From daecf458bce50d2ecc2912df218d9873a5b8ad5f Mon Sep 17 00:00:00 2001 From: akhunti Date: Sat, 5 Mar 2022 15:09:28 +0550 Subject: [PATCH] Updated detection files with recommended TA list. --- .../endpoint/attacker_tools_on_endpoint.yml | 1 + .../endpoint/chcp_command_execution.yml | 2 + ...ate_local_admin_accounts_using_net_exe.yml | 1 + .../detect_azurehound_file_modifications.yml | 2 + ...cessive_account_lockouts_from_endpoint.yml | 2 + ...detect_excessive_user_account_lockouts.yml | 2 + ...system_network_configuration_discovery.yml | 1 + .../detect_sharphound_file_modifications.yml | 2 + .../endpoint/disable_show_hidden_files.yml | 2 + ...disable_windows_smartscreen_protection.yml | 2 + .../dns_exfiltration_using_nslookup_app.yml | 1 + .../excel_spawning_windows_script_host.yml | 2 + ...ution_of_file_with_multiple_extensions.yml | 1 + .../endpoint/file_with_samsam_extension.yml | 1 + ..._files_and_directories_with_attrib_exe.yml | 1 + .../malicious_inprocserver32_modification.yml | 2 + ...z_passtheticket_commandline_parameters.yml | 2 + ...nitor_registry_keys_for_print_monitors.yml | 2 + .../office_application_drop_executable.yml | 2 + .../office_product_writing_cab_or_inf.yml | 2 + .../overwriting_accessibility_binaries.yml | 1 + ...istry_keys_for_creating_shim_databases.yml | 2 + ...try_keys_used_for_privilege_escalation.yml | 2 + ...cos_rat_file_creation_in_remcos_folder.yml | 2 + .../rubeus_command_line_parameters.yml | 2 + .../rundll_loading_dll_by_ordinal.yml | 2 + .../endpoint/samsam_test_file_write.yml | 1 + .../endpoint/shim_database_file_creation.yml | 2 + .../single_letter_process_on_endpoint.yml | 1 + ...cious_image_creation_in_appdata_folder.yml | 2 + .../suspicious_wav_file_in_appdata_folder.yml | 2 + ...spicious_writes_to_windows_recycle_bin.yml | 3 + .../windows_disable_memory_crash_dump.yml | 2 + .../windows_diskshadow_proxy_execution.yml | 2 + ...w_compress_color_and_info_tip_registry.yml | 2 + ...ows_process_with_namedpipe_commandline.yml | 2 + .../windows_rasautou_dll_execution.yml | 2 + ...ows_remote_assistance_spawning_process.yml | 2 + .../windows_schtasks_create_run_as_system.yml | 2 + ..._service_creation_using_registry_entry.yml | 2 + .../winword_spawning_windows_script_host.yml | 2 + .../detection_ta_mapping.csv | 286 +++++----- .../detection_ta_mapping.yml | 515 ++++++++++++++---- 43 files changed, 643 insertions(+), 231 deletions(-) diff --git a/detections/endpoint/attacker_tools_on_endpoint.yml b/detections/endpoint/attacker_tools_on_endpoint.yml index 87aef90198..dc931e0af9 100644 --- a/detections/endpoint/attacker_tools_on_endpoint.yml +++ b/detections/endpoint/attacker_tools_on_endpoint.yml @@ -87,5 +87,6 @@ tags: security_domain: endpoint supported_tas: - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows type: TTP version: 2 diff --git a/detections/endpoint/chcp_command_execution.yml b/detections/endpoint/chcp_command_execution.yml index 1099b06df8..79462eb101 100644 --- a/detections/endpoint/chcp_command_execution.yml +++ b/detections/endpoint/chcp_command_execution.yml @@ -72,5 +72,7 @@ tags: - user risk_score: 9 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon type: TTP version: 1 diff --git a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml index c22397cca3..a30211024b 100644 --- a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml +++ b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml @@ -80,5 +80,6 @@ tags: security_domain: endpoint supported_tas: - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows type: TTP version: 6 diff --git a/detections/endpoint/detect_azurehound_file_modifications.yml b/detections/endpoint/detect_azurehound_file_modifications.yml index 4c430c03d7..42cda4f404 100644 --- a/detections/endpoint/detect_azurehound_file_modifications.yml +++ b/detections/endpoint/detect_azurehound_file_modifications.yml @@ -80,5 +80,7 @@ tags: - process_id risk_score: 63 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon type: TTP version: 1 diff --git a/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml b/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml index 5071265f8d..378dcc1002 100644 --- a/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml +++ b/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml @@ -72,5 +72,7 @@ tags: - nodename risk_score: 36 security_domain: access + supported_tas: + - Splunk_TA_windows type: Anomaly version: 5 diff --git a/detections/endpoint/detect_excessive_user_account_lockouts.yml b/detections/endpoint/detect_excessive_user_account_lockouts.yml index c052c19b7c..31b57cb5a5 100644 --- a/detections/endpoint/detect_excessive_user_account_lockouts.yml +++ b/detections/endpoint/detect_excessive_user_account_lockouts.yml @@ -60,5 +60,7 @@ tags: - nodename risk_score: 36 security_domain: access + supported_tas: + - Splunk_TA_windows type: Anomaly version: 3 diff --git a/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml b/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml index de7a19d4c8..5fe22e42de 100644 --- a/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml +++ b/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml @@ -82,5 +82,6 @@ tags: security_domain: endpoint supported_tas: - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows type: TTP version: 2 diff --git a/detections/endpoint/detect_sharphound_file_modifications.yml b/detections/endpoint/detect_sharphound_file_modifications.yml index d2d0a9a3bd..90ac4ee56f 100644 --- a/detections/endpoint/detect_sharphound_file_modifications.yml +++ b/detections/endpoint/detect_sharphound_file_modifications.yml @@ -86,5 +86,7 @@ tags: - process_id risk_score: 24 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon type: TTP version: 1 diff --git a/detections/endpoint/disable_show_hidden_files.yml b/detections/endpoint/disable_show_hidden_files.yml index b1497a5370..683adf20cd 100644 --- a/detections/endpoint/disable_show_hidden_files.yml +++ b/detections/endpoint/disable_show_hidden_files.yml @@ -78,5 +78,7 @@ tags: - _time risk_score: 40 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon type: TTP version: 2 diff --git a/detections/endpoint/disable_windows_smartscreen_protection.yml b/detections/endpoint/disable_windows_smartscreen_protection.yml index 61e01cf678..607c01f550 100644 --- a/detections/endpoint/disable_windows_smartscreen_protection.yml +++ b/detections/endpoint/disable_windows_smartscreen_protection.yml @@ -78,5 +78,7 @@ tags: - _time risk_score: 25 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon type: TTP version: 2 diff --git a/detections/endpoint/dns_exfiltration_using_nslookup_app.yml b/detections/endpoint/dns_exfiltration_using_nslookup_app.yml index b475af0b30..9954bad4c1 100644 --- a/detections/endpoint/dns_exfiltration_using_nslookup_app.yml +++ b/detections/endpoint/dns_exfiltration_using_nslookup_app.yml @@ -80,5 +80,6 @@ tags: security_domain: endpoint supported_tas: - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows type: TTP version: 1 diff --git a/detections/endpoint/excel_spawning_windows_script_host.yml b/detections/endpoint/excel_spawning_windows_script_host.yml index 8527405d64..412d09cb49 100644 --- a/detections/endpoint/excel_spawning_windows_script_host.yml +++ b/detections/endpoint/excel_spawning_windows_script_host.yml @@ -82,5 +82,7 @@ tags: - user risk_score: 80 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon type: TTP version: 1 diff --git a/detections/endpoint/execution_of_file_with_multiple_extensions.yml b/detections/endpoint/execution_of_file_with_multiple_extensions.yml index 52f04d085b..be2df331f7 100644 --- a/detections/endpoint/execution_of_file_with_multiple_extensions.yml +++ b/detections/endpoint/execution_of_file_with_multiple_extensions.yml @@ -74,5 +74,6 @@ tags: security_domain: endpoint supported_tas: - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows type: TTP version: 3 diff --git a/detections/endpoint/file_with_samsam_extension.yml b/detections/endpoint/file_with_samsam_extension.yml index fd590bd51d..87cac9588b 100644 --- a/detections/endpoint/file_with_samsam_extension.yml +++ b/detections/endpoint/file_with_samsam_extension.yml @@ -69,5 +69,6 @@ tags: security_domain: endpoint supported_tas: - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows type: TTP version: 1 diff --git a/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml b/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml index 9054f5cea9..5f161272d6 100644 --- a/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml +++ b/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml @@ -74,5 +74,6 @@ tags: security_domain: endpoint supported_tas: - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows type: TTP version: 4 diff --git a/detections/endpoint/malicious_inprocserver32_modification.yml b/detections/endpoint/malicious_inprocserver32_modification.yml index 2ab8e87400..6d4810bbef 100644 --- a/detections/endpoint/malicious_inprocserver32_modification.yml +++ b/detections/endpoint/malicious_inprocserver32_modification.yml @@ -94,5 +94,7 @@ tags: - user risk_score: 80 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon type: TTP version: 1 diff --git a/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml b/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml index ec00b812e2..bbec369545 100644 --- a/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml +++ b/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml @@ -71,5 +71,7 @@ tags: - _time risk_score: 36 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon type: TTP version: 1 diff --git a/detections/endpoint/monitor_registry_keys_for_print_monitors.yml b/detections/endpoint/monitor_registry_keys_for_print_monitors.yml index ea5c641a70..de6bc84e1b 100644 --- a/detections/endpoint/monitor_registry_keys_for_print_monitors.yml +++ b/detections/endpoint/monitor_registry_keys_for_print_monitors.yml @@ -90,5 +90,7 @@ tags: - _time risk_score: 64 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon type: TTP version: 3 diff --git a/detections/endpoint/office_application_drop_executable.yml b/detections/endpoint/office_application_drop_executable.yml index efed529643..2a0ac3104e 100644 --- a/detections/endpoint/office_application_drop_executable.yml +++ b/detections/endpoint/office_application_drop_executable.yml @@ -77,5 +77,7 @@ tags: - dest risk_score: 64 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon type: TTP version: 1 diff --git a/detections/endpoint/office_product_writing_cab_or_inf.yml b/detections/endpoint/office_product_writing_cab_or_inf.yml index 75273d0d79..45443175fd 100644 --- a/detections/endpoint/office_product_writing_cab_or_inf.yml +++ b/detections/endpoint/office_product_writing_cab_or_inf.yml @@ -83,5 +83,7 @@ tags: - process_name risk_score: 80 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon type: TTP version: 1 diff --git a/detections/endpoint/overwriting_accessibility_binaries.yml b/detections/endpoint/overwriting_accessibility_binaries.yml index 560381f17c..a1b179585a 100644 --- a/detections/endpoint/overwriting_accessibility_binaries.yml +++ b/detections/endpoint/overwriting_accessibility_binaries.yml @@ -69,5 +69,6 @@ tags: security_domain: endpoint supported_tas: - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows type: TTP version: 4 diff --git a/detections/endpoint/registry_keys_for_creating_shim_databases.yml b/detections/endpoint/registry_keys_for_creating_shim_databases.yml index 4b98c0e2a4..2414df46ce 100644 --- a/detections/endpoint/registry_keys_for_creating_shim_databases.yml +++ b/detections/endpoint/registry_keys_for_creating_shim_databases.yml @@ -83,5 +83,7 @@ tags: - _time risk_score: 56 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon type: TTP version: 4 diff --git a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml index 7ee07740f2..dc3dc4a055 100644 --- a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml +++ b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml @@ -91,5 +91,7 @@ tags: - _time risk_score: 76 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon type: TTP version: 5 diff --git a/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml b/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml index a4a717ab39..29ea1535db 100644 --- a/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml +++ b/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml @@ -58,5 +58,7 @@ tags: - file_path risk_score: 100 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon type: TTP version: 1 diff --git a/detections/endpoint/rubeus_command_line_parameters.yml b/detections/endpoint/rubeus_command_line_parameters.yml index 16ef1d3335..8c6e27f006 100644 --- a/detections/endpoint/rubeus_command_line_parameters.yml +++ b/detections/endpoint/rubeus_command_line_parameters.yml @@ -82,5 +82,7 @@ tags: - _time risk_score: 36 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon type: TTP version: 1 diff --git a/detections/endpoint/rundll_loading_dll_by_ordinal.yml b/detections/endpoint/rundll_loading_dll_by_ordinal.yml index 35a5feaea3..7c46209468 100644 --- a/detections/endpoint/rundll_loading_dll_by_ordinal.yml +++ b/detections/endpoint/rundll_loading_dll_by_ordinal.yml @@ -77,5 +77,7 @@ tags: - _time risk_score: 49 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon type: TTP version: 6 diff --git a/detections/endpoint/samsam_test_file_write.yml b/detections/endpoint/samsam_test_file_write.yml index 5ec5c40c17..41a201f1c0 100644 --- a/detections/endpoint/samsam_test_file_write.yml +++ b/detections/endpoint/samsam_test_file_write.yml @@ -62,5 +62,6 @@ tags: security_domain: endpoint supported_tas: - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows type: TTP version: 1 diff --git a/detections/endpoint/shim_database_file_creation.yml b/detections/endpoint/shim_database_file_creation.yml index 1a2dc98ee4..188a9b7fe5 100644 --- a/detections/endpoint/shim_database_file_creation.yml +++ b/detections/endpoint/shim_database_file_creation.yml @@ -67,5 +67,7 @@ tags: - _time risk_score: 56 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon type: TTP version: 3 diff --git a/detections/endpoint/single_letter_process_on_endpoint.yml b/detections/endpoint/single_letter_process_on_endpoint.yml index 2798bda888..c2efa0df9f 100644 --- a/detections/endpoint/single_letter_process_on_endpoint.yml +++ b/detections/endpoint/single_letter_process_on_endpoint.yml @@ -66,5 +66,6 @@ tags: security_domain: endpoint supported_tas: - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows type: TTP version: 3 diff --git a/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml b/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml index d632a4ebfd..6846cb19d9 100644 --- a/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml +++ b/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml @@ -78,5 +78,7 @@ tags: - process_path risk_score: 49 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon type: TTP version: 1 diff --git a/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml b/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml index 6b1cdcfbcf..aa9a5d4efc 100644 --- a/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml +++ b/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml @@ -77,5 +77,7 @@ tags: - process_path risk_score: 49 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon type: TTP version: 1 diff --git a/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml b/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml index a197e492f4..7d14d12366 100644 --- a/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml +++ b/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml @@ -68,5 +68,8 @@ tags: - _time risk_score: 28 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows type: TTP version: 4 diff --git a/detections/endpoint/windows_disable_memory_crash_dump.yml b/detections/endpoint/windows_disable_memory_crash_dump.yml index 887be771cb..da4be331d5 100644 --- a/detections/endpoint/windows_disable_memory_crash_dump.yml +++ b/detections/endpoint/windows_disable_memory_crash_dump.yml @@ -96,5 +96,7 @@ tags: - _time risk_score: 90 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon type: TTP version: 1 diff --git a/detections/endpoint/windows_diskshadow_proxy_execution.yml b/detections/endpoint/windows_diskshadow_proxy_execution.yml index 0923671d7a..28cae55ccc 100644 --- a/detections/endpoint/windows_diskshadow_proxy_execution.yml +++ b/detections/endpoint/windows_diskshadow_proxy_execution.yml @@ -65,5 +65,7 @@ tags: - _time risk_score: 49 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon type: TTP version: 1 diff --git a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml index 8210f23ebb..97f3ccd01a 100644 --- a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml +++ b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml @@ -79,5 +79,7 @@ tags: - _time risk_score: 25 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon type: TTP version: 1 diff --git a/detections/endpoint/windows_process_with_namedpipe_commandline.yml b/detections/endpoint/windows_process_with_namedpipe_commandline.yml index 6c18977b5d..5422b91b4f 100644 --- a/detections/endpoint/windows_process_with_namedpipe_commandline.yml +++ b/detections/endpoint/windows_process_with_namedpipe_commandline.yml @@ -73,5 +73,7 @@ tags: - _time risk_score: 49 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon type: Anomaly version: 1 diff --git a/detections/endpoint/windows_rasautou_dll_execution.yml b/detections/endpoint/windows_rasautou_dll_execution.yml index 5823fb68e6..7981ae303d 100644 --- a/detections/endpoint/windows_rasautou_dll_execution.yml +++ b/detections/endpoint/windows_rasautou_dll_execution.yml @@ -73,5 +73,7 @@ tags: - _time risk_score: 80 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon type: TTP version: 1 diff --git a/detections/endpoint/windows_remote_assistance_spawning_process.yml b/detections/endpoint/windows_remote_assistance_spawning_process.yml index e4d3ea0d90..6fd6bfb8ac 100644 --- a/detections/endpoint/windows_remote_assistance_spawning_process.yml +++ b/detections/endpoint/windows_remote_assistance_spawning_process.yml @@ -70,5 +70,7 @@ tags: - _time risk_score: 80 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon type: TTP version: 1 diff --git a/detections/endpoint/windows_schtasks_create_run_as_system.yml b/detections/endpoint/windows_schtasks_create_run_as_system.yml index ef5f0a04d0..7b79fe0648 100644 --- a/detections/endpoint/windows_schtasks_create_run_as_system.yml +++ b/detections/endpoint/windows_schtasks_create_run_as_system.yml @@ -67,5 +67,7 @@ tags: - _time risk_score: 48 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon type: TTP version: 1 diff --git a/detections/endpoint/windows_service_creation_using_registry_entry.yml b/detections/endpoint/windows_service_creation_using_registry_entry.yml index 394613a63c..c85cbc7920 100644 --- a/detections/endpoint/windows_service_creation_using_registry_entry.yml +++ b/detections/endpoint/windows_service_creation_using_registry_entry.yml @@ -83,5 +83,7 @@ tags: - _time risk_score: 64 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon type: TTP version: 1 diff --git a/detections/endpoint/winword_spawning_windows_script_host.yml b/detections/endpoint/winword_spawning_windows_script_host.yml index 360c9b974c..a378fa785b 100644 --- a/detections/endpoint/winword_spawning_windows_script_host.yml +++ b/detections/endpoint/winword_spawning_windows_script_host.yml @@ -79,5 +79,7 @@ tags: - user risk_score: 70 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon type: TTP version: 1 diff --git a/security_content_automation/detection_ta_mapping.csv b/security_content_automation/detection_ta_mapping.csv index 4ce0deb0aa..62e36aad89 100644 --- a/security_content_automation/detection_ta_mapping.csv +++ b/security_content_automation/detection_ta_mapping.csv @@ -3,160 +3,177 @@ abnormally_high_number_of_cloud_security_group_api_calls,5.0.0,Splunk_TA_aws-kin cloud_api_calls_from_previously_unseen_user_roles,5.0.0,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, splunk_ta_o365, Splunk_TA_box, Splunk_TA_infoblox, Splunk_TA_salesforce" cloud_compute_instance_created_in_previously_unused_region,5.0.0,Splunk_TA_aws-kinesis-firehose,Splunk_TA_aws-kinesis-firehose cloud_provisioning_from_previously_unseen_country,5.0.0,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_citrix-netscaler, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_cisco-asa, Splunk_TA_infoblox, Splunk_TA_salesforce" -cloud_compute_instance_created_with_previously_unseen_instance_type,5.0.0,Splunk_TA_aws-kinesis-firehose,Splunk_TA_aws-kinesis-firehose +cloud_compute_instance_created_with_previously_unseen_instance_type,5.0.0,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_microsoft-cloudservices, Splunk_TA_citrix-netscaler, Splunk_TA_nix, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_ossec, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_CrowdStrike_FDR, Splunk_TA_cisco-asa, Splunk_TA_salesforce" cloud_compute_instance_created_by_previously_unseen_user,5.0.0,Splunk_TA_aws-kinesis-firehose,Splunk_TA_aws-kinesis-firehose cloud_provisioning_from_previously_unseen_region,5.0.0,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_citrix-netscaler, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_cisco-asa, Splunk_TA_infoblox, Splunk_TA_salesforce" abnormally_high_number_of_cloud_infrastructure_api_calls,5.0.0,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_citrix-netscaler, Splunk_TA_nix, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_ossec, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_cisco-asa, Splunk_TA_infoblox, Splunk_TA_salesforce" -cloud_compute_instance_created_with_previously_unseen_image,5.0.0,Splunk_TA_aws-kinesis-firehose,Splunk_TA_aws-kinesis-firehose +cloud_compute_instance_created_with_previously_unseen_image,5.0.0,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_microsoft-cloudservices, Splunk_TA_citrix-netscaler, Splunk_TA_nix, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_ossec, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_CrowdStrike_FDR, Splunk_TA_cisco-asa, Splunk_TA_salesforce" cloud_provisioning_from_previously_unseen_city,5.0.0,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_citrix-netscaler, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_cisco-asa, Splunk_TA_infoblox, Splunk_TA_salesforce" cloud_provisioning_from_previously_unseen_ip_address,5.0.0,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_citrix-netscaler, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_salesforce" cloud_instance_modified_with_previously_unseen_user,5.0.0,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_citrix-netscaler, Splunk_TA_nix, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_ossec, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_salesforce" -linux_setuid_using_chmod_utility,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +linux_setuid_using_chmod_utility,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" disabling_folderoptions_windows_feature,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" anomalous_usage_of_7zip,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +remcos_rat_file_creation_in_remcos_folder,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_ossec, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_cyberark, Splunk_TA_CrowdStrike_FDR" enable_rdp_in_other_port_number,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" excessive_number_of_taskhost_processes,5.0.0,Splunk_TA_windows,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" xsl_script_execution_with_wmic,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" rundll32_control_rundll_world_writable_directory,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -disable_schedule_task,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +disable_schedule_task,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +detect_excessive_account_lockouts_from_endpoint,5.0.0,Splunk_TA_windows,"Splunk_TA_microsoft-cloudservices, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_symantec-ep, Splunk_TA_sophos, Splunk_TA_cyberark, Splunk_TA_windows, Splunk_TA_box, Splunk_TA_CrowdStrike_FDR, Splunk_TA_cisco-asa, Splunk_TA_salesforce" serviceprincipalnames_discovery_with_setspn,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon allow_operation_with_consent_admin,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" windows_service_initiation_on_remote_endpoint,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -spoolsv_writing_a_dll,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -dsquery_domain_discovery,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +spoolsv_writing_a_dll,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_ossec, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_cyberark, Splunk_TA_CrowdStrike_FDR" +dsquery_domain_discovery,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +detect_azurehound_file_modifications,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" linux_possible_access_or_modification_of_sshd_config_file,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +windows_file_without_extension_in_critical_folder,5.0.0,,Splunk_TA_bit9-carbonblack secretdumps_offline_ntds_dumping_tool,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -attacker_tools_on_endpoint,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +attacker_tools_on_endpoint,5.0.0,"Splunk_TA_microsoft_sysmon, Splunk_TA_windows","Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" domain_account_discovery_with_net_app,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -certutil_exe_certificate_extraction,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +certutil_exe_certificate_extraction,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" detect_html_help_url_in_command_line,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon prevent_automatic_repair_mode_using_bcdedit,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" linux_possible_access_to_sudoers_file,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" get_domainpolicy_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -excessive_number_of_distinct_processes_created_in_windows_temp_folder,5.0.0,Splunk_TA_windows,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR, Splunk_TA_cyberark_epm" +excessive_number_of_distinct_processes_created_in_windows_temp_folder,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR, Splunk_TA_cyberark_epm" disable_registry_tool,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" powershell_disable_security_monitoring,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -svchost_exe_lolbas_execution_process_spawn,5.0.0,,Splunk_TA_microsoft_sysmon -disable_defender_spynet_reporting,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +svchost_exe_lolbas_execution_process_spawn,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +disable_defender_spynet_reporting,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +windows_rasautou_dll_execution,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon certutil_download_with_verifyctl_and_split_arguments,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon windows_nirsoft_advancedrun,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +disable_show_hidden_files,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" cmd_echo_pipe___escalation,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon excessive_number_of_service_control_start_as_disabled,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" windows_installutil_url_in_command_line,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +windows_disable_memory_crash_dump,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" detect_use_of_cmd_exe_to_launch_script_interpreters,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -suspicious_icedid_rundll32_cmdline,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +suspicious_icedid_rundll32_cmdline,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" excessive_service_stop_attempt,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -suspicious_copy_on_system32,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +suspicious_copy_on_system32,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" credential_dumping_via_symlink_to_shadow_copy,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -suspicious_searchprotocolhost_no_command_line_arguments,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +suspicious_searchprotocolhost_no_command_line_arguments,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" excessive_usage_of_net_app,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon permission_modification_using_takeown_app,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -linux_at_application_execution,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +linux_at_application_execution,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" reg_exe_manipulating_windows_services_registry_keys,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -logon_script_event_trigger_execution,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +logon_script_event_trigger_execution,5.0.0,,Splunk_TA_bit9-carbonblack linux_possible_ssh_key_file_creation,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -dump_lsass_via_procdump,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -getwmiobject_ds_computer_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +dump_lsass_via_procdump,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_cyberark_epm" +getwmiobject_ds_computer_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" sdclt_uac_bypass,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" hide_user_account_from_sign_in_screen,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" deleting_of_net_users,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon revil_registry_entry,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -detect_psexec_with_accepteula_flag,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -remote_process_instantiation_via_dcom_and_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +detect_psexec_with_accepteula_flag,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +remote_process_instantiation_via_dcom_and_powershell,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" auto_admin_logon_registry_entry,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -linux_doas_tool_execution,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +linux_doas_tool_execution,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" modify_acl_permission_to_files_or_folder,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -getdomaingroup_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +getdomaingroup_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" disable_amsi_through_registry,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" wermgr_process_spawned_cmd_or_powershell_process,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -detect_azurehound_command_line_arguments,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -office_product_spawning_rundll32_with_no_dll,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -detect_exchange_web_shell,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +detect_azurehound_command_line_arguments,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +office_product_spawning_rundll32_with_no_dll,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +detect_exchange_web_shell,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_ossec, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_cyberark, Splunk_TA_CrowdStrike_FDR" time_provider_persistence_registry,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -system_processes_run_from_unexpected_locations,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +system_processes_run_from_unexpected_locations,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" scheduled_task_initiation_on_remote_endpoint,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +registry_keys_used_for_privilege_escalation,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" sc_exe_manipulating_windows_services,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -disable_defender_submit_samples_consent_feature,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +disable_defender_submit_samples_consent_feature,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" ryuk_wake_on_lan_command,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +windows_remote_assistance_spawning_process,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon suspicious_msbuild_spawn,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon linux_possible_access_to_credential_files,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" suspicious_wevtutil_usage,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -excessive_usage_of_cacls_app,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +excessive_usage_of_cacls_app,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +office_product_writing_cab_or_inf,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_ossec, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_cyberark, Splunk_TA_CrowdStrike_FDR" disabling_task_manager,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" office_document_spawned_child_process_to_download,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -processes_launching_netsh,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -linux_possible_append_command_to_at_allow_config_file,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -single_letter_process_on_endpoint,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR, Splunk_TA_cyberark_epm" +processes_launching_netsh,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_possible_append_command_to_at_allow_config_file,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +single_letter_process_on_endpoint,5.0.0,"Splunk_TA_microsoft_sysmon, Splunk_TA_windows","Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR, Splunk_TA_cyberark_epm" +suspicious_image_creation_in_appdata_folder,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_ossec, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_cyberark, Splunk_TA_CrowdStrike_FDR" check_elevated_cmd_using_whoami,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -short_lived_windows_accounts,5.0.0,,"Splunk_TA_microsoft-cloudservices, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_cyberark" -possible_lateral_movement_powershell_spawn,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -schtasks_scheduling_job_on_remote_system,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -executables_or_script_creation_in_suspicious_path,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +possible_lateral_movement_powershell_spawn,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +schtasks_scheduling_job_on_remote_system,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +executables_or_script_creation_in_suspicious_path,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_CrowdStrike_FDR" active_setup_registry_autostart,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -suspicious_rundll32_with_no_command_line_arguments,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +suspicious_rundll32_with_no_command_line_arguments,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" winword_spawning_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon suspicious_regsvr32_register_suspicious_path,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -linux_install_kernel_module_using_modprobe_utility,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +linux_install_kernel_module_using_modprobe_utility,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" scheduled_task_creation_on_remote_endpoint_using_at,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -linux_possible_append_command_to_profile_config_file,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +linux_possible_append_command_to_profile_config_file,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" nishang_powershelltcponeline,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon detect_mshta_url_in_command_line,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon linux_sudoers_tmp_file_creation,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -linux_service_restarted,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -disabling_defender_services,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -getwmiobject_ds_group_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +suspicious_linux_discovery_commands,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +linux_service_restarted,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +disabling_defender_services,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +getwmiobject_ds_group_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" firewall_allowed_program_enable,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" office_application_spawn_regsvr32_process,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon detect_rundll32_inline_hta_execution,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -suspicious_gpupdate_no_command_line_arguments,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -extraction_of_registry_hives,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +suspicious_gpupdate_no_command_line_arguments,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +extraction_of_registry_hives,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" powershell_start_bitstransfer,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon suspicious_mshta_spawn,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon detect_rundll32_application_control_bypass___setupapi,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -recursive_delete_of_directory_in_batch_cmd,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +recursive_delete_of_directory_in_batch_cmd,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" get_aduserresultantpasswordpolicy_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" windows_dotnet_binary_in_non_standard_path,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -net_profiler_uac_bypass,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +net_profiler_uac_bypass,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon disable_etw_through_registry,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" remote_process_instantiation_via_winrm_and_winrs,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +registry_keys_for_creating_shim_databases,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" office_product_spawning_wmic,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -execution_of_file_with_multiple_extensions,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" -remote_process_instantiation_via_winrm_and_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +execution_of_file_with_multiple_extensions,5.0.0,"Splunk_TA_microsoft_sysmon, Splunk_TA_windows","Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +remote_process_instantiation_via_winrm_and_powershell,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" suspicious_process_file_path,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" any_powershell_downloadstring,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -linux_change_file_owner_to_root,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -process_creating_lnk_file_in_suspicious_location,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +linux_change_file_owner_to_root,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +disable_windows_smartscreen_protection,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +process_creating_lnk_file_in_suspicious_location,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" wbadmin_delete_system_backups,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -linux_pkexec_privilege_escalation,5.0.0,,Splunk_TA_microsoft_sysmon +linux_pkexec_privilege_escalation,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" disabling_controlpanel,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" attempt_to_stop_security_service,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon excel_spawning_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +suspicious_writes_to_windows_recycle_bin,5.0.0,"Splunk_TA_microsoft_sysmon, Splunk_TA_windows","Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" allow_inbound_traffic_by_firewall_rule_registry,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -getdomaincomputer_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -malicious_powershell_process___execution_policy_bypass,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -disable_defender_enhanced_notification,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +getdomaincomputer_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +malicious_powershell_process___execution_policy_bypass,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +disable_defender_enhanced_notification,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" fodhelper_uac_bypass,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" detect_regsvr32_application_control_bypass,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon windows_curl_download_to_suspicious_path,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -remcos_client_registry_install_entry,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +remcos_client_registry_install_entry,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" suspicious_microsoft_workflow_compiler_usage,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon bcdedit_failure_recovery_modification,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" linux_service_file_created_in_systemd_directory,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +suspicious_wav_file_in_appdata_folder,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_ossec, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_cyberark, Splunk_TA_CrowdStrike_FDR" slui_runas_elevated,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -batch_file_write_to_system32,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +batch_file_write_to_system32,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_ossec, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_cyberark, Splunk_TA_CrowdStrike_FDR" +chcp_command_execution,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +excel_spawning_windows_script_host,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" windows_dism_remove_defender,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon excessive_usage_of_taskkill,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" nltest_domain_trust_discovery,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" fsutil_zeroing_file,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -office_application_spawn_rundll32_process,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +windows_modify_show_compress_color_and_info_tip_registry,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +office_application_spawn_rundll32_process,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" add_or_set_windows_defender_exclusion,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon bitsadmin_download_file,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -print_processor_registry_autostart,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -detect_path_interception_by_creation_of_program_exe,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +detect_path_interception_by_creation_of_program_exe,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" cmdline_tool_not_executed_in_cmd_shell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon detect_mshta_inline_hta_execution,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon suspicious_rundll32_startw,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -script_execution_via_wmi,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR, Splunk_TA_cyberark_epm" +script_execution_via_wmi,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" slui_spawning_a_process,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" scheduled_task_deleted_or_created_via_cmd,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" allow_network_discovery_in_firewall,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon @@ -164,154 +181,165 @@ linux_file_created_in_kernel_driver_directory,5.0.0,,"Splunk_TA_bit9-carbonblack disable_logs_using_wevtutil,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" revil_common_exec_parameter,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" detect_sharphound_usage,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -wmiprsve_exe_lolbas_execution_process_spawn,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +wmiprsve_exe_lolbas_execution_process_spawn,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" linux_file_creation_in_profile_directory,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -services_exe_lolbas_execution_process_spawn,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +windows_service_creation_using_registry_entry,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +services_exe_lolbas_execution_process_spawn,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" regsvr32_with_known_silent_switch_cmdline,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon windows_installutil_uninstall_option,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -deleting_shadow_copies,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +deleting_shadow_copies,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" winhlp32_spawning_a_process,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon disabling_firewall_with_netsh,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -elevated_group_discovery_with_net,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -linux_setuid_using_setcap_utility,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -linux_preload_hijack_library_calls,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +elevated_group_discovery_with_net,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +linux_setuid_using_setcap_utility,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +linux_preload_hijack_library_calls,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" windows_installutil_in_non_standard_path,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -get_foresttrust_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -windows_defender_exclusion_registry_entry,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +get_foresttrust_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +windows_defender_exclusion_registry_entry,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" windows_adfind_exe,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" disabling_cmd_application,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -msmpeng_application_dll_side_loading,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -account_discovery_with_net_app,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -linux_insert_kernel_module_using_insmod_utility,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +monitor_registry_keys_for_print_monitors,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +msmpeng_application_dll_side_loading,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_CrowdStrike_FDR" +account_discovery_with_net_app,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +linux_insert_kernel_module_using_insmod_utility,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" certutil_download_with_urlcache_and_split_arguments,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon suspicious_msbuild_rename,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon suspicious_mshta_child_process,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -set_default_powershell_execution_policy_to_unrestricted_or_bypass,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +set_default_powershell_execution_policy_to_unrestricted_or_bypass,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon uninstall_app_using_msiexec,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" execute_javascript_with_jscript_com_clsid,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -create_local_admin_accounts_using_net_exe,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -disable_uac_remote_restriction,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +create_local_admin_accounts_using_net_exe,5.0.0,"Splunk_TA_microsoft_sysmon, Splunk_TA_windows","Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +disable_uac_remote_restriction,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" linux_doas_conf_file_creation,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -creation_of_shadow_copy,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +creation_of_shadow_copy,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" linux_file_creation_in_init_boot_directory,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -windows_disableantispyware_reg,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -disable_defender_mpengine_registry,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +disable_defender_mpengine_registry,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" getwmiobject_ds_user_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" disable_windows_app_hotkeys,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -dns_exfiltration_using_nslookup_app,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -clear_unallocated_sector_using_cipher_app,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -linux_java_spawning_shell,5.0.0,,Splunk_TA_microsoft_sysmon -disable_defender_blockatfirstseen_feature,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -remote_process_instantiation_via_wmi_and_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -detect_regsvcs_with_no_command_line_arguments,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -get_domaintrust_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -windows_installutil_credential_theft,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -elevated_group_discovery_with_wmic,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +dns_exfiltration_using_nslookup_app,5.0.0,"Splunk_TA_microsoft_sysmon, Splunk_TA_windows","Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +detect_sharphound_file_modifications,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +clear_unallocated_sector_using_cipher_app,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +detect_excessive_user_account_lockouts,5.0.0,Splunk_TA_windows,"Splunk_TA_microsoft-cloudservices, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_symantec-ep, Splunk_TA_sophos, Splunk_TA_cyberark, Splunk_TA_windows, Splunk_TA_box, Splunk_TA_CrowdStrike_FDR, Splunk_TA_cisco-asa, Splunk_TA_salesforce" +linux_java_spawning_shell,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +disable_defender_blockatfirstseen_feature,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +remote_process_instantiation_via_wmi_and_powershell,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +detect_regsvcs_with_no_command_line_arguments,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +get_domaintrust_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +elevated_group_discovery_with_wmic,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" registry_keys_used_for_persistence,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" detect_rundll32_application_control_bypass___syssetup,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon ping_sleep_batch_command,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -detect_processes_used_for_system_network_configuration_discovery,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -clop_common_exec_parameter,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_system_network_discovery,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +detect_processes_used_for_system_network_configuration_discovery,5.0.0,"Splunk_TA_microsoft_sysmon, Splunk_TA_windows","Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +clop_common_exec_parameter,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" office_product_spawning_certutil,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon regsvr32_silent_and_install_param_dll_loading,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +winword_spawning_windows_script_host,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +rubeus_command_line_parameters,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" msbuild_suspicious_spawned_by_script_process,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -hiding_files_and_directories_with_attrib_exe,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +hiding_files_and_directories_with_attrib_exe,5.0.0,"Splunk_TA_microsoft_sysmon, Splunk_TA_windows","Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" office_product_spawn_cmd_process,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon wsreset_uac_bypass,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -certutil_with_decode_argument,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +certutil_with_decode_argument,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" allow_file_and_printing_sharing_in_firewall,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -system_information_discovery_detection,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR, Splunk_TA_cyberark_epm" +system_information_discovery_detection,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" malicious_powershell_process_with_obfuscation_techniques,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon linux_add_files_in_known_crontab_directories,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" eventvwr_uac_bypass,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" icacls_deny_command,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" usn_journal_deletion,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -remote_system_discovery_with_wmic,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -detect_html_help_using_infotech_storage_handlers,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -disable_security_logs_using_minint_registry,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +remote_system_discovery_with_wmic,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +detect_html_help_using_infotech_storage_handlers,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +disable_security_logs_using_minint_registry,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" sdelete_application_execution,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -curl_download_and_bash_execution,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +curl_download_and_bash_execution,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" icacls_grant_command,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +rundll_loading_dll_by_ordinal,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon winword_spawning_cmd,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon credential_dumping_via_copy_command_from_shadow_copy,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -detect_regasm_with_no_command_line_arguments,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -enable_wdigest_uselogoncredential_registry,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +detect_regasm_with_no_command_line_arguments,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +enable_wdigest_uselogoncredential_registry,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" control_loading_from_world_writable_directory,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -remote_process_instantiation_via_wmi,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -suspicious_dllhost_no_command_line_arguments,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +remote_process_instantiation_via_wmi,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +suspicious_dllhost_no_command_line_arguments,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" spoolsv_spawning_rundll32,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -conti_common_exec_parameter,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +shim_database_file_creation,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_ossec, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +conti_common_exec_parameter,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" attempted_credential_dump_from_registry_via_reg_exe,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon jscript_execution_using_cscript_app,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -bcdedit_command_back_to_normal_mode_boot,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +bcdedit_command_back_to_normal_mode_boot,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" rundll32_shimcache_flush,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -screensaver_event_trigger_execution,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +screensaver_event_trigger_execution,5.0.0,,Splunk_TA_bit9-carbonblack office_product_spawning_bitsadmin,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -change_default_file_association,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -wscript_or_cscript_suspicious_child_process,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -domain_controller_discovery_with_nltest,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +change_default_file_association,5.0.0,,Splunk_TA_bit9-carbonblack +wscript_or_cscript_suspicious_child_process,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +domain_controller_discovery_with_nltest,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" disable_windows_behavior_monitoring,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" windows_curl_upload_to_remote_destination,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon unified_messaging_service_spawning_a_process,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -detect_html_help_spawn_child_process,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +detect_html_help_spawn_child_process,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" detect_regsvcs_spawning_a_process,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -linux_service_started_or_enabled,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -java_class_file_download_by_java_user_agent,5.0.0,,"Splunk_TA_citrix-netscaler, Splunk_TA_nginx, Splunk_TA_microsoft-iis, Splunk_TA_websense-cg, Splunk_TA_squid, Splunk_TA_haproxy, Splunk_TA_mcafee-wg, Splunk_TA_cisco-wsa" +linux_service_started_or_enabled,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" linux_at_allow_config_file_creation,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -disable_defender_antivirus_registry,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -linux_visudo_utility_execution,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +disable_defender_antivirus_registry,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +linux_visudo_utility_execution,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" schtasks_run_task_on_demand,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" schtasks_used_for_forcing_a_reboot,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" windows_raccine_scheduled_task_deletion,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -mshta_spawning_rundll32_or_regsvr32_process,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +mshta_spawning_rundll32_or_regsvr32_process,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +mimikatz_passtheticket_commandline_parameters,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" excessive_attempt_to_disable_services,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" get_domainuser_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" suspicious_scheduled_task_from_public_directory,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -rundll32_with_no_command_line_arguments_with_network,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon windows_service_creation_on_remote_endpoint,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -linux_nopasswd_entry_in_sudoers_file,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +linux_nopasswd_entry_in_sudoers_file,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" attempt_to_add_certificate_to_untrusted_store,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" process_kill_base_on_file_path,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -wsmprovhost_exe_lolbas_execution_process_spawn,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +wsmprovhost_exe_lolbas_execution_process_spawn,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" domain_account_discovery_with_wmic,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +linux_dd_file_overwrite,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" disabling_norun_windows_app,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" suspicious_rundll32_plugininit,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -file_with_samsam_extension,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, splunk_ta_o365, Splunk_TA_sophos, Splunk_TA_cyberark, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +file_with_samsam_extension,5.0.0,"Splunk_TA_microsoft_sysmon, Splunk_TA_windows","Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, splunk_ta_o365, Splunk_TA_sophos, Splunk_TA_cyberark, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" silentcleanup_uac_bypass,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" ntdsutil_export_ntds,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" disabling_systemrestore_in_registry,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -vbscript_execution_using_wscript_app,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -office_spawning_control,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +vbscript_execution_using_wscript_app,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +office_spawning_control,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" detect_regasm_spawning_a_process,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" start_up_during_safe_mode_boot,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +malicious_inprocserver32_modification,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" office_product_spawning_mshta,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -change_to_safe_mode_with_network_config,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -potentially_malicious_code_on_commandline,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +change_to_safe_mode_with_network_config,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" detect_rundll32_application_control_bypass___advpack,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon services_escalate_exe,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -wget_download_and_bash_execution,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +wget_download_and_bash_execution,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" remote_wmi_command_attempt,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" create_or_delete_windows_shares_using_net_exe,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon unload_sysmon_filter_driver,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" resize_shadowstorage_volume,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" wmic_xsl_execution_via_url,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon suspicious_reg_exe_process,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -etw_registry_disabled,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -process_execution_via_wmi,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -samsam_test_file_write,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, splunk_ta_o365, Splunk_TA_sophos, Splunk_TA_cyberark, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" -impacket_lateral_movement_commandline_parameters,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -dump_lsass_via_comsvcs_dll,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -creation_of_shadow_copy_with_wmic_and_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -overwriting_accessibility_binaries,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_ossec, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, splunk_ta_o365, Splunk_TA_sophos, Splunk_TA_cyberark, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +etw_registry_disabled,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +process_execution_via_wmi,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +samsam_test_file_write,5.0.0,"Splunk_TA_microsoft_sysmon, Splunk_TA_windows","Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, splunk_ta_o365, Splunk_TA_sophos, Splunk_TA_cyberark, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +impacket_lateral_movement_commandline_parameters,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +windows_process_with_namedpipe_commandline,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +dump_lsass_via_comsvcs_dll,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_cyberark_epm" +creation_of_shadow_copy_with_wmic_and_powershell,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_cyberark_epm" +overwriting_accessibility_binaries,5.0.0,"Splunk_TA_microsoft_sysmon, Splunk_TA_windows","Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, splunk_ta_o365, Splunk_TA_sophos, Splunk_TA_cyberark, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +windows_schtasks_create_run_as_system,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon add_defaultuser_and_password_in_registry,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" bits_job_persistence,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon suspicious_rundll32_dllregisterserver,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon any_powershell_downloadfile,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -mmc_exe_lolbas_execution_process_spawn,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +mmc_exe_lolbas_execution_process_spawn,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" w3wp_spawning_shell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon detect_sharphound_command_line_arguments,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -detect_rclone_command_line_usage,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +detect_rclone_command_line_usage,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" suspicious_msbuild_path,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon disabling_net_user_account,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon shim_database_installation_with_suspicious_parameters,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -dns_query_length_with_high_standard_deviation,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_isc-bind, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR, Splunk_TA_infoblox" +office_application_drop_executable,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +windows_diskshadow_proxy_execution,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +dns_query_length_with_high_standard_deviation,5.0.0,,"Splunk_TA_isc-bind, Splunk_TA_CrowdStrike_FDR, Splunk_TA_infoblox" diff --git a/security_content_automation/detection_ta_mapping.yml b/security_content_automation/detection_ta_mapping.yml index ffb96a2eb7..9f902a568b 100644 --- a/security_content_automation/detection_ta_mapping.yml +++ b/security_content_automation/detection_ta_mapping.yml @@ -39,6 +39,7 @@ account_discovery_with_net_app: supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon active_setup_registry_autostart: cim_version: 5.0.0 @@ -109,6 +110,7 @@ attacker_tools_on_endpoint: cim_version: 5.0.0 supported_tas: - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon @@ -145,9 +147,10 @@ batch_file_write_to_system32: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_nix + - Splunk_TA_ossec - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon - - Splunk_TA_windows + - Splunk_TA_cyberark - Splunk_TA_CrowdStrike_FDR bcdedit_command_back_to_normal_mode_boot: cim_version: 5.0.0 @@ -156,6 +159,7 @@ bcdedit_command_back_to_normal_mode_boot: tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR bcdedit_failure_recovery_modification: cim_version: 5.0.0 supported_tas: @@ -193,21 +197,28 @@ certutil_exe_certificate_extraction: supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon certutil_with_decode_argument: cim_version: 5.0.0 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon change_default_file_association: + cim_version: 5.0.0 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack +change_to_safe_mode_with_network_config: cim_version: 5.0.0 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon -change_to_safe_mode_with_network_config: + - Splunk_TA_CrowdStrike_FDR +chcp_command_execution: cim_version: 5.0.0 supported_tas: - Splunk_TA_microsoft_sysmon @@ -226,12 +237,14 @@ clear_unallocated_sector_using_cipher_app: supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon clop_common_exec_parameter: cim_version: 5.0.0 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon cloud_api_calls_from_previously_unseen_user_roles: cim_version: 5.0.0 @@ -261,13 +274,39 @@ cloud_compute_instance_created_with_previously_unseen_image: supported_tas: - Splunk_TA_aws-kinesis-firehose tas_with_cim_mapping: + - Splunk_TA_microsoft-cloudservices + - Splunk_TA_citrix-netscaler + - Splunk_TA_nix + - Splunk_TA_rsa-securid - Splunk_TA_aws-kinesis-firehose + - Splunk_TA_rsa_securid_cas + - Splunk_TA_ossec + - Splunk_TA_juniper + - splunk_ta_o365 + - Splunk_TA_cyberark + - Splunk_TA_box + - Splunk_TA_CrowdStrike_FDR + - Splunk_TA_cisco-asa + - Splunk_TA_salesforce cloud_compute_instance_created_with_previously_unseen_instance_type: cim_version: 5.0.0 supported_tas: - Splunk_TA_aws-kinesis-firehose tas_with_cim_mapping: + - Splunk_TA_microsoft-cloudservices + - Splunk_TA_citrix-netscaler + - Splunk_TA_nix + - Splunk_TA_rsa-securid - Splunk_TA_aws-kinesis-firehose + - Splunk_TA_rsa_securid_cas + - Splunk_TA_ossec + - Splunk_TA_juniper + - splunk_ta_o365 + - Splunk_TA_cyberark + - Splunk_TA_box + - Splunk_TA_CrowdStrike_FDR + - Splunk_TA_cisco-asa + - Splunk_TA_salesforce cloud_instance_modified_with_previously_unseen_user: cim_version: 5.0.0 supported_tas: @@ -363,6 +402,7 @@ conti_common_exec_parameter: supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon control_loading_from_world_writable_directory: cim_version: 5.0.0 @@ -374,8 +414,11 @@ create_local_admin_accounts_using_net_exe: cim_version: 5.0.0 supported_tas: - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows create_or_delete_windows_shares_using_net_exe: cim_version: 5.0.0 supported_tas: @@ -387,6 +430,7 @@ creation_of_shadow_copy: supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon creation_of_shadow_copy_with_wmic_and_powershell: cim_version: 5.0.0 @@ -394,6 +438,7 @@ creation_of_shadow_copy_with_wmic_and_powershell: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon + - Splunk_TA_cyberark_epm credential_dumping_via_copy_command_from_shadow_copy: cim_version: 5.0.0 supported_tas: @@ -411,6 +456,7 @@ curl_download_and_bash_execution: tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR deleting_of_net_users: cim_version: 5.0.0 supported_tas: @@ -422,14 +468,16 @@ deleting_shadow_copies: supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon detect_azurehound_command_line_arguments: cim_version: 5.0.0 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon -detect_exchange_web_shell: +detect_azurehound_file_modifications: cim_version: 5.0.0 supported_tas: - Splunk_TA_microsoft_sysmon @@ -437,11 +485,57 @@ detect_exchange_web_shell: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon - Splunk_TA_CrowdStrike_FDR +detect_excessive_account_lockouts_from_endpoint: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_windows + tas_with_cim_mapping: + - Splunk_TA_microsoft-cloudservices + - Splunk_TA_rsa-securid + - Splunk_TA_aws-kinesis-firehose + - Splunk_TA_rsa_securid_cas + - Splunk_TA_symantec-ep + - Splunk_TA_sophos + - Splunk_TA_cyberark + - Splunk_TA_windows + - Splunk_TA_box + - Splunk_TA_CrowdStrike_FDR + - Splunk_TA_cisco-asa + - Splunk_TA_salesforce +detect_excessive_user_account_lockouts: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_windows + tas_with_cim_mapping: + - Splunk_TA_microsoft-cloudservices + - Splunk_TA_rsa-securid + - Splunk_TA_aws-kinesis-firehose + - Splunk_TA_rsa_securid_cas + - Splunk_TA_symantec-ep + - Splunk_TA_sophos + - Splunk_TA_cyberark + - Splunk_TA_windows + - Splunk_TA_box + - Splunk_TA_CrowdStrike_FDR + - Splunk_TA_cisco-asa + - Splunk_TA_salesforce +detect_exchange_web_shell: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_nix + - Splunk_TA_ossec + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_cyberark + - Splunk_TA_CrowdStrike_FDR detect_html_help_spawn_child_process: cim_version: 5.0.0 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon detect_html_help_url_in_command_line: cim_version: 5.0.0 @@ -454,6 +548,7 @@ detect_html_help_using_infotech_storage_handlers: supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon detect_mshta_inline_hta_execution: cim_version: 5.0.0 @@ -472,24 +567,32 @@ detect_path_interception_by_creation_of_program_exe: supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR detect_processes_used_for_system_network_configuration_discovery: cim_version: 5.0.0 supported_tas: - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows detect_psexec_with_accepteula_flag: cim_version: 5.0.0 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR detect_rclone_command_line_usage: cim_version: 5.0.0 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon detect_regasm_spawning_a_process: cim_version: 5.0.0 @@ -503,7 +606,9 @@ detect_regasm_with_no_command_line_arguments: supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR detect_regsvcs_spawning_a_process: cim_version: 5.0.0 supported_tas: @@ -516,7 +621,9 @@ detect_regsvcs_with_no_command_line_arguments: supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR detect_regsvr32_application_control_bypass: cim_version: 5.0.0 supported_tas: @@ -554,6 +661,14 @@ detect_sharphound_command_line_arguments: tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon +detect_sharphound_file_modifications: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR detect_sharphound_usage: cim_version: 5.0.0 supported_tas: @@ -579,36 +694,42 @@ disable_defender_antivirus_registry: supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon disable_defender_blockatfirstseen_feature: cim_version: 5.0.0 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon disable_defender_enhanced_notification: cim_version: 5.0.0 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon disable_defender_mpengine_registry: cim_version: 5.0.0 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon disable_defender_spynet_reporting: cim_version: 5.0.0 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon disable_defender_submit_samples_consent_feature: cim_version: 5.0.0 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon disable_etw_through_registry: cim_version: 5.0.0 @@ -638,18 +759,26 @@ disable_schedule_task: tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon - - Splunk_TA_CrowdStrike_FDR disable_security_logs_using_minint_registry: cim_version: 5.0.0 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +disable_show_hidden_files: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon disable_uac_remote_restriction: cim_version: 5.0.0 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon disable_windows_app_hotkeys: cim_version: 5.0.0 @@ -665,6 +794,13 @@ disable_windows_behavior_monitoring: tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon +disable_windows_smartscreen_protection: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon disabling_cmd_application: cim_version: 5.0.0 supported_tas: @@ -684,6 +820,7 @@ disabling_defender_services: supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon disabling_firewall_with_netsh: cim_version: 5.0.0 @@ -727,15 +864,15 @@ dns_exfiltration_using_nslookup_app: cim_version: 5.0.0 supported_tas: - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows dns_query_length_with_high_standard_deviation: cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_isc-bind - - Splunk_TA_microsoft_sysmon - Splunk_TA_CrowdStrike_FDR - Splunk_TA_infoblox domain_account_discovery_with_net_app: @@ -757,6 +894,7 @@ domain_controller_discovery_with_nltest: supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon dsquery_domain_discovery: cim_version: 5.0.0 @@ -765,32 +903,33 @@ dsquery_domain_discovery: tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon - - Splunk_TA_CrowdStrike_FDR dump_lsass_via_comsvcs_dll: cim_version: 5.0.0 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon + - Splunk_TA_cyberark_epm dump_lsass_via_procdump: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon + - Splunk_TA_cyberark_epm +elevated_group_discovery_with_net: cim_version: 5.0.0 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon - - Splunk_TA_CrowdStrike_FDR -elevated_group_discovery_with_net: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon elevated_group_discovery_with_wmic: cim_version: 5.0.0 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon enable_rdp_in_other_port_number: cim_version: 5.0.0 @@ -804,12 +943,14 @@ enable_wdigest_uselogoncredential_registry: supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon etw_registry_disabled: cim_version: 5.0.0 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon eventvwr_uac_bypass: cim_version: 5.0.0 @@ -824,6 +965,13 @@ excel_spawning_powershell: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon +excel_spawning_windows_script_host: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon excessive_attempt_to_disable_services: cim_version: 5.0.0 supported_tas: @@ -834,13 +982,9 @@ excessive_attempt_to_disable_services: - Splunk_TA_CrowdStrike_FDR excessive_number_of_distinct_processes_created_in_windows_temp_folder: cim_version: 5.0.0 - supported_tas: - - Splunk_TA_windows tas_with_cim_mapping: - - Splunk_TA_nix - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon - - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR - Splunk_TA_cyberark_epm excessive_number_of_service_control_start_as_disabled: @@ -873,7 +1017,6 @@ excessive_usage_of_cacls_app: tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon - - Splunk_TA_CrowdStrike_FDR excessive_usage_of_net_app: cim_version: 5.0.0 supported_tas: @@ -890,11 +1033,8 @@ excessive_usage_of_taskkill: - Splunk_TA_CrowdStrike_FDR executables_or_script_creation_in_suspicious_path: cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon - Splunk_TA_CrowdStrike_FDR execute_javascript_with_jscript_com_clsid: cim_version: 5.0.0 @@ -907,6 +1047,7 @@ execution_of_file_with_multiple_extensions: cim_version: 5.0.0 supported_tas: - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon @@ -916,11 +1057,13 @@ extraction_of_registry_hives: supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon file_with_samsam_extension: cim_version: 5.0.0 supported_tas: - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows tas_with_cim_mapping: - Splunk_TA_nix - Splunk_TA_bit9-carbonblack @@ -970,7 +1113,9 @@ get_domaintrust_with_powershell: supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR get_domainuser_with_powershell: cim_version: 5.0.0 supported_tas: @@ -983,30 +1128,36 @@ get_foresttrust_with_powershell: supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR getdomaincomputer_with_powershell: cim_version: 5.0.0 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon getdomaingroup_with_powershell: cim_version: 5.0.0 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon getwmiobject_ds_computer_with_powershell: cim_version: 5.0.0 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon getwmiobject_ds_group_with_powershell: cim_version: 5.0.0 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon getwmiobject_ds_user_with_powershell: cim_version: 5.0.0 @@ -1026,6 +1177,7 @@ hiding_files_and_directories_with_attrib_exe: cim_version: 5.0.0 supported_tas: - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon @@ -1051,18 +1203,9 @@ impacket_lateral_movement_commandline_parameters: supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon -java_class_file_download_by_java_user_agent: - cim_version: 5.0.0 - tas_with_cim_mapping: - - Splunk_TA_citrix-netscaler - - Splunk_TA_nginx - - Splunk_TA_microsoft-iis - - Splunk_TA_websense-cg - - Splunk_TA_squid - - Splunk_TA_haproxy - - Splunk_TA_mcafee-wg - - Splunk_TA_cisco-wsa + - Splunk_TA_CrowdStrike_FDR jscript_execution_using_cscript_app: cim_version: 5.0.0 supported_tas: @@ -1085,13 +1228,16 @@ linux_at_application_execution: tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon - - Splunk_TA_CrowdStrike_FDR linux_change_file_owner_to_root: cim_version: 5.0.0 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon - - Splunk_TA_CrowdStrike_FDR +linux_dd_file_overwrite: + cim_version: 5.0.0 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon linux_doas_conf_file_creation: cim_version: 5.0.0 tas_with_cim_mapping: @@ -1102,7 +1248,6 @@ linux_doas_tool_execution: tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon - - Splunk_TA_CrowdStrike_FDR linux_file_created_in_kernel_driver_directory: cim_version: 5.0.0 tas_with_cim_mapping: @@ -1123,27 +1268,28 @@ linux_insert_kernel_module_using_insmod_utility: tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon - - Splunk_TA_CrowdStrike_FDR linux_install_kernel_module_using_modprobe_utility: cim_version: 5.0.0 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon - - Splunk_TA_CrowdStrike_FDR linux_java_spawning_shell: - cim_version: 5.0.0 - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon -linux_nopasswd_entry_in_sudoers_file: cim_version: 5.0.0 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon - Splunk_TA_CrowdStrike_FDR +linux_nopasswd_entry_in_sudoers_file: + cim_version: 5.0.0 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon linux_pkexec_privilege_escalation: cim_version: 5.0.0 tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR linux_possible_access_or_modification_of_sshd_config_file: cim_version: 5.0.0 tas_with_cim_mapping: @@ -1167,13 +1313,11 @@ linux_possible_append_command_to_at_allow_config_file: tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon - - Splunk_TA_CrowdStrike_FDR linux_possible_append_command_to_profile_config_file: cim_version: 5.0.0 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon - - Splunk_TA_CrowdStrike_FDR linux_possible_ssh_key_file_creation: cim_version: 5.0.0 tas_with_cim_mapping: @@ -1184,7 +1328,6 @@ linux_preload_hijack_library_calls: tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon - - Splunk_TA_CrowdStrike_FDR linux_service_file_created_in_systemd_directory: cim_version: 5.0.0 tas_with_cim_mapping: @@ -1195,37 +1338,41 @@ linux_service_restarted: tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon - - Splunk_TA_CrowdStrike_FDR linux_service_started_or_enabled: cim_version: 5.0.0 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon - - Splunk_TA_CrowdStrike_FDR linux_setuid_using_chmod_utility: cim_version: 5.0.0 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon - - Splunk_TA_CrowdStrike_FDR linux_setuid_using_setcap_utility: cim_version: 5.0.0 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon - - Splunk_TA_CrowdStrike_FDR linux_sudoers_tmp_file_creation: cim_version: 5.0.0 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon +linux_system_network_discovery: + cim_version: 5.0.0 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon linux_visudo_utility_execution: cim_version: 5.0.0 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon - - Splunk_TA_CrowdStrike_FDR logon_script_event_trigger_execution: + cim_version: 5.0.0 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack +malicious_inprocserver32_modification: cim_version: 5.0.0 supported_tas: - Splunk_TA_microsoft_sysmon @@ -1237,18 +1384,28 @@ malicious_powershell_process___execution_policy_bypass: supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR malicious_powershell_process_with_obfuscation_techniques: cim_version: 5.0.0 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon +mimikatz_passtheticket_commandline_parameters: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon mmc_exe_lolbas_execution_process_spawn: cim_version: 5.0.0 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon modify_acl_permission_to_files_or_folder: cim_version: 5.0.0 @@ -1258,6 +1415,13 @@ modify_acl_permission_to_files_or_folder: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon - Splunk_TA_CrowdStrike_FDR +monitor_registry_keys_for_print_monitors: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon msbuild_suspicious_spawned_by_script_process: cim_version: 5.0.0 supported_tas: @@ -1269,21 +1433,18 @@ mshta_spawning_rundll32_or_regsvr32_process: supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon msmpeng_application_dll_side_loading: cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon - Splunk_TA_CrowdStrike_FDR net_profiler_uac_bypass: cim_version: 5.0.0 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon nishang_powershelltcponeline: cim_version: 5.0.0 @@ -1305,6 +1466,13 @@ ntdsutil_export_ntds: tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon +office_application_drop_executable: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon office_application_spawn_regsvr32_process: cim_version: 5.0.0 supported_tas: @@ -1316,6 +1484,7 @@ office_application_spawn_rundll32_process: supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon office_document_spawned_child_process_to_download: cim_version: 5.0.0 @@ -1352,6 +1521,7 @@ office_product_spawning_rundll32_with_no_dll: supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon office_product_spawning_wmic: cim_version: 5.0.0 @@ -1359,13 +1529,7 @@ office_product_spawning_wmic: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon -office_spawning_control: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon -overwriting_accessibility_binaries: +office_product_writing_cab_or_inf: cim_version: 5.0.0 supported_tas: - Splunk_TA_microsoft_sysmon @@ -1374,6 +1538,24 @@ overwriting_accessibility_binaries: - Splunk_TA_ossec - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_cyberark + - Splunk_TA_CrowdStrike_FDR +office_spawning_control: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +overwriting_accessibility_binaries: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows + tas_with_cim_mapping: + - Splunk_TA_nix + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon - splunk_ta_o365 - Splunk_TA_sophos - Splunk_TA_cyberark @@ -1393,12 +1575,6 @@ ping_sleep_batch_command: tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon possible_lateral_movement_powershell_spawn: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon -potentially_malicious_code_on_commandline: cim_version: 5.0.0 supported_tas: - Splunk_TA_microsoft_sysmon @@ -1424,11 +1600,6 @@ prevent_automatic_repair_mode_using_bcdedit: tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon -print_processor_registry_autostart: - cim_version: 5.0.0 - tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon process_creating_lnk_file_in_suspicious_location: cim_version: 5.0.0 supported_tas: @@ -1436,7 +1607,6 @@ process_creating_lnk_file_in_suspicious_location: tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon - - Splunk_TA_CrowdStrike_FDR process_execution_via_wmi: cim_version: 5.0.0 supported_tas: @@ -1444,7 +1614,6 @@ process_execution_via_wmi: tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon - - Splunk_TA_CrowdStrike_FDR process_kill_base_on_file_path: cim_version: 5.0.0 supported_tas: @@ -1456,13 +1625,13 @@ processes_launching_netsh: supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon recursive_delete_of_directory_in_batch_cmd: cim_version: 5.0.0 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon reg_exe_manipulating_windows_services_registry_keys: cim_version: 5.0.0 @@ -1472,6 +1641,13 @@ reg_exe_manipulating_windows_services_registry_keys: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon - Splunk_TA_CrowdStrike_FDR +registry_keys_for_creating_shim_databases: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon registry_keys_used_for_persistence: cim_version: 5.0.0 supported_tas: @@ -1479,6 +1655,13 @@ registry_keys_used_for_persistence: tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon +registry_keys_used_for_privilege_escalation: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon regsvr32_silent_and_install_param_dll_loading: cim_version: 5.0.0 supported_tas: @@ -1496,19 +1679,35 @@ remcos_client_registry_install_entry: supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon +remcos_rat_file_creation_in_remcos_folder: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_nix + - Splunk_TA_ossec + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_cyberark + - Splunk_TA_CrowdStrike_FDR remote_process_instantiation_via_dcom_and_powershell: cim_version: 5.0.0 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR remote_process_instantiation_via_winrm_and_powershell: cim_version: 5.0.0 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR remote_process_instantiation_via_winrm_and_winrs: cim_version: 5.0.0 supported_tas: @@ -1520,18 +1719,23 @@ remote_process_instantiation_via_wmi: supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR remote_process_instantiation_via_wmi_and_powershell: cim_version: 5.0.0 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR remote_system_discovery_with_wmic: cim_version: 5.0.0 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon remote_wmi_command_attempt: cim_version: 5.0.0 @@ -1561,6 +1765,13 @@ revil_registry_entry: tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon +rubeus_command_line_parameters: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon rundll32_control_rundll_world_writable_directory: cim_version: 5.0.0 supported_tas: @@ -1573,7 +1784,7 @@ rundll32_shimcache_flush: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon -rundll32_with_no_command_line_arguments_with_network: +rundll_loading_dll_by_ordinal: cim_version: 5.0.0 supported_tas: - Splunk_TA_microsoft_sysmon @@ -1590,6 +1801,7 @@ samsam_test_file_write: cim_version: 5.0.0 supported_tas: - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows tas_with_cim_mapping: - Splunk_TA_nix - Splunk_TA_bit9-carbonblack @@ -1639,9 +1851,7 @@ schtasks_scheduling_job_on_remote_system: supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon - - Splunk_TA_CrowdStrike_FDR schtasks_used_for_forcing_a_reboot: cim_version: 5.0.0 supported_tas: @@ -1652,22 +1862,15 @@ schtasks_used_for_forcing_a_reboot: - Splunk_TA_CrowdStrike_FDR screensaver_event_trigger_execution: cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon script_execution_via_wmi: cim_version: 5.0.0 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_nix - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon - - Splunk_TA_windows - - Splunk_TA_CrowdStrike_FDR - - Splunk_TA_cyberark_epm sdclt_uac_bypass: cim_version: 5.0.0 supported_tas: @@ -1706,14 +1909,24 @@ services_exe_lolbas_execution_process_spawn: supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon set_default_powershell_execution_policy_to_unrestricted_or_bypass: cim_version: 5.0.0 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +shim_database_file_creation: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_nix + - Splunk_TA_ossec - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR shim_database_installation_with_suspicious_parameters: cim_version: 5.0.0 supported_tas: @@ -1722,13 +1935,6 @@ shim_database_installation_with_suspicious_parameters: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon - Splunk_TA_CrowdStrike_FDR -short_lived_windows_accounts: - cim_version: 5.0.0 - tas_with_cim_mapping: - - Splunk_TA_microsoft-cloudservices - - Splunk_TA_rsa-securid - - Splunk_TA_aws-kinesis-firehose - - Splunk_TA_cyberark silentcleanup_uac_bypass: cim_version: 5.0.0 supported_tas: @@ -1740,6 +1946,7 @@ single_letter_process_on_endpoint: cim_version: 5.0.0 supported_tas: - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows tas_with_cim_mapping: - Splunk_TA_nix - Splunk_TA_bit9-carbonblack @@ -1773,8 +1980,10 @@ spoolsv_writing_a_dll: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_nix + - Splunk_TA_ossec - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_cyberark - Splunk_TA_CrowdStrike_FDR start_up_during_safe_mode_boot: cim_version: 5.0.0 @@ -1788,25 +1997,49 @@ suspicious_copy_on_system32: supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR suspicious_dllhost_no_command_line_arguments: cim_version: 5.0.0 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR suspicious_gpupdate_no_command_line_arguments: cim_version: 5.0.0 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR suspicious_icedid_rundll32_cmdline: cim_version: 5.0.0 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon +suspicious_image_creation_in_appdata_folder: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_nix + - Splunk_TA_ossec + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_cyberark + - Splunk_TA_CrowdStrike_FDR +suspicious_linux_discovery_commands: + cim_version: 5.0.0 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR suspicious_microsoft_workflow_compiler_usage: cim_version: 5.0.0 supported_tas: @@ -1888,7 +2121,9 @@ suspicious_rundll32_with_no_command_line_arguments: supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR suspicious_scheduled_task_from_public_directory: cim_version: 5.0.0 supported_tas: @@ -1901,7 +2136,20 @@ suspicious_searchprotocolhost_no_command_line_arguments: supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR +suspicious_wav_file_in_appdata_folder: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_nix + - Splunk_TA_ossec + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_cyberark + - Splunk_TA_CrowdStrike_FDR suspicious_wevtutil_usage: cim_version: 5.0.0 supported_tas: @@ -1910,21 +2158,29 @@ suspicious_wevtutil_usage: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon - Splunk_TA_CrowdStrike_FDR +suspicious_writes_to_windows_recycle_bin: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR svchost_exe_lolbas_execution_process_spawn: cim_version: 5.0.0 tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon system_information_discovery_detection: cim_version: 5.0.0 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_nix - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon - - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR - - Splunk_TA_cyberark_epm system_processes_run_from_unexpected_locations: cim_version: 5.0.0 supported_tas: @@ -1932,7 +2188,6 @@ system_processes_run_from_unexpected_locations: tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon - - Splunk_TA_CrowdStrike_FDR time_provider_persistence_registry: cim_version: 5.0.0 supported_tas: @@ -1974,6 +2229,7 @@ vbscript_execution_using_wscript_app: supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon w3wp_spawning_shell: cim_version: 5.0.0 @@ -2000,6 +2256,7 @@ wget_download_and_bash_execution: tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR windows_adfind_exe: cim_version: 5.0.0 supported_tas: @@ -2024,8 +2281,16 @@ windows_defender_exclusion_registry_entry: supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon -windows_disableantispyware_reg: +windows_disable_memory_crash_dump: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +windows_diskshadow_proxy_execution: cim_version: 5.0.0 supported_tas: - Splunk_TA_microsoft_sysmon @@ -2044,12 +2309,10 @@ windows_dotnet_binary_in_non_standard_path: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon -windows_installutil_credential_theft: +windows_file_without_extension_in_critical_folder: cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack windows_installutil_in_non_standard_path: cim_version: 5.0.0 supported_tas: @@ -2068,24 +2331,62 @@ windows_installutil_url_in_command_line: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon +windows_modify_show_compress_color_and_info_tip_registry: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon windows_nirsoft_advancedrun: cim_version: 5.0.0 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon +windows_process_with_namedpipe_commandline: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon windows_raccine_scheduled_task_deletion: cim_version: 5.0.0 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon +windows_rasautou_dll_execution: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +windows_remote_assistance_spawning_process: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +windows_schtasks_create_run_as_system: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon windows_service_creation_on_remote_endpoint: cim_version: 5.0.0 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon +windows_service_creation_using_registry_entry: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon windows_service_initiation_on_remote_endpoint: cim_version: 5.0.0 supported_tas: @@ -2110,6 +2411,13 @@ winword_spawning_powershell: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon +winword_spawning_windows_script_host: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon wmic_xsl_execution_via_url: cim_version: 5.0.0 supported_tas: @@ -2121,18 +2429,21 @@ wmiprsve_exe_lolbas_execution_process_spawn: supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon wscript_or_cscript_suspicious_child_process: cim_version: 5.0.0 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon wsmprovhost_exe_lolbas_execution_process_spawn: cim_version: 5.0.0 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon wsreset_uac_bypass: cim_version: 5.0.0