e381980a0..fbc5bcdc30 100644 --- a/detections/endpoint/w3wp_spawning_shell.yml +++ b/detections/endpoint/w3wp_spawning_shell.yml @@ -41,4 +41,12 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + security_domain: endpoint + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.dest + - Processes.user + - Processes.parent_process automated_detection_testing: passed diff --git a/detections/endpoint/wbadmin_delete_system_backups.yml b/detections/endpoint/wbadmin_delete_system_backups.yml index 5c47434d89..c8a5890ee4 100644 --- a/detections/endpoint/wbadmin_delete_system_backups.yml +++ b/detections/endpoint/wbadmin_delete_system_backups.yml @@ -44,4 +44,11 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.parent_process_name + - Processes.dest + - Processes.user security_domain: endpoint diff --git a/detections/endpoint/windows_disableantispyware_reg.yml b/detections/endpoint/windows_disableantispyware_reg.yml index fdb5a41cbe..d4e86e5b1d 100644 --- a/detections/endpoint/windows_disableantispyware_reg.yml +++ b/detections/endpoint/windows_disableantispyware_reg.yml @@ -47,4 +47,11 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_value_name + - Registry.dest + - Registry.user + - Registry.registry_path security_domain: endpoint diff --git a/detections/endpoint/windows_event_log_cleared.yml b/detections/endpoint/windows_event_log_cleared.yml index 4551e47785..97ffdf278f 100644 --- a/detections/endpoint/windows_event_log_cleared.yml +++ b/detections/endpoint/windows_event_log_cleared.yml @@ -7,10 +7,10 @@ type: batch datamodel: [] description: This search looks for Windows events that indicate one of the Windows event logs has been purged. -search: (`wineventlog_security` (EventCode=1102 OR EventCode=1100)) OR (`wineventlog_system` +search: '(`wineventlog_security` (EventCode=1102 OR EventCode=1100)) OR (`wineventlog_system` EventCode=104) | stats count min(_time) as firstTime max(_time) as lastTime by EventCode dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_event_log_cleared_filter` + | `windows_event_log_cleared_filter`' how_to_implement: To successfully implement this search, you need to be ingesting Windows event logs from your hosts. known_false_positives: It is possible that these logs may be legitimately cleared @@ -43,4 +43,8 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - EventCode + - dest security_domain: endpoint diff --git a/detections/endpoint/windows_security_account_manager_stopped.yml b/detections/endpoint/windows_security_account_manager_stopped.yml index b0e0e01abf..fef52f7f43 100644 --- a/detections/endpoint/windows_security_account_manager_stopped.yml +++ b/detections/endpoint/windows_security_account_manager_stopped.yml @@ -40,4 +40,10 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.dest + - Processes.user security_domain: endpoint diff --git a/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml b/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml index bdf3982186..02ea4b7c39 100644 --- a/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml +++ b/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml @@ -38,4 +38,14 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - EventCode + - host + - user + - Operation + - EventType + - Query + - Consumer + - Filter security_domain: endpoint diff --git a/detections/experimental/application/detect_new_login_attempts_to_routers.yml b/detections/experimental/application/detect_new_login_attempts_to_routers.yml index dcb8aa1b6b..64c82afde4 100644 --- a/detections/experimental/application/detect_new_login_attempts_to_routers.yml +++ b/detections/experimental/application/detect_new_login_attempts_to_routers.yml @@ -36,4 +36,9 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Authentication.dest_category + - Authentication.dest + - Authentication.user security_domain: network diff --git a/detections/experimental/application/email_attachments_with_lots_of_spaces.yml b/detections/experimental/application/email_attachments_with_lots_of_spaces.yml index b13ccb80ee..41756c1e47 100644 --- a/detections/experimental/application/email_attachments_with_lots_of_spaces.yml +++ b/detections/experimental/application/email_attachments_with_lots_of_spaces.yml @@ -45,4 +45,11 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - All_Email.recipient + - All_Email.file_name + - All_Email.src_user + - All_Email.file_name + - All_Email.message_id security_domain: network diff --git a/detections/experimental/application/email_files_written_outside_of_the_outlook_directory.yml b/detections/experimental/application/email_files_written_outside_of_the_outlook_directory.yml index 680c012412..8d4f823b6c 100644 --- a/detections/experimental/application/email_files_written_outside_of_the_outlook_directory.yml +++ b/detections/experimental/application/email_files_written_outside_of_the_outlook_directory.yml @@ -39,4 +39,11 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Filesystem.file_path + - Filesystem.file_name + - Filesystem.action + - Filesystem.process_id + - Filesystem.dest security_domain: endpoint diff --git a/detections/experimental/application/email_servers_sending_high_volume_traffic_to_hosts.yml b/detections/experimental/application/email_servers_sending_high_volume_traffic_to_hosts.yml index 7e8aacb673..fdf21a24e1 100644 --- a/detections/experimental/application/email_servers_sending_high_volume_traffic_to_hosts.yml +++ b/detections/experimental/application/email_servers_sending_high_volume_traffic_to_hosts.yml @@ -53,4 +53,9 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - All_Traffic.bytes_out + - All_Traffic.src_category + - All_Traffic.dest_ip security_domain: network diff --git a/detections/experimental/application/monitor_email_for_brand_abuse.yml b/detections/experimental/application/monitor_email_for_brand_abuse.yml index b90a8c2d05..bb4e5c8f99 100644 --- a/detections/experimental/application/monitor_email_for_brand_abuse.yml +++ b/detections/experimental/application/monitor_email_for_brand_abuse.yml @@ -36,4 +36,9 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - All_Email.recipient + - All_Email.src_user + - All_Email.message_id security_domain: network diff --git a/detections/experimental/application/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml b/detections/experimental/application/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml index 0da01c6449..998c33216e 100644 --- a/detections/experimental/application/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml +++ b/detections/experimental/application/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml @@ -34,4 +34,13 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - outcome.reason + - client.geographicalContext.country + - client.geographicalContext.state + - client.geographicalContext.city + - user + - src_ip + - displayMessage security_domain: access diff --git a/detections/experimental/application/no_windows_updates_in_a_time_frame.yml b/detections/experimental/application/no_windows_updates_in_a_time_frame.yml index 260866e37a..436ad2e90a 100644 --- a/detections/experimental/application/no_windows_updates_in_a_time_frame.yml +++ b/detections/experimental/application/no_windows_updates_in_a_time_frame.yml @@ -39,4 +39,9 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Updates.status + - Updates.vendor_product + - Updates.dest security_domain: endpoint diff --git a/detections/experimental/application/okta_account_lockout_events.yml b/detections/experimental/application/okta_account_lockout_events.yml index 0740c2cf38..9e9fb09806 100644 --- a/detections/experimental/application/okta_account_lockout_events.yml +++ b/detections/experimental/application/okta_account_lockout_events.yml @@ -29,4 +29,10 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - displayMessage + - client.geographicalContext.country + - client.geographicalContext.state + - client.geographicalContext.city security_domain: access diff --git a/detections/experimental/application/okta_failed_sso_attempts.yml b/detections/experimental/application/okta_failed_sso_attempts.yml index 8b5426dcc9..d3657a18aa 100644 --- a/detections/experimental/application/okta_failed_sso_attempts.yml +++ b/detections/experimental/application/okta_failed_sso_attempts.yml @@ -29,4 +29,11 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - displayMessage + - app + - user + - result + - src_ip security_domain: access diff --git a/detections/experimental/application/okta_user_logins_from_multiple_cities.yml b/detections/experimental/application/okta_user_logins_from_multiple_cities.yml index 35dba10164..f9af8ceabf 100644 --- a/detections/experimental/application/okta_user_logins_from_multiple_cities.yml +++ b/detections/experimental/application/okta_user_logins_from_multiple_cities.yml @@ -35,4 +35,10 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - displayMessage + - client.geographicalContext.city + - client.geographicalContext.state + - user security_domain: access diff --git a/detections/experimental/application/suspicious_email_attachment_extensions.yml b/detections/experimental/application/suspicious_email_attachment_extensions.yml index a5ddc04ec4..0dd5924c4e 100644 --- a/detections/experimental/application/suspicious_email_attachment_extensions.yml +++ b/detections/experimental/application/suspicious_email_attachment_extensions.yml @@ -47,4 +47,9 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - All_Email.file_name + - All_Email.src_user + - All_Email.message_id security_domain: network diff --git a/detections/experimental/application/suspicious_java_classes.yml b/detections/experimental/application/suspicious_java_classes.yml index 20b9f4c9a4..71b239ab65 100644 --- a/detections/experimental/application/suspicious_java_classes.yml +++ b/detections/experimental/application/suspicious_java_classes.yml @@ -33,4 +33,14 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - http_method + - http_content_length + - src_ip + - url + - status + - http_user_agent + - src + - dest security_domain: threat diff --git a/detections/experimental/application/web_servers_executing_suspicious_processes.yml b/detections/experimental/application/web_servers_executing_suspicious_processes.yml index b9cceaa60a..0b9aedda13 100644 --- a/detections/experimental/application/web_servers_executing_suspicious_processes.yml +++ b/detections/experimental/application/web_servers_executing_suspicious_processes.yml @@ -39,4 +39,11 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.dest_category + - Processes.process + - Processes.process_name + - Processes.dest + - Processes.user security_domain: endpoint diff --git a/detections/experimental/cloud/abnormally_high_cloud_instances_destroyed.yml b/detections/experimental/cloud/abnormally_high_cloud_instances_destroyed.yml index c8df0ab4a6..9c63535d48 100644 --- a/detections/experimental/cloud/abnormally_high_cloud_instances_destroyed.yml +++ b/detections/experimental/cloud/abnormally_high_cloud_instances_destroyed.yml @@ -47,6 +47,13 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - All_Changes.object_id + - All_Changes.action + - All_Changes.status + - All_Changes.object_category + - All_Changes.user risk_object: user risk_object_type: user risk_score: 10 diff --git a/detections/experimental/cloud/abnormally_high_cloud_instances_launched.yml b/detections/experimental/cloud/abnormally_high_cloud_instances_launched.yml index 707441011f..a51da3d794 100644 --- a/detections/experimental/cloud/abnormally_high_cloud_instances_launched.yml +++ b/detections/experimental/cloud/abnormally_high_cloud_instances_launched.yml @@ -48,6 +48,13 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - All_Changes.object_id + - All_Changes.action + - All_Changes.status + - All_Changes.object_category + - All_Changes.user risk_object: user risk_object_type: user risk_score: 40 diff --git a/detections/experimental/cloud/amazon_eks_kubernetes_cluster_scan_detection.yml b/detections/experimental/cloud/amazon_eks_kubernetes_cluster_scan_detection.yml index 17fc6b562d..f480552aaf 100644 --- a/detections/experimental/cloud/amazon_eks_kubernetes_cluster_scan_detection.yml +++ b/detections/experimental/cloud/amazon_eks_kubernetes_cluster_scan_detection.yml @@ -31,4 +31,16 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - user.username + - userAgent + - sourceIPs{} + - responseStatus.reason + - source + - responseStatus.code + - verb + - requestURI + - src_ip + - user.groups{} security_domain: threat diff --git a/detections/experimental/cloud/amazon_eks_kubernetes_pod_scan_detection.yml b/detections/experimental/cloud/amazon_eks_kubernetes_pod_scan_detection.yml index 7ec567a60c..b08c483e37 100644 --- a/detections/experimental/cloud/amazon_eks_kubernetes_pod_scan_detection.yml +++ b/detections/experimental/cloud/amazon_eks_kubernetes_pod_scan_detection.yml @@ -32,4 +32,17 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - user.username + - verb + - objectRef.resource + - requestURI + - source + - sourceIPs{} + - responseStatus.reason + - responseStatus.code + - userAgent + - src_ip + - user.groups{} security_domain: threat diff --git a/detections/experimental/cloud/aws_detect_attach_to_role_policy.yml b/detections/experimental/cloud/aws_detect_attach_to_role_policy.yml index ec33f24fd2..dccf43f830 100644 --- a/detections/experimental/cloud/aws_detect_attach_to_role_policy.yml +++ b/detections/experimental/cloud/aws_detect_attach_to_role_policy.yml @@ -30,4 +30,7 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - requestParameters.policyArn security_domain: threat diff --git a/detections/experimental/cloud/aws_detect_permanent_key_creation.yml b/detections/experimental/cloud/aws_detect_permanent_key_creation.yml index 80b079210e..fa9d678c60 100644 --- a/detections/experimental/cloud/aws_detect_permanent_key_creation.yml +++ b/detections/experimental/cloud/aws_detect_permanent_key_creation.yml @@ -29,4 +29,16 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - eventName + - userIdentity.type + - sourceIPAddress + - userName userIdentity.type + - userAgent + - action + - status + - responseElements.accessKey.createDate + - esponseElements.accessKey.status + - responseElements.accessKey.accessKeyId security_domain: threat diff --git a/detections/experimental/cloud/aws_detect_role_creation.yml b/detections/experimental/cloud/aws_detect_role_creation.yml index 1841b3f6e5..65da0b3a02 100644 --- a/detections/experimental/cloud/aws_detect_role_creation.yml +++ b/detections/experimental/cloud/aws_detect_role_creation.yml @@ -32,4 +32,23 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - event_name + - action + - userIdentity.type + - requestParameters.description + - sourceIPAddress + - userIdentity.principalId + - userIdentity.arn + - action + - event_name + - awsRegion + - http_user_agent + - mfa_auth + - msg + - requestParameters.roleName + - requestParameters.description + - responseElements.role.arn + - responseElements.role.createDate security_domain: threat diff --git a/detections/experimental/cloud/aws_detect_sts_assume_role_abuse.yml b/detections/experimental/cloud/aws_detect_sts_assume_role_abuse.yml index 99799e92b2..900f611b9d 100644 --- a/detections/experimental/cloud/aws_detect_sts_assume_role_abuse.yml +++ b/detections/experimental/cloud/aws_detect_sts_assume_role_abuse.yml @@ -30,4 +30,17 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - user_type + - userIdentity.sessionContext.sessionIssuer.type + - sourceIPAddress + - userIdentity.arn + - user_agent + - user_access_key + - status + - action + - requestParameters.roleName + - esponseElements.role.roleName + - esponseElements.role.createDate security_domain: threat diff --git a/detections/experimental/cloud/aws_detect_sts_get_session_token_abuse.yml b/detections/experimental/cloud/aws_detect_sts_get_session_token_abuse.yml index a3c5eb90ee..29e4b18515 100644 --- a/detections/experimental/cloud/aws_detect_sts_get_session_token_abuse.yml +++ b/detections/experimental/cloud/aws_detect_sts_get_session_token_abuse.yml @@ -30,4 +30,16 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - userIdentity.type + - eventName + - sourceIPAddress + - eventTime + - userIdentity.arn + - userName + - userAgent + - user_type + - status + - region security_domain: threat diff --git a/detections/experimental/cloud/detect_gcp_storage_access_from_a_new_ip.yml b/detections/experimental/cloud/detect_gcp_storage_access_from_a_new_ip.yml index d5a702a1cb..9d81174150 100644 --- a/detections/experimental/cloud/detect_gcp_storage_access_from_a_new_ip.yml +++ b/detections/experimental/cloud/detect_gcp_storage_access_from_a_new_ip.yml @@ -54,4 +54,11 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - sc_status_ + - cs_object_ + - c_ip_ + - cs_uri_ + - cs_method_ security_domain: network diff --git a/detections/experimental/cloud/detect_new_open_gcp_storage_buckets.yml b/detections/experimental/cloud/detect_new_open_gcp_storage_buckets.yml index cb8dfcf3fe..b014153fc1 100644 --- a/detections/experimental/cloud/detect_new_open_gcp_storage_buckets.yml +++ b/detections/experimental/cloud/detect_new_open_gcp_storage_buckets.yml @@ -42,4 +42,15 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - data.resource.type + - data.protoPayload.methodName + - data.protoPayload.serviceData.policyDelta.bindingDeltas{}.action + - data.protoPayload.authenticationInfo.principalEmail + - data.protoPayload.resourceLocation.currentLocations{} + - data.protoPayload.requestMetadata.callerIp + - data.protoPayload.resourceName + - data.protoPayload.serviceData.policyDelta.bindingDeltas{}.role + - data.protoPayload.serviceData.policyDelta.bindingDeltas{}.member security_domain: network diff --git a/detections/experimental/cloud/detect_s3_access_from_a_new_ip.yml b/detections/experimental/cloud/detect_s3_access_from_a_new_ip.yml index 3cf6e5e656..63a3286e81 100644 --- a/detections/experimental/cloud/detect_s3_access_from_a_new_ip.yml +++ b/detections/experimental/cloud/detect_s3_access_from_a_new_ip.yml @@ -43,6 +43,11 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - http_status + - bucket_name + - remote_ip risk_object: src_ip risk_object_type: system risk_score: 10 diff --git a/detections/experimental/cloud/detect_spike_in_aws_security_hub_alerts_for_user.yml b/detections/experimental/cloud/detect_spike_in_aws_security_hub_alerts_for_user.yml index a2cbabf3fe..9b2b3d0f36 100644 --- a/detections/experimental/cloud/detect_spike_in_aws_security_hub_alerts_for_user.yml +++ b/detections/experimental/cloud/detect_spike_in_aws_security_hub_alerts_for_user.yml @@ -31,4 +31,9 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - findings{}.Resources{}.Type + - indings{}.Resources{}.Id + - user security_domain: network diff --git a/detections/experimental/cloud/detect_spike_in_blocked_outbound_traffic_from_your_aws.yml b/detections/experimental/cloud/detect_spike_in_blocked_outbound_traffic_from_your_aws.yml index fbc6eef691..f405807d9d 100644 --- a/detections/experimental/cloud/detect_spike_in_blocked_outbound_traffic_from_your_aws.yml +++ b/detections/experimental/cloud/detect_spike_in_blocked_outbound_traffic_from_your_aws.yml @@ -59,6 +59,11 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - action + - src_ip + - dest_ip risk_object: src_ip risk_object_type: system risk_score: 20 diff --git a/detections/experimental/cloud/detect_spike_in_s3_bucket_deletion.yml b/detections/experimental/cloud/detect_spike_in_s3_bucket_deletion.yml index e43dd157f8..905e4f1fc9 100644 --- a/detections/experimental/cloud/detect_spike_in_s3_bucket_deletion.yml +++ b/detections/experimental/cloud/detect_spike_in_s3_bucket_deletion.yml @@ -52,6 +52,10 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - eventName + - userIdentity.arn risk_object: user risk_object_type: user risk_score: 10 diff --git a/detections/experimental/cloud/gcp_detect_gcploit_framework.yml b/detections/experimental/cloud/gcp_detect_gcploit_framework.yml index 7d112319e1..55602d3497 100644 --- a/detections/experimental/cloud/gcp_detect_gcploit_framework.yml +++ b/detections/experimental/cloud/gcp_detect_gcploit_framework.yml @@ -32,4 +32,14 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - data.protoPayload.request.function.timeout + - src + - src_user + - data.resource.labels.project_id + - data.protoPayload.request.function.serviceAccountEmail + - data.protoPayload.authorizationInfo{}.permission + - data.protoPayload.request.location + - http_user_agent security_domain: threat diff --git a/detections/experimental/cloud/gcp_kubernetes_cluster_pod_scan_detection.yml b/detections/experimental/cloud/gcp_kubernetes_cluster_pod_scan_detection.yml index 09d4e4b55d..8c87e69ddf 100644 --- a/detections/experimental/cloud/gcp_kubernetes_cluster_pod_scan_detection.yml +++ b/detections/experimental/cloud/gcp_kubernetes_cluster_pod_scan_detection.yml @@ -27,4 +27,14 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - category + - responseStatus.code + - sourceIPs{} + - userAgent + - verb + - requestURI + - responseStatus.reason + - properties.pod security_domain: threat diff --git a/detections/experimental/cloud/high_number_of_login_failures_from_a_single_source.yml b/detections/experimental/cloud/high_number_of_login_failures_from_a_single_source.yml index 549076642f..faf0db4630 100644 --- a/detections/experimental/cloud/high_number_of_login_failures_from_a_single_source.yml +++ b/detections/experimental/cloud/high_number_of_login_failures_from_a_single_source.yml @@ -33,4 +33,16 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Operation + - record_type + - app + - user + - LogonError + - authentication_method + - signature + - UserAgent + - src_ip + - record_type security_domain: threat diff --git a/detections/experimental/cloud/kubernetes_aws_detect_suspicious_kubectl_calls.yml b/detections/experimental/cloud/kubernetes_aws_detect_suspicious_kubectl_calls.yml index ff8cba3f9e..68ee00b79c 100644 --- a/detections/experimental/cloud/kubernetes_aws_detect_suspicious_kubectl_calls.yml +++ b/detections/experimental/cloud/kubernetes_aws_detect_suspicious_kubectl_calls.yml @@ -26,4 +26,12 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - userAgent + - sourceIPs{} + - src_user + - src_ip + - verb + - requestURI security_domain: threat diff --git a/detections/experimental/cloud/new_container_uploaded_to_aws_ecr.yml b/detections/experimental/cloud/new_container_uploaded_to_aws_ecr.yml index 0ce8471f56..c1be25bc4f 100644 --- a/detections/experimental/cloud/new_container_uploaded_to_aws_ecr.yml +++ b/detections/experimental/cloud/new_container_uploaded_to_aws_ecr.yml @@ -30,4 +30,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time security_domain: threat diff --git a/detections/experimental/endpoint/child_processes_of_spoolsv_exe.yml b/detections/experimental/endpoint/child_processes_of_spoolsv_exe.yml index 21247f7933..390555875e 100644 --- a/detections/experimental/endpoint/child_processes_of_spoolsv_exe.yml +++ b/detections/experimental/endpoint/child_processes_of_spoolsv_exe.yml @@ -44,4 +44,13 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.parent_process_name + - Processes.process_name + - Processes.dest + - Processes.parent_process + - Processes.user security_domain: endpoint diff --git a/detections/experimental/endpoint/detect_baron_samedit_cve_2021_3156.yml b/detections/experimental/endpoint/detect_baron_samedit_cve_2021_3156.yml index 42553d4a4b..23777f2158 100644 --- a/detections/experimental/endpoint/detect_baron_samedit_cve_2021_3156.yml +++ b/detections/experimental/endpoint/detect_baron_samedit_cve_2021_3156.yml @@ -32,4 +32,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time security_domain: endpoint diff --git a/detections/experimental/endpoint/detect_baron_samedit_cve_2021_3156_segfault.yml b/detections/experimental/endpoint/detect_baron_samedit_cve_2021_3156_segfault.yml index 523180408b..f5106efba1 100644 --- a/detections/experimental/endpoint/detect_baron_samedit_cve_2021_3156_segfault.yml +++ b/detections/experimental/endpoint/detect_baron_samedit_cve_2021_3156_segfault.yml @@ -35,4 +35,7 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - host security_domain: endpoint diff --git a/detections/experimental/endpoint/detect_baron_samedit_cve_2021_3156_via_osquery.yml b/detections/experimental/endpoint/detect_baron_samedit_cve_2021_3156_via_osquery.yml index bdaa20f495..f3f44fa477 100644 --- a/detections/experimental/endpoint/detect_baron_samedit_cve_2021_3156_via_osquery.yml +++ b/detections/experimental/endpoint/detect_baron_samedit_cve_2021_3156_via_osquery.yml @@ -32,4 +32,7 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - columns.cmdline security_domain: endpoint diff --git a/detections/experimental/endpoint/detect_exchange_web_shell.yml b/detections/experimental/endpoint/detect_exchange_web_shell.yml index 5d4f30f523..ecaff7c803 100644 --- a/detections/experimental/endpoint/detect_exchange_web_shell.yml +++ b/detections/experimental/endpoint/detect_exchange_web_shell.yml @@ -38,4 +38,11 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - \ No newline at end of file + security_domain: endpoint + required_fields: + - _time + - Filesystem.file_path + - Filesystem.process_id + - Filesystem.file_name + - Filesystem.file_hash + - Filesystem.user \ No newline at end of file diff --git a/detections/experimental/endpoint/detect_oulook_exe_writing_a__zip_file.yml b/detections/experimental/endpoint/detect_oulook_exe_writing_a__zip_file.yml index 119e697c68..c2e7d3d4f0 100644 --- a/detections/experimental/endpoint/detect_oulook_exe_writing_a__zip_file.yml +++ b/detections/experimental/endpoint/detect_oulook_exe_writing_a__zip_file.yml @@ -49,4 +49,12 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.parent_process_id + - Processes.process_id + - Processes.dest + - Processes.parent_process_name + - Processes.user security_domain: network diff --git a/detections/experimental/endpoint/detect_rare_executables.yml b/detections/experimental/endpoint/detect_rare_executables.yml index edb7bb1b93..f401c5ef16 100644 --- a/detections/experimental/endpoint/detect_rare_executables.yml +++ b/detections/experimental/endpoint/detect_rare_executables.yml @@ -50,4 +50,9 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.process_name security_domain: endpoint diff --git a/detections/experimental/endpoint/detection_of_tools_built_by_nirsoft.yml b/detections/experimental/endpoint/detection_of_tools_built_by_nirsoft.yml index 739c1d5904..796d911a53 100644 --- a/detections/experimental/endpoint/detection_of_tools_built_by_nirsoft.yml +++ b/detections/experimental/endpoint/detection_of_tools_built_by_nirsoft.yml @@ -38,4 +38,10 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process + - Processes.parent_process + - Processes.process_name + - Processes.user security_domain: endpoint diff --git a/detections/experimental/endpoint/first_time_seen_running_windows_service.yml b/detections/experimental/endpoint/first_time_seen_running_windows_service.yml index 83b31906f8..f96c33119a 100644 --- a/detections/experimental/endpoint/first_time_seen_running_windows_service.yml +++ b/detections/experimental/endpoint/first_time_seen_running_windows_service.yml @@ -47,4 +47,9 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - EventCode + - Message + - dest security_domain: endpoint diff --git a/detections/experimental/endpoint/macos___re_opened_applications.yml b/detections/experimental/endpoint/macos___re_opened_applications.yml index 20dfa8b493..983e1f6686 100644 --- a/detections/experimental/endpoint/macos___re_opened_applications.yml +++ b/detections/experimental/endpoint/macos___re_opened_applications.yml @@ -41,4 +41,12 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process + - Processes.parent_process + - Processes.user + - Processes.process_name + - Processes.parent_process_name + - Processes.dest security_domain: threat diff --git a/detections/experimental/endpoint/processes_tapping_keyboard_events.yml b/detections/experimental/endpoint/processes_tapping_keyboard_events.yml index d94c514f67..6582417e65 100644 --- a/detections/experimental/endpoint/processes_tapping_keyboard_events.yml +++ b/detections/experimental/endpoint/processes_tapping_keyboard_events.yml @@ -37,4 +37,12 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - app + - name + - columns.cmdline + - columns.name + - columns.pid + - host security_domain: threat diff --git a/detections/experimental/endpoint/remote_desktop_process_running_on_system.yml b/detections/experimental/endpoint/remote_desktop_process_running_on_system.yml index c00b9a83c9..29f2055d0b 100644 --- a/detections/experimental/endpoint/remote_desktop_process_running_on_system.yml +++ b/detections/experimental/endpoint/remote_desktop_process_running_on_system.yml @@ -46,4 +46,10 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process + - Processes.dest_category + - Processes.dest + - Processes.user security_domain: endpoint diff --git a/detections/experimental/endpoint/spike_in_file_writes.yml b/detections/experimental/endpoint/spike_in_file_writes.yml index 5a61580b9d..38d9e00271 100644 --- a/detections/experimental/endpoint/spike_in_file_writes.yml +++ b/detections/experimental/endpoint/spike_in_file_writes.yml @@ -39,4 +39,8 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Filesystem.action + - Filesystem.dest security_domain: endpoint diff --git a/detections/experimental/endpoint/sunburst_correlation_dll_and_network_event.yml b/detections/experimental/endpoint/sunburst_correlation_dll_and_network_event.yml index e942474d48..8313925d74 100644 --- a/detections/experimental/endpoint/sunburst_correlation_dll_and_network_event.yml +++ b/detections/experimental/endpoint/sunburst_correlation_dll_and_network_event.yml @@ -38,4 +38,9 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - EventCode + - ImageLoaded + - QueryName security_domain: endpoint diff --git a/detections/experimental/endpoint/suspicious_curl_network_connection.yml b/detections/experimental/endpoint/suspicious_curl_network_connection.yml index b032bd976e..bfaa4e5cdc 100644 --- a/detections/experimental/endpoint/suspicious_curl_network_connection.yml +++ b/detections/experimental/endpoint/suspicious_curl_network_connection.yml @@ -36,4 +36,13 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_id + - Processes.parent_process_id security_domain: endpoint diff --git a/detections/experimental/endpoint/suspicious_plistbuddy_usage.yml b/detections/experimental/endpoint/suspicious_plistbuddy_usage.yml index f23862b30b..5228a3b666 100644 --- a/detections/experimental/endpoint/suspicious_plistbuddy_usage.yml +++ b/detections/experimental/endpoint/suspicious_plistbuddy_usage.yml @@ -58,4 +58,13 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_id + - Processes.parent_process_id security_domain: endpoint diff --git a/detections/experimental/endpoint/suspicious_plistbuddy_usage_via_osquery.yml b/detections/experimental/endpoint/suspicious_plistbuddy_usage_via_osquery.yml index 166842d10e..0a39f86f1b 100644 --- a/detections/experimental/endpoint/suspicious_plistbuddy_usage_via_osquery.yml +++ b/detections/experimental/endpoint/suspicious_plistbuddy_usage_via_osquery.yml @@ -53,4 +53,7 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - columns.cmdline security_domain: endpoint diff --git a/detections/experimental/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml b/detections/experimental/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml index 79d88ba76c..7f7a1b127d 100644 --- a/detections/experimental/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml +++ b/detections/experimental/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml @@ -36,4 +36,13 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_id + - Processes.parent_process_id security_domain: endpoint diff --git a/detections/experimental/endpoint/unusually_long_command_line___mltk.yml b/detections/experimental/endpoint/unusually_long_command_line___mltk.yml index 458754720a..67c273e04e 100644 --- a/detections/experimental/endpoint/unusually_long_command_line___mltk.yml +++ b/detections/experimental/endpoint/unusually_long_command_line___mltk.yml @@ -52,4 +52,10 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.user + - Processes.dest + - Processes.process_name + - Processes.process security_domain: endpoint diff --git a/detections/experimental/endpoint/windows_adfind_exe.yml b/detections/experimental/endpoint/windows_adfind_exe.yml index 43796f1380..c02fe85f37 100644 --- a/detections/experimental/endpoint/windows_adfind_exe.yml +++ b/detections/experimental/endpoint/windows_adfind_exe.yml @@ -46,4 +46,13 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process + - Processes.dest + - Processes.user + - Processes.process_name + - Processes.parent_process + - Processes.process_id + - Processes.parent_process_id security_domain: endpoint diff --git a/detections/experimental/endpoint/wmi_permanent_event_subscription.yml b/detections/experimental/endpoint/wmi_permanent_event_subscription.yml index a35567f023..d2ae61da94 100644 --- a/detections/experimental/endpoint/wmi_permanent_event_subscription.yml +++ b/detections/experimental/endpoint/wmi_permanent_event_subscription.yml @@ -37,4 +37,10 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - EventCode + - Message + - consumer + - ComputerName security_domain: endpoint diff --git a/detections/experimental/endpoint/wmi_temporary_event_subscription.yml b/detections/experimental/endpoint/wmi_temporary_event_subscription.yml index 6ba11f0709..0e0f55805d 100644 --- a/detections/experimental/endpoint/wmi_temporary_event_subscription.yml +++ b/detections/experimental/endpoint/wmi_temporary_event_subscription.yml @@ -40,4 +40,9 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - EventCode + - Message + - query security_domain: endpoint diff --git a/detections/experimental/network/detect_arp_poisoning.yml b/detections/experimental/network/detect_arp_poisoning.yml index 0be208ae0e..e0449004d5 100644 --- a/detections/experimental/network/detect_arp_poisoning.yml +++ b/detections/experimental/network/detect_arp_poisoning.yml @@ -45,4 +45,13 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - facility + - mnemonic + - disable_cause + - src_int_prefix_long + - src_int_suffix + - host + - src_interface security_domain: network diff --git a/detections/experimental/network/detect_ipv6_network_infrastructure_threats.yml b/detections/experimental/network/detect_ipv6_network_infrastructure_threats.yml index 39240a442e..be07ec8c26 100644 --- a/detections/experimental/network/detect_ipv6_network_infrastructure_threats.yml +++ b/detections/experimental/network/detect_ipv6_network_infrastructure_threats.yml @@ -56,4 +56,16 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - facility + - mnemonic + - src_int_prefix_long + - src_int_suffix + - dest_int_prefix_long + - dest_int_suffix + - src_mac + - src_vlan + - vendor_explanation + - action security_domain: network diff --git a/detections/experimental/network/detect_large_outbound_icmp_packets.yml b/detections/experimental/network/detect_large_outbound_icmp_packets.yml index 5d1824035c..458a1d582d 100644 --- a/detections/experimental/network/detect_large_outbound_icmp_packets.yml +++ b/detections/experimental/network/detect_large_outbound_icmp_packets.yml @@ -51,4 +51,13 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - All_Traffic.action + - All_Traffic.bytes + - All_Traffic.dest_category + - All_Traffic.protocol + - All_Traffic.transport + - All_Traffic.src_ip + - All_Traffic.dest_ip security_domain: network diff --git a/detections/experimental/network/detect_outbound_smb_traffic.yml b/detections/experimental/network/detect_outbound_smb_traffic.yml index ba9a8ffd97..705a631f2d 100644 --- a/detections/experimental/network/detect_outbound_smb_traffic.yml +++ b/detections/experimental/network/detect_outbound_smb_traffic.yml @@ -56,4 +56,13 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - All_Traffic.action + - All_Traffic.app + - All_Traffic.dest_ip + - All_Traffic.dest_port + - sourcetype + - All_Traffic.dest_category + - All_Traffic.src_ip security_domain: network diff --git a/detections/experimental/network/detect_port_security_violation.yml b/detections/experimental/network/detect_port_security_violation.yml index 7d38351e33..0763318773 100644 --- a/detections/experimental/network/detect_port_security_violation.yml +++ b/detections/experimental/network/detect_port_security_violation.yml @@ -55,4 +55,16 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - facility + - mnemonic + - disable_cause + - src_int_prefix_long + - src_int_suffix + - src_mac + - src_vlan + - action + - host + - src_interface security_domain: network diff --git a/detections/experimental/network/detect_rogue_dhcp_server.yml b/detections/experimental/network/detect_rogue_dhcp_server.yml index c3acdc47d9..c11c9f1fe2 100644 --- a/detections/experimental/network/detect_rogue_dhcp_server.yml +++ b/detections/experimental/network/detect_rogue_dhcp_server.yml @@ -45,4 +45,11 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - facility + - mnemonic + - message_type + - src_mac + - host security_domain: network diff --git a/detections/experimental/network/detect_snicat_sni_exfiltration.yml b/detections/experimental/network/detect_snicat_sni_exfiltration.yml index 862cb13a89..58a0866c3a 100644 --- a/detections/experimental/network/detect_snicat_sni_exfiltration.yml +++ b/detections/experimental/network/detect_snicat_sni_exfiltration.yml @@ -39,4 +39,9 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - server_name + - src_ip + - dest_ip security_domain: network diff --git a/detections/experimental/network/detect_software_download_to_network_device.yml b/detections/experimental/network/detect_software_download_to_network_device.yml index 33db59428f..ce7d4d8706 100644 --- a/detections/experimental/network/detect_software_download_to_network_device.yml +++ b/detections/experimental/network/detect_software_download_to_network_device.yml @@ -47,4 +47,12 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - All_Traffic.transport + - All_Traffic.dest_port + - All_Traffic.dest_category + - All_Traffic.src_category + - All_Traffic.src + - All_Traffic.dest security_domain: network diff --git a/detections/experimental/network/detect_traffic_mirroring.yml b/detections/experimental/network/detect_traffic_mirroring.yml index f270c9a423..18fc745a0e 100644 --- a/detections/experimental/network/detect_traffic_mirroring.yml +++ b/detections/experimental/network/detect_traffic_mirroring.yml @@ -47,4 +47,9 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - facility + - mnemonic + - host security_domain: network diff --git a/detections/experimental/network/detect_unauthorized_assets_by_mac_address.yml b/detections/experimental/network/detect_unauthorized_assets_by_mac_address.yml index b71232d79f..c99f37bc8a 100644 --- a/detections/experimental/network/detect_unauthorized_assets_by_mac_address.yml +++ b/detections/experimental/network/detect_unauthorized_assets_by_mac_address.yml @@ -45,4 +45,9 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - All_Sessions.signature + - All_Sessions.src_ip + - All_Sessions.dest_mac security_domain: network diff --git a/detections/experimental/network/detect_windows_dns_sigred_via_splunk_stream.yml b/detections/experimental/network/detect_windows_dns_sigred_via_splunk_stream.yml index 0d9fa88013..1496580093 100644 --- a/detections/experimental/network/detect_windows_dns_sigred_via_splunk_stream.yml +++ b/detections/experimental/network/detect_windows_dns_sigred_via_splunk_stream.yml @@ -34,4 +34,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time security_domain: network diff --git a/detections/experimental/network/detect_windows_dns_sigred_via_zeek.yml b/detections/experimental/network/detect_windows_dns_sigred_via_zeek.yml index 7a7e2410f9..b7b07a6692 100644 --- a/detections/experimental/network/detect_windows_dns_sigred_via_zeek.yml +++ b/detections/experimental/network/detect_windows_dns_sigred_via_zeek.yml @@ -37,4 +37,10 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - DNS.query_type + - DNS.flow_id + - All_Traffic.bytes_in + - All_Traffic.flow_id security_domain: endpoint diff --git a/detections/experimental/network/detect_zerologon_via_zeek.yml b/detections/experimental/network/detect_zerologon_via_zeek.yml index 4a09aa0491..20e6c3a9b3 100644 --- a/detections/experimental/network/detect_zerologon_via_zeek.yml +++ b/detections/experimental/network/detect_zerologon_via_zeek.yml @@ -38,4 +38,7 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - operation security_domain: network diff --git a/detections/experimental/network/dns_query_length_outliers___mltk.yml b/detections/experimental/network/dns_query_length_outliers___mltk.yml index ec6b240ebd..11ea5beddd 100644 --- a/detections/experimental/network/dns_query_length_outliers___mltk.yml +++ b/detections/experimental/network/dns_query_length_outliers___mltk.yml @@ -68,4 +68,10 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - DNS.src + - DNS.dest + - DNS.query + - DNS.record_type security_domain: network diff --git a/detections/experimental/network/excessive_dns_failures.yml b/detections/experimental/network/excessive_dns_failures.yml index b000a4f436..ec0e5764bf 100644 --- a/detections/experimental/network/excessive_dns_failures.yml +++ b/detections/experimental/network/excessive_dns_failures.yml @@ -42,4 +42,9 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - DNS.query + - DNS.reply_code + - DNS.src security_domain: network diff --git a/detections/experimental/network/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml b/detections/experimental/network/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml index 3f274315f2..21cfde7487 100644 --- a/detections/experimental/network/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml +++ b/detections/experimental/network/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml @@ -52,4 +52,9 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - All_Traffic.bytes_in + - All_Traffic.dest_category + - All_Traffic.src_ip security_domain: network diff --git a/detections/experimental/network/large_volume_of_dns_any_queries.yml b/detections/experimental/network/large_volume_of_dns_any_queries.yml index 2cd258a8fe..eb86051009 100644 --- a/detections/experimental/network/large_volume_of_dns_any_queries.yml +++ b/detections/experimental/network/large_volume_of_dns_any_queries.yml @@ -36,4 +36,9 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - DNS.message_type + - DNS.record_type + - DNS.dest security_domain: network diff --git a/detections/experimental/network/prohibited_network_traffic_allowed.yml b/detections/experimental/network/prohibited_network_traffic_allowed.yml index cae48f8216..970f4ec790 100644 --- a/detections/experimental/network/prohibited_network_traffic_allowed.yml +++ b/detections/experimental/network/prohibited_network_traffic_allowed.yml @@ -44,4 +44,10 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - All_Traffic.action + - All_Traffic.src_ip + - All_Traffic.dest_ip + - All_Traffic.dest_port security_domain: network diff --git a/detections/experimental/network/protocol_or_port_mismatch.yml b/detections/experimental/network/protocol_or_port_mismatch.yml index 2b8ef78736..4b906ec85f 100644 --- a/detections/experimental/network/protocol_or_port_mismatch.yml +++ b/detections/experimental/network/protocol_or_port_mismatch.yml @@ -45,4 +45,10 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - All_Traffic.app + - All_Traffic.dest_port + - All_Traffic.src_ip + - All_Traffic.dest_ip security_domain: network diff --git a/detections/experimental/network/protocols_passing_authentication_in_cleartext.yml b/detections/experimental/network/protocols_passing_authentication_in_cleartext.yml index 5c54766ef7..24a747ac9e 100644 --- a/detections/experimental/network/protocols_passing_authentication_in_cleartext.yml +++ b/detections/experimental/network/protocols_passing_authentication_in_cleartext.yml @@ -40,4 +40,11 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - All_Traffic.transport + - All_Traffic.dest_port + - All_Traffic.user + - All_Traffic.src + - All_Traffic.dest security_domain: network diff --git a/detections/experimental/network/remote_desktop_network_bruteforce.yml b/detections/experimental/network/remote_desktop_network_bruteforce.yml index b202102997..7c8b3f7adb 100644 --- a/detections/experimental/network/remote_desktop_network_bruteforce.yml +++ b/detections/experimental/network/remote_desktop_network_bruteforce.yml @@ -42,4 +42,10 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - All_Traffic.app + - All_Traffic.src + - All_Traffic.dest + - All_Traffic.dest_port security_domain: network diff --git a/detections/experimental/network/remote_desktop_network_traffic.yml b/detections/experimental/network/remote_desktop_network_traffic.yml index 4114cd1ea1..cf6c5a380f 100644 --- a/detections/experimental/network/remote_desktop_network_traffic.yml +++ b/detections/experimental/network/remote_desktop_network_traffic.yml @@ -50,4 +50,12 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - All_Traffic.dest_port + - All_Traffic.dest_category + - All_Traffic.src_category + - All_Traffic.src + - All_Traffic.dest + - All_Traffic.dest_port security_domain: network diff --git a/detections/experimental/network/smb_traffic_spike.yml b/detections/experimental/network/smb_traffic_spike.yml index 313ae164cb..75d375e5e5 100644 --- a/detections/experimental/network/smb_traffic_spike.yml +++ b/detections/experimental/network/smb_traffic_spike.yml @@ -40,4 +40,9 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - All_Traffic.dest_port + - All_Traffic.app + - All_Traffic.src security_domain: network diff --git a/detections/experimental/network/smb_traffic_spike___mltk.yml b/detections/experimental/network/smb_traffic_spike___mltk.yml index 9121b5469f..fde25fac02 100644 --- a/detections/experimental/network/smb_traffic_spike___mltk.yml +++ b/detections/experimental/network/smb_traffic_spike___mltk.yml @@ -61,4 +61,10 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - All_Traffic.dest_ip + - All_Traffic.dest_port + - All_Traffic.app + - All_Traffic.src security_domain: network diff --git a/detections/experimental/network/tor_traffic.yml b/detections/experimental/network/tor_traffic.yml index 469ca3e1d0..7c3795b66d 100644 --- a/detections/experimental/network/tor_traffic.yml +++ b/detections/experimental/network/tor_traffic.yml @@ -41,4 +41,11 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - All_Traffic.app + - All_Traffic.action + - All_Traffic.src_ip + - All_Traffic.dest_ip + - All_Traffic.dest_port security_domain: network diff --git a/detections/experimental/network/unusually_long_content_type_length.yml b/detections/experimental/network/unusually_long_content_type_length.yml index a8cba96a7e..ecfa2b1182 100644 --- a/detections/experimental/network/unusually_long_content_type_length.yml +++ b/detections/experimental/network/unusually_long_content_type_length.yml @@ -39,4 +39,11 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - cs_content_type + - endtime + - src_ip + - dest_ip + - url security_domain: network diff --git a/detections/experimental/web/detect_attackers_scanning_for_vulnerable_jboss_servers.yml b/detections/experimental/web/detect_attackers_scanning_for_vulnerable_jboss_servers.yml index 3c334a6a2e..f5ac2e42ec 100644 --- a/detections/experimental/web/detect_attackers_scanning_for_vulnerable_jboss_servers.yml +++ b/detections/experimental/web/detect_attackers_scanning_for_vulnerable_jboss_servers.yml @@ -32,4 +32,10 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Web.http_method + - Web.url + - Web.src + - Web.dest security_domain: network diff --git a/detections/experimental/web/detect_f5_tmui_rct_cve_2020_5902.yml b/detections/experimental/web/detect_f5_tmui_rct_cve_2020_5902.yml index f93c6322cc..118dcf5367 100644 --- a/detections/experimental/web/detect_f5_tmui_rct_cve_2020_5902.yml +++ b/detections/experimental/web/detect_f5_tmui_rct_cve_2020_5902.yml @@ -37,4 +37,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time security_domain: network diff --git a/detections/experimental/web/detect_malicious_requests_to_exploit_jboss_servers.yml b/detections/experimental/web/detect_malicious_requests_to_exploit_jboss_servers.yml index 71bd1b6b3c..5d8fd58b5b 100644 --- a/detections/experimental/web/detect_malicious_requests_to_exploit_jboss_servers.yml +++ b/detections/experimental/web/detect_malicious_requests_to_exploit_jboss_servers.yml @@ -42,4 +42,11 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Web.http_method + - Web.url + - Web.url_length + - Web.src + - Web.dest security_domain: network diff --git a/detections/experimental/web/monitor_web_traffic_for_brand_abuse.yml b/detections/experimental/web/monitor_web_traffic_for_brand_abuse.yml index d00edff771..e97391ea34 100644 --- a/detections/experimental/web/monitor_web_traffic_for_brand_abuse.yml +++ b/detections/experimental/web/monitor_web_traffic_for_brand_abuse.yml @@ -31,4 +31,8 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Web.url + - Web.src security_domain: network diff --git a/detections/experimental/web/sql_injection_with_long_urls.yml b/detections/experimental/web/sql_injection_with_long_urls.yml index 7007b3a0a9..631bac6e6d 100644 --- a/detections/experimental/web/sql_injection_with_long_urls.yml +++ b/detections/experimental/web/sql_injection_with_long_urls.yml @@ -52,4 +52,13 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Web.dest_category + - Web.url_length + - Web.http_user_agent_length + - Web.src + - Web.dest + - Web.url + - Web.http_user_agent security_domain: network diff --git a/detections/experimental/web/supernova_webshell.yml b/detections/experimental/web/supernova_webshell.yml index 7ddfa8f635..0cb51a9f4a 100644 --- a/detections/experimental/web/supernova_webshell.yml +++ b/detections/experimental/web/supernova_webshell.yml @@ -42,4 +42,12 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Web.url + - Web.src + - Web.dest + - Web.vendor_product + - Web.user + - Web.http_user_agent security_domain: network diff --git a/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml b/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml index 324507d7ff..e86301192a 100644 --- a/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml +++ b/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml @@ -74,4 +74,9 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - DNS.answer + - DNS.query + - host security_domain: network diff --git a/detections/network/dns_query_length_with_high_standard_deviation.yml b/detections/network/dns_query_length_with_high_standard_deviation.yml index 932d7bbc4c..5748355bb6 100644 --- a/detections/network/dns_query_length_with_high_standard_deviation.yml +++ b/detections/network/dns_query_length_with_high_standard_deviation.yml @@ -42,4 +42,7 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - DNS.query security_domain: network