From 458147e1e7470c085930c48f89f8abef2c0989a8 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Tue, 27 Apr 2021 14:32:30 -0600 Subject: [PATCH 01/27] SSA TBD --- ...a___attempted_credential_dump_from_registry_via_reg_exe.yml | 2 +- detections/endpoint/ssa___detect_kerberoasting.yml | 2 +- detections/endpoint/ssa___detect_pass_hash.yml | 2 +- detections/endpoint/ssa___first_time_seen_cmd_line.yml | 2 +- .../endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml | 2 +- detections/endpoint/ssa___unusually_long_command_line.yml | 3 +-- 6 files changed, 6 insertions(+), 7 deletions(-) diff --git a/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml b/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml index 85c3594726..a260b282e9 100644 --- a/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml @@ -18,7 +18,7 @@ search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(ma OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\Security/)=true OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\System/)=true ) | eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id, - dest_user_id), body = "TBD" | into write_ssa_detected_events(); ' + dest_user_id), body=create_map(["cmd_line", cmd_line, "process_name", process_name, "dest_user_id", dest_user_id, "dest_device_id", dest_device_id]) | into write_ssa_detected_events(); ' how_to_implement: You must be ingesting windows endpoint data that tracks process activity, including parent-child relationships from your endpoints. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___detect_kerberoasting.yml b/detections/endpoint/ssa___detect_kerberoasting.yml index 1173b9c638..a987964589 100644 --- a/detections/endpoint/ssa___detect_kerberoasting.yml +++ b/detections/endpoint/ssa___detect_kerberoasting.yml @@ -14,7 +14,7 @@ search: ' | from read_ssa_enriched_events() | eval _time=map_get(input_event, "_ "service_id") | where EventCode="4769" AND TicketOptions="0x40810000" AND TicketEncryptionType="0x17" | first_time_event input_columns=["EventCode","TicketOptions","TicketEncryptionType","ServiceName","ServiceID"] | where first_time_EventCode_TicketOptions_TicketEncryptionType_ServiceName_ServiceID - | eval start_time=_time, end_time=_time, body="TBD", entities="TBD" | select start_time, + | eval start_time=_time, end_time=_time, body=create_map(["EventCode", EventCode, "ServiceName", ServiceName, "TicketOptions", TicketOptions, "TicketEncryptionType", TicketEncryptionType]), entities="TBD" | select start_time, end_time, entities, body | into write_null(); ' how_to_implement: The test data is converted from Windows Security Event logs generated from Attach Range simulation and used in SPL search and extended to SPL2 diff --git a/detections/endpoint/ssa___detect_pass_hash.yml b/detections/endpoint/ssa___detect_pass_hash.yml index c7f2a72e80..635989ef20 100644 --- a/detections/endpoint/ssa___detect_pass_hash.yml +++ b/detections/endpoint/ssa___detect_pass_hash.yml @@ -20,7 +20,7 @@ search: ' | from read_ssa_enriched_events() AND authentication_method="seclogo") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id, - dest_user_id), body="TBD" | into write_ssa_detected_events();' + dest_user_id), body=create_map(["authentication_type", authentication_type, "authentication_method", authentication_method, "dest_user_id", dest_user_id]) | into write_ssa_detected_events();' how_to_implement: The test data is converted from Windows Security Event logs generated from Attach Range simulation and used in SPL search and extended to SPL2 known_false_positives: Legitimate logon activity by authorized NTLM systems may be diff --git a/detections/endpoint/ssa___first_time_seen_cmd_line.yml b/detections/endpoint/ssa___first_time_seen_cmd_line.yml index 9c56ac054e..9ada39500c 100644 --- a/detections/endpoint/ssa___first_time_seen_cmd_line.yml +++ b/detections/endpoint/ssa___first_time_seen_cmd_line.yml @@ -22,7 +22,7 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map ""), /.* \/[cC] .*/)=true | select cmd_line, cmd_line_norm, timestamp, dest_device_id, dest_user_id | first_time_event input_columns=["cmd_line_norm"] | where first_time_cmd_line_norm | eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id, - dest_user_id), body = "TBD" | into write_ssa_detected_events();' + dest_user_id), body=create_map(["cmd_line", cmd_line, "process_name", process_name]) | into write_ssa_detected_events();' how_to_implement: You must be populating the endpoint data model for SSA and specifically the process_name and the process fields known_false_positives: Legitimate programs can also use command-line arguments to diff --git a/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml b/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml index 9dbe8df03a..9e7a01b7cd 100644 --- a/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml +++ b/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml @@ -40,7 +40,7 @@ search: ' | from read_ssa_enriched_events() | eval device=ucast(map_get(input_ev device,span(timestamp, 300s) | eval lolbas_counter=lolbas_counter*1.0 | rename window_end as timestamp | adaptive_threshold algorithm="quantile" value="lolbas_counter" entity="device" window=2419200000L | where label AND quantile>0.99 | eval start_time = window_start, - end_time = timestamp, entities = mvappend(device), body = "TBD" | into write_null();' + end_time = timestamp, entities = mvappend(device), body=create_map(["process_name", process_name]) | into write_null();' how_to_implement: Collect endpoint data such as sysmon or 4688 events. known_false_positives: 'Some administrative tasks may involve multiple use of LOLBAS applications in a short period of time. This might trigger false positives at the diff --git a/detections/endpoint/ssa___unusually_long_command_line.yml b/detections/endpoint/ssa___unusually_long_command_line.yml index ff19160691..c56080318a 100644 --- a/detections/endpoint/ssa___unusually_long_command_line.yml +++ b/detections/endpoint/ssa___unusually_long_command_line.yml @@ -21,8 +21,7 @@ search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(ma input | adaptive_threshold algorithm="quantile" entity="process_name" window=60480000 | where label AND quantile>0.99 | first_time_event input_columns=["dest_device_id", "cmd_line"] | where first_time_dest_device_id_cmd_line | eval start_time = timestamp, - end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body = - "TBD" | into write_ssa_detected_events();' + end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body=create_map(["cmd_line", cmd_line, "process_name", process_name]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting sysmon endpoint data that monitors command lines. known_false_positives: This detection may flag suspiciously long command lines when From 79dd8f833cc75453dbe45ee1015cdc4ae7b6a975 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Wed, 28 Apr 2021 10:25:26 -0600 Subject: [PATCH 02/27] all SSA TBD bodies Done --- .gitignore | 1 + .../ssa___applying_stolen_credentials_via_mimikatz_modules.yml | 2 +- ...sa___applying_stolen_credentials_via_powersploit_modules.yml | 2 +- ...ssa___assess_credential_strength_via_dsinternals_modules.yml | 2 +- ...a___credential_extraction_dsinternals_conversion_modules.yml | 2 +- .../ssa___credential_extraction_dsinternals_modules.yml | 2 +- .../ssa___credential_extraction_fgdump_cachedump_s_option.yml | 2 +- .../ssa___credential_extraction_fgdump_cachedump_v_option.yml | 2 +- .../ssa___credential_extraction_getaddbaccount_from_dump.yml | 2 +- .../ssa___credential_extraction_lazagne_command_options.yml | 2 +- .../endpoint/ssa___credential_extraction_mimikatz_modules.yml | 2 +- .../ssa___credential_extraction_ms_debuggers_kernel_peek.yml | 2 +- .../ssa___credential_extraction_ms_debuggers_z_option.yml | 2 +- .../ssa___credential_extraction_powersploit_modules.yml | 2 +- .../endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml | 2 +- ...sa___illegal_access_user_content_via_powersploit_modules.yml | 2 +- .../ssa___illegal_account_creation_via_powersploit_modules.yml | 2 +- ...__illegal_account_enable_disable_via_dsinternals_modules.yml | 2 +- .../ssa___illegal_log_deletion_via_mimikatz_modules.yml | 2 +- ...agement_AD_elements_and_policies_via_dsinternals_modules.yml | 2 +- ...gement_computers_and_AD_elements_via_powersploit_modules.yml | 2 +- ...vilege_elevation_and_persistence_via_powersploit_modules.yml | 2 +- .../ssa___illegal_privilege_elevation_via_mimikatz_modules.yml | 2 +- ...illegal_service_and_process_control_via_mimikatz_modules.yml | 2 +- ...egal_service_and_process_control_via_powersploit_modules.yml | 2 +- ...g_access_with_stolen_credentials_via_powersploit_modules.yml | 2 +- .../endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml | 2 +- ...ss_and_persistence_opportunities_via_powersploit_modules.yml | 2 +- ...and_use_accounts_groups_policies_via_powersploit_modules.yml | 2 +- ...ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml | 2 +- ..._active_directory_infrastructure_via_powersploit_modules.yml | 2 +- ..._recon_and_use_computers_domains_via_powersploit_modules.yml | 2 +- .../ssa___recon_and_use_computers_via_mimikatz_modules.yml | 2 +- ...nd_use_operating_system_elements_via_powersploit_modules.yml | 2 +- .../ssa___recon_and_use_shares_via_mimikatz_modules.yml | 2 +- .../ssa___recon_and_use_shares_via_powersploit_modules.yml | 2 +- .../ssa___recon_connectivity_via_powersploit_modules.yml | 2 +- ...econ_credential_stores_and_services_via_mimikatz_modules.yml | 2 +- .../ssa___recon_defensive_tools_via_powersploit_modules.yml | 2 +- ...ivilege_escalation_opportunities_via_powersploit_modules.yml | 2 +- ...a___recon_process_service_hijacking_via_mimikatz_modules.yml | 2 +- .../ssa___recon_processes_and_services_via_mimikatz_modules.yml | 2 +- .../ssa___setting_credentials_via_dsinternals_modules.yml | 2 +- .../endpoint/ssa___setting_credentials_via_mimikatz_modules.yml | 2 +- .../ssa___setting_credentials_via_powersploit_modules.yml | 2 +- 45 files changed, 45 insertions(+), 44 deletions(-) diff --git a/.gitignore b/.gitignore index 0e3d724591..afb92a49b6 100644 --- a/.gitignore +++ b/.gitignore @@ -114,3 +114,4 @@ venv.bak/ package/bin/sftp-config.json package/default/sftp-config.json *.code-snippets +notes diff --git a/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml b/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml index 66b7577fb2..ea20ad3dd5 100644 --- a/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml @@ -17,7 +17,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body = "TBD" | into write_ssa_detected_events();' + "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml b/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml index 038433b8e3..755e1a487b 100644 --- a/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml @@ -20,7 +20,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body = "TBD" | into write_ssa_detected_events();' + "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml b/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml index 7d7229186f..e5f020d063 100644 --- a/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml +++ b/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml @@ -15,7 +15,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body = "TBD" | into write_ssa_detected_events();' + "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml b/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml index 9909deeaad..fd0d800d12 100644 --- a/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml +++ b/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml @@ -26,7 +26,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body = "TBD" | into write_ssa_detected_events();' + "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line, "process_name", process_name]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml b/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml index eaee57b287..a54fdeb701 100644 --- a/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml +++ b/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml @@ -27,7 +27,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body = "TBD" | into write_ssa_detected_events();' + "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line, "process_name", process_name]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml index 4328219d0e..083aa5014b 100644 --- a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml +++ b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml @@ -24,7 +24,7 @@ search: ' | from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body = "TBD" | into write_ssa_detected_events();' + "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml index 253e8e758d..d1e0309836 100644 --- a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml +++ b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml @@ -22,7 +22,7 @@ search: ' | from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body = "TBD" | into write_ssa_detected_events();' + "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line, "process_name", process_name]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml b/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml index f3c4dec90b..969506902a 100644 --- a/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml +++ b/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml @@ -20,7 +20,7 @@ search: ' | from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body = "TBD" | into write_ssa_detected_events();' + "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml b/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml index 542c0b7f0a..c54b4c28de 100644 --- a/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml +++ b/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml @@ -18,7 +18,7 @@ search: ' | from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body = "TBD" | into write_ssa_detected_events();' + "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml b/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml index 93f40cbe13..e03e7b9b05 100644 --- a/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml +++ b/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml @@ -22,7 +22,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body = "TBD" | into write_ssa_detected_events();' + "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml b/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml index 8878295c8e..57aa23c9d1 100644 --- a/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml +++ b/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml @@ -23,7 +23,7 @@ search: ' | from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body = "TBD" | into write_ssa_detected_events();' + "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: Although unlikely, using debuggers this way may be indicative diff --git a/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml b/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml index edc32a0191..beaf98519c 100644 --- a/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml +++ b/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml @@ -20,7 +20,7 @@ search: ' | from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body = "TBD" | into write_ssa_detected_events();' + "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line, "process_name", process_name]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: Although unlikely, using debuggers this way may be indicative diff --git a/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml b/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml index 76749dd812..b263162b6b 100644 --- a/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml +++ b/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml @@ -23,7 +23,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body = "TBD" | into write_ssa_detected_events();' + "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml b/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml index f41ba78cff..46397d9466 100644 --- a/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml +++ b/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml @@ -14,7 +14,7 @@ search: '| from read_ssa_enriched_events() | eval tenant=ucast(map_get(input_eve null)), process=lower(ucast(map_get(input_event, "process"), "string", null)) | where process_name LIKE "%rundll32.exe%" AND match_regex(process, /(?i)comsvcs.dll[,\s]+MiniDump/)=true | eval start_time = timestamp, end_time = timestamp, entities = mvappend(machine), - body = "TBD" | into write_ssa_detected_events();' + body=create_map(["process_name", process_name]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting endpoint data that tracks process activity, including Windows command line logging. You can see how we test this with [Event Code 4688](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4688a) diff --git a/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml index a05b5568fd..cef5feb750 100644 --- a/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml @@ -20,7 +20,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body = "TBD" | into write_ssa_detected_events();' + "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml index 9760b79551..1cc4475117 100644 --- a/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml @@ -15,7 +15,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body = "TBD" | into write_ssa_detected_events();' + "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml b/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml index 576ee442e6..da35d0caa0 100644 --- a/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml +++ b/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml @@ -16,7 +16,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body = "TBD" | into write_ssa_detected_events();' + "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml b/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml index 75d48fe9a1..aa0c4990b9 100644 --- a/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml @@ -16,7 +16,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body = "TBD" | into write_ssa_detected_events();' + "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml b/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml index a7a4f1be74..65ad0fb318 100644 --- a/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml +++ b/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml @@ -18,7 +18,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body = "TBD" | into write_ssa_detected_events();' + "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml index b1d82da7b3..ce30522bd0 100644 --- a/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml @@ -19,7 +19,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body = "TBD" | into write_ssa_detected_events();' + "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml index b51519c51b..9cd2c0ad85 100644 --- a/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml @@ -19,7 +19,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body = "TBD" | into write_ssa_detected_events();' + "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml b/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml index 97933e79c6..bf310733b5 100644 --- a/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml @@ -16,7 +16,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body = "TBD" | into write_ssa_detected_events();' + "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml b/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml index 05805542f8..e253ebde9e 100644 --- a/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml @@ -19,7 +19,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body = "TBD" | into write_ssa_detected_events();' + "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml index 0b5d63a87e..97121fa7bd 100644 --- a/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml @@ -27,7 +27,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body = "TBD" | into write_ssa_detected_events();' + "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml b/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml index 6e3701bf30..e56b76e5df 100644 --- a/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml @@ -17,7 +17,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body = "TBD" | into write_ssa_detected_events();' + "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml index ca3d16a760..8ef8eae7e4 100644 --- a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml +++ b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml @@ -24,7 +24,7 @@ search: '| from read_ssa_enriched_events() OR field0="java.exe" OR field0="powershell.exe" | eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id, - dest_user_id), body="TBD" | into write_ssa_detected_events();' + dest_user_id), body=create_map(["dest_user_id", dest_user_id, "process_name", process_name, "parent_process_name", parent_process_name]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting sysmon logs. This search has been modified to process raw sysmon data from attack_range's nxlogs on DSP. known_false_positives: There are circumstances where an application may legitimately diff --git a/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml index 706c7971b5..ce1b57f704 100644 --- a/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml @@ -28,7 +28,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body = "TBD" | into write_ssa_detected_events();' + "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml index af14d1c16d..d4c5b15ece 100644 --- a/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml @@ -37,7 +37,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body = "TBD" | into write_ssa_detected_events();' + "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml index 981a9a931e..c92d7102c6 100644 --- a/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml @@ -16,7 +16,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body = "TBD" | into write_ssa_detected_events();' + "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml index 3ef8f29b0e..1fe61be41f 100644 --- a/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml @@ -27,7 +27,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body = "TBD" | into write_ssa_detected_events();' + "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml index be95d12bc7..d4a56e1cac 100644 --- a/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml @@ -20,7 +20,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body = "TBD" | into write_ssa_detected_events();' + "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml index 053846f790..8261d3ee44 100644 --- a/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml @@ -15,7 +15,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body = "TBD" | into write_ssa_detected_events();' + "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml index a47ee9c985..54f5f67c73 100644 --- a/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml @@ -22,7 +22,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body = "TBD" | into write_ssa_detected_events();' + "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml index f4ca8c5552..88b3c4a6b6 100644 --- a/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml @@ -15,7 +15,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body = "TBD" | into write_ssa_detected_events();' + "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml index bb72bccec8..80ce63f1d9 100644 --- a/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml @@ -20,7 +20,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body = "TBD" | into write_ssa_detected_events();' + "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml index 6db9741604..7eaa34bf6c 100644 --- a/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml @@ -21,7 +21,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body = "TBD" | into write_ssa_detected_events();' + "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml index 1bafd232c2..7708d6f0ca 100644 --- a/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml @@ -18,7 +18,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body = "TBD" | into write_ssa_detected_events();' + "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml index 739c7f5aee..22d5965d27 100644 --- a/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml @@ -15,7 +15,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body = "TBD" | into write_ssa_detected_events();' + "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml index 1429edbf00..ab02ecf651 100644 --- a/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml @@ -15,7 +15,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body = "TBD" | into write_ssa_detected_events();' + "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml index 1637864452..34b362ed78 100644 --- a/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml @@ -19,7 +19,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body = "TBD" | into write_ssa_detected_events();' + "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml index 9132b86a45..431a75688d 100644 --- a/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml @@ -16,7 +16,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body = "TBD" | into write_ssa_detected_events();' + "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml b/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml index f17ed1e04c..3eb1b0307d 100644 --- a/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml +++ b/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml @@ -21,7 +21,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body = "TBD" | into write_ssa_detected_events();' + "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml b/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml index 7f7a8f98e3..c93d5de57b 100644 --- a/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml @@ -16,7 +16,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body = "TBD" | into write_ssa_detected_events();' + "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml b/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml index 022bf545c2..96ea61ae06 100644 --- a/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml @@ -15,7 +15,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body = "TBD" | into write_ssa_detected_events();' + "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. From 76083b30b2d00138b4b0c3d4a74b68fb34c9cf52 Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Wed, 28 Apr 2021 13:48:15 -0400 Subject: [PATCH 03/27] Update ssa___applying_stolen_credentials_via_mimikatz_modules.yml --- .../ssa___applying_stolen_credentials_via_mimikatz_modules.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml b/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml index ea20ad3dd5..8dfda4f098 100644 --- a/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml @@ -8,7 +8,6 @@ datamodel: [] description: This detection indicates use of Mimikatz modules that facilitate Pass-the-Token attack, Golden or Silver kerberos ticket attack, and Skeleton key attack. search: '| from read_ssa_enriched_events() - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)kerberos::ptt/)=true OR match_regex(cmd_line, @@ -17,7 +16,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. From 38706ea53e99dee7687588f902560712ec8ea7c5 Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Wed, 28 Apr 2021 13:49:01 -0400 Subject: [PATCH 04/27] Update ssa___applying_stolen_credentials_via_powersploit_modules.yml --- ...sa___applying_stolen_credentials_via_powersploit_modules.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml b/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml index 755e1a487b..16e8b0e679 100644 --- a/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml @@ -20,7 +20,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. From 6e043a8e9a770a33264e3503348ed68ac493eff1 Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Wed, 28 Apr 2021 13:49:27 -0400 Subject: [PATCH 05/27] Update ssa___assess_credential_strength_via_dsinternals_modules.yml --- ...ssa___assess_credential_strength_via_dsinternals_modules.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml b/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml index e5f020d063..633ae2f609 100644 --- a/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml +++ b/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml @@ -15,7 +15,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. From f2953fe5ea1be91beaf16cfaa867da6ec9006278 Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Wed, 28 Apr 2021 13:49:49 -0400 Subject: [PATCH 06/27] Update ssa___attempted_credential_dump_from_registry_via_reg_exe.yml --- ...sa___attempted_credential_dump_from_registry_via_reg_exe.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml b/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml index a260b282e9..219f43ed40 100644 --- a/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml @@ -18,7 +18,7 @@ search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(ma OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\Security/)=true OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\System/)=true ) | eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id, - dest_user_id), body=create_map(["cmd_line", cmd_line, "process_name", process_name, "dest_user_id", dest_user_id, "dest_device_id", dest_device_id]) | into write_ssa_detected_events(); ' + dest_user_id), body=create_map(["cmd_line", cmd_line, "process_name", process_name]) | into write_ssa_detected_events(); ' how_to_implement: You must be ingesting windows endpoint data that tracks process activity, including parent-child relationships from your endpoints. known_false_positives: None identified. From 0ac46abe29aa7c12f1e8046880d32e43fbaea0b2 Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Wed, 28 Apr 2021 13:50:09 -0400 Subject: [PATCH 07/27] Update ssa___credential_extraction_dsinternals_conversion_modules.yml --- ...a___credential_extraction_dsinternals_conversion_modules.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml b/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml index fd0d800d12..adfc40eeb4 100644 --- a/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml +++ b/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml @@ -26,7 +26,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line, "process_name", process_name]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. From ff215bb9998fb566f71f7de8fde5406159d55311 Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Wed, 28 Apr 2021 13:50:29 -0400 Subject: [PATCH 08/27] Update ssa___credential_extraction_dsinternals_modules.yml --- .../ssa___credential_extraction_dsinternals_modules.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml b/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml index a54fdeb701..cc8a2a4c35 100644 --- a/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml +++ b/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml @@ -27,7 +27,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line, "process_name", process_name]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. From c9953b5c8a249cde5db253d4f366bfcf706b8362 Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Wed, 28 Apr 2021 13:50:45 -0400 Subject: [PATCH 09/27] Update ssa___credential_extraction_fgdump_cachedump_s_option.yml --- .../ssa___credential_extraction_fgdump_cachedump_s_option.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml index 083aa5014b..4b0cec8774 100644 --- a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml +++ b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml @@ -24,7 +24,7 @@ search: ' | from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. From 1298161c3a0f1f1038c8c7342330b11a300bfb11 Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Wed, 28 Apr 2021 13:51:01 -0400 Subject: [PATCH 10/27] Update ssa___credential_extraction_fgdump_cachedump_v_option.yml --- .../ssa___credential_extraction_fgdump_cachedump_v_option.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml index d1e0309836..711d8ad3ff 100644 --- a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml +++ b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml @@ -22,7 +22,7 @@ search: ' | from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line, "process_name", process_name]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. From 5309d6546da891ddc02016b41c3ad30cc23c843f Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Wed, 28 Apr 2021 13:52:05 -0400 Subject: [PATCH 11/27] Update ssa___credential_extraction_getaddbaccount_from_dump.yml --- .../ssa___credential_extraction_getaddbaccount_from_dump.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml b/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml index 969506902a..6fc58c60fa 100644 --- a/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml +++ b/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml @@ -20,7 +20,7 @@ search: ' | from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. From 485af4308db7721c3fddc0ec77dc5e81aaac2d12 Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Wed, 28 Apr 2021 13:52:55 -0400 Subject: [PATCH 12/27] Update ssa___credential_extraction_lazagne_command_options.yml --- .../ssa___credential_extraction_lazagne_command_options.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml b/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml index c54b4c28de..020080237e 100644 --- a/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml +++ b/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml @@ -18,7 +18,7 @@ search: ' | from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. From 1a0c351e6421cd574cb32787a05eb210518d7d7e Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Wed, 28 Apr 2021 13:53:09 -0400 Subject: [PATCH 13/27] Update ssa___credential_extraction_mimikatz_modules.yml --- .../endpoint/ssa___credential_extraction_mimikatz_modules.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml b/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml index e03e7b9b05..ebe6f4588f 100644 --- a/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml +++ b/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml @@ -22,7 +22,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. From 65dc6f14026c5d27eb10e8d514c82485e7d13e79 Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Wed, 28 Apr 2021 13:53:25 -0400 Subject: [PATCH 14/27] Update ssa___credential_extraction_ms_debuggers_kernel_peek.yml --- .../ssa___credential_extraction_ms_debuggers_kernel_peek.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml b/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml index 57aa23c9d1..44d626d56d 100644 --- a/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml +++ b/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml @@ -23,7 +23,7 @@ search: ' | from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: Although unlikely, using debuggers this way may be indicative From 05f4acb4c2adc00661f353b20ac5b94d69041a9a Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Wed, 28 Apr 2021 13:53:38 -0400 Subject: [PATCH 15/27] Update ssa___credential_extraction_ms_debuggers_z_option.yml --- .../ssa___credential_extraction_ms_debuggers_z_option.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml b/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml index beaf98519c..9f77a8bf42 100644 --- a/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml +++ b/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml @@ -20,7 +20,7 @@ search: ' | from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line, "process_name", process_name]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: Although unlikely, using debuggers this way may be indicative From 2877c3679eb901fe6c53fcbfc5ccff5e11609ad8 Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Wed, 28 Apr 2021 13:53:51 -0400 Subject: [PATCH 16/27] Update ssa___credential_extraction_powersploit_modules.yml --- .../ssa___credential_extraction_powersploit_modules.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml b/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml index b263162b6b..04dbeae255 100644 --- a/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml +++ b/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml @@ -23,7 +23,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. From 5eec0c731a823495dd72f15e1075fe05e2f46009 Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Wed, 28 Apr 2021 13:54:35 -0400 Subject: [PATCH 17/27] Update ssa___detect_pass_hash.yml --- detections/endpoint/ssa___detect_pass_hash.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/ssa___detect_pass_hash.yml b/detections/endpoint/ssa___detect_pass_hash.yml index 635989ef20..1bf7d6f228 100644 --- a/detections/endpoint/ssa___detect_pass_hash.yml +++ b/detections/endpoint/ssa___detect_pass_hash.yml @@ -20,7 +20,7 @@ search: ' | from read_ssa_enriched_events() AND authentication_method="seclogo") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id, - dest_user_id), body=create_map(["authentication_type", authentication_type, "authentication_method", authentication_method, "dest_user_id", dest_user_id]) | into write_ssa_detected_events();' + dest_user_id), body=create_map(["authentication_type", authentication_type, "authentication_method", authentication_method]) | into write_ssa_detected_events();' how_to_implement: The test data is converted from Windows Security Event logs generated from Attach Range simulation and used in SPL search and extended to SPL2 known_false_positives: Legitimate logon activity by authorized NTLM systems may be From acae84ab621c7786ad1e64ce250f52c43ff0b209 Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Wed, 28 Apr 2021 13:54:52 -0400 Subject: [PATCH 18/27] Update ssa___illegal_access_user_content_via_powersploit_modules.yml --- ...sa___illegal_access_user_content_via_powersploit_modules.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml index cef5feb750..d823bc0991 100644 --- a/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml @@ -20,7 +20,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. From df8c60d58fdf8941d67a45e0402ceedfa1a2d92c Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Wed, 28 Apr 2021 13:55:07 -0400 Subject: [PATCH 19/27] Update ssa___illegal_account_creation_via_powersploit_modules.yml --- .../ssa___illegal_account_creation_via_powersploit_modules.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml index 1cc4475117..212c382844 100644 --- a/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml @@ -15,7 +15,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. From d0c21456aec7a785dac96951541d75a71f89f767 Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Wed, 28 Apr 2021 13:55:40 -0400 Subject: [PATCH 20/27] Update ssa___illegal_account_enable_disable_via_dsinternals_modules.yml --- ...__illegal_account_enable_disable_via_dsinternals_modules.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml b/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml index da35d0caa0..8117269ce4 100644 --- a/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml +++ b/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml @@ -16,7 +16,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. From 39801049627bbc77aec59568d35b06efdea48378 Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Wed, 28 Apr 2021 13:55:52 -0400 Subject: [PATCH 21/27] Update ssa___illegal_log_deletion_via_mimikatz_modules.yml --- .../ssa___illegal_log_deletion_via_mimikatz_modules.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml b/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml index aa0c4990b9..9820dcb2a8 100644 --- a/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml @@ -16,7 +16,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. From 8f1e5f6a0e24d2f63924e8171cb3a915cd73a21a Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Wed, 28 Apr 2021 13:56:03 -0400 Subject: [PATCH 22/27] Update ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml --- ...agement_AD_elements_and_policies_via_dsinternals_modules.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml b/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml index 65ad0fb318..4190380254 100644 --- a/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml +++ b/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml @@ -18,7 +18,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. From 5d7c94f5084aed2ecc649aafdd73dd95c8d9e31f Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Wed, 28 Apr 2021 13:56:17 -0400 Subject: [PATCH 23/27] Update ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml --- ...gement_computers_and_AD_elements_via_powersploit_modules.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml index ce30522bd0..f078d62322 100644 --- a/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml @@ -19,7 +19,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. From 2bd7255d19c5f834ee37d00a295096a0b1698f1b Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Wed, 28 Apr 2021 13:56:30 -0400 Subject: [PATCH 24/27] Update ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml --- ...vilege_elevation_and_persistence_via_powersploit_modules.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml index 9cd2c0ad85..d085cc9296 100644 --- a/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml @@ -19,7 +19,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. From 87d7cb0f4def9ce1ead2e885d81c04e5829788f6 Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Wed, 28 Apr 2021 13:56:41 -0400 Subject: [PATCH 25/27] Update ssa___illegal_privilege_elevation_via_mimikatz_modules.yml --- .../ssa___illegal_privilege_elevation_via_mimikatz_modules.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml b/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml index bf310733b5..fccfccad9f 100644 --- a/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml @@ -16,7 +16,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. From e334484b1e27c2adc34737adf0aba0845434755d Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Wed, 28 Apr 2021 13:56:54 -0400 Subject: [PATCH 26/27] Update ssa___illegal_service_and_process_control_via_mimikatz_modules.yml --- ...illegal_service_and_process_control_via_mimikatz_modules.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml b/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml index e253ebde9e..8f5d877367 100644 --- a/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml @@ -19,7 +19,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. From a2e62c08b9ff2a399514830a4b135e05d54f9b59 Mon Sep 17 00:00:00 2001 From: divious1 Date: Wed, 28 Apr 2021 14:01:05 -0400 Subject: [PATCH 27/27] removed dest id from a body field since it is already part of the anomaly --- ...egal_service_and_process_control_via_powersploit_modules.yml | 2 +- ...g_access_with_stolen_credentials_via_powersploit_modules.yml | 2 +- .../endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml | 2 +- ...ss_and_persistence_opportunities_via_powersploit_modules.yml | 2 +- ...and_use_accounts_groups_policies_via_powersploit_modules.yml | 2 +- ...ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml | 2 +- ..._active_directory_infrastructure_via_powersploit_modules.yml | 2 +- ..._recon_and_use_computers_domains_via_powersploit_modules.yml | 2 +- .../ssa___recon_and_use_computers_via_mimikatz_modules.yml | 2 +- ...nd_use_operating_system_elements_via_powersploit_modules.yml | 2 +- .../ssa___recon_and_use_shares_via_mimikatz_modules.yml | 2 +- .../ssa___recon_and_use_shares_via_powersploit_modules.yml | 2 +- .../ssa___recon_connectivity_via_powersploit_modules.yml | 2 +- ...econ_credential_stores_and_services_via_mimikatz_modules.yml | 2 +- .../ssa___recon_defensive_tools_via_powersploit_modules.yml | 2 +- ...ivilege_escalation_opportunities_via_powersploit_modules.yml | 2 +- ...a___recon_process_service_hijacking_via_mimikatz_modules.yml | 2 +- .../ssa___recon_processes_and_services_via_mimikatz_modules.yml | 2 +- .../ssa___setting_credentials_via_dsinternals_modules.yml | 2 +- .../endpoint/ssa___setting_credentials_via_mimikatz_modules.yml | 2 +- .../ssa___setting_credentials_via_powersploit_modules.yml | 2 +- 21 files changed, 21 insertions(+), 21 deletions(-) diff --git a/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml index 97121fa7bd..8883cfe1e2 100644 --- a/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml @@ -27,7 +27,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml b/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml index e56b76e5df..4f796555b4 100644 --- a/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml @@ -17,7 +17,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml index 8ef8eae7e4..32f5f83902 100644 --- a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml +++ b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml @@ -24,7 +24,7 @@ search: '| from read_ssa_enriched_events() OR field0="java.exe" OR field0="powershell.exe" | eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id, - dest_user_id), body=create_map(["dest_user_id", dest_user_id, "process_name", process_name, "parent_process_name", parent_process_name]) | into write_ssa_detected_events();' + dest_user_id), body=create_map([ "process_name", process_name, "parent_process_name", parent_process_name]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting sysmon logs. This search has been modified to process raw sysmon data from attack_range's nxlogs on DSP. known_false_positives: There are circumstances where an application may legitimately diff --git a/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml index ce1b57f704..b1653762d6 100644 --- a/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml @@ -28,7 +28,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml index d4c5b15ece..7f8cf6e654 100644 --- a/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml @@ -37,7 +37,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml index c92d7102c6..be4717def3 100644 --- a/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml @@ -16,7 +16,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml index 1fe61be41f..a7e80199eb 100644 --- a/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml @@ -27,7 +27,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml index d4a56e1cac..6e3077f5bd 100644 --- a/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml @@ -20,7 +20,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml index 8261d3ee44..f65abc61c0 100644 --- a/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml @@ -15,7 +15,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml index 54f5f67c73..02d762f620 100644 --- a/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml @@ -22,7 +22,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml index 88b3c4a6b6..a3f1c2d85b 100644 --- a/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml @@ -15,7 +15,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml index 80ce63f1d9..64a86372ba 100644 --- a/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml @@ -20,7 +20,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml index 7eaa34bf6c..647dcf4512 100644 --- a/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml @@ -21,7 +21,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml index 7708d6f0ca..5cfdef007f 100644 --- a/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml @@ -18,7 +18,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml index 22d5965d27..32ef4abbeb 100644 --- a/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml @@ -15,7 +15,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml index ab02ecf651..f8f29c6fdf 100644 --- a/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml @@ -15,7 +15,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml index 34b362ed78..034d96eae1 100644 --- a/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml @@ -19,7 +19,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml index 431a75688d..1f7bf96dc5 100644 --- a/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml @@ -16,7 +16,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml b/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml index 3eb1b0307d..20ee3eb47d 100644 --- a/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml +++ b/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml @@ -21,7 +21,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml b/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml index c93d5de57b..7847644266 100644 --- a/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml @@ -16,7 +16,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml b/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml index 96ea61ae06..7099d84b62 100644 --- a/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml @@ -15,7 +15,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified.