Merge branch 'develop' into dependabot/pip/azure-mgmt-compute-23.0.0

2026-06-08 17:32:49 +00:00 · 2021-10-28 13:09:44 -04:00
parent 4d5e4d70ed 0ef1b857f6
commit dc36511d1d
1221 changed files with 23108 additions and 9808 deletions
@@ -1,4 +1,4 @@
-ansible==3.1.0
+ansible==4.2.0
 ansible-runner==1.4.7
 apipkg==1.5
 aspy.yaml==1.3.0
@@ -1,4 +1,4 @@
-ansible==2.9.20
+ansible==4.2.0
 ansible-runner==1.4.4
 attackcti==0.3.4.3
 boto3==1.11.0
@@ -1,5 +1,5 @@
 ansible==3.4.0
-ansible-runner==1.4.7
+ansible-runner==2.0.2
 apipkg==1.5
 aspy.yaml==1.3.0
 atomicwrites==1.4.0
@@ -7,13 +7,13 @@ attackcti==0.3.4.3
 attrs==21.2.0
 azure-common==1.1.27
 azure-core==1.18.0
-azure-identity==1.6.0
 azure-mgmt-compute==23.0.0
+azure-identity==1.6.1
 azure-mgmt-core==1.2.1
 azure-mgmt-network==19.0.0
 azure-mgmt-resource==17.0.0
 bcrypt==3.2.0
-boto3==1.17.104
+boto3==1.18.38
 botocore==1.20.105
 certifi==2021.5.30
 cffi==1.14.5
@@ -45,8 +45,8 @@ path==15.1.2
 path.py==12.5.0
 pexpect==4.8.0
 pluggy==0.13.1
-pre-commit==2.13.0
-protobuf==3.17.0
+pre-commit==2.15.0
+protobuf==3.18.1
 psutil==5.8.0
 ptyprocess==0.7.0
 py==1.10.0
@@ -9,6 +9,18 @@ from jinja2 import Environment, FileSystemLoader
 import datetime
 from stix2 import FileSystemSource
 from stix2 import Filter
+from pycvesearch import CVESearch
+
+CVESSEARCH_API_URL = 'https://cve.circl.lu'
+
+def get_cve_enrichment_new(cve_id):
+    cve = CVESearch(CVESSEARCH_API_URL)
+    result = cve.id(cve_id)
+    cve_enriched = dict()
+    cve_enriched['id'] = cve_id
+    cve_enriched['cvss'] = result['cvss']
+    cve_enriched['summary'] = result['summary']
+    return cve_enriched

 def get_all_techniques(projects_path):
    path_cti = path.join(projects_path,'cti/enterprise-attack')
@@ -109,11 +121,6 @@ def generate_doc_stories(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, attack, sorted_de
                        sto_to_kill_chain_phases[story] = set(detection['tags']['kill_chain_phases'])

                if 'mitre_attacks' in detection:
-                    if story in sto_to_mitre_attacks.keys():
-                        for mitre_attack in detection['mitre_attacks']:
-                            if mitre_attack not in sto_to_mitre_attacks[story]:
-                                sto_to_mitre_attacks[story].append(mitre_attack)
-                    else:
                        sto_to_mitre_attacks[story] = detection['mitre_attacks']

    # add the enrich objects to the story
@@ -198,14 +205,6 @@ def generate_doc_stories(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, attack, sorted_de
            f.write(output)
        messages.append("doc_gen.py wrote _page for: {0} structure to: {1}".format(category['name'], output_path))

-    # write index updated metrics
-    template = j2_env.get_template('doc_index_markdown.j2')
-    output_path = path.join(OUTPUT_DIR + '/index.markdown')
-    output = template.render(detection_count=len(sorted_detections), story_count=len(sorted_stories))
-    with open(output_path, 'w', encoding="utf-8") as f:
-        f.write(output)
-    messages.append("doc_gen.py wrote site index page to: {0}".format(output_path))
-
    # write stories listing markdown
    template = j2_env.get_template('doc_story_page_markdown.j2')
    output_path = path.join(OUTPUT_DIR + '/_pages/stories.md')
@@ -267,6 +266,14 @@ def generate_doc_detections(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, attack, messag
                mitre_attacks.append(mitre_attack)
            detection_yaml['mitre_attacks'] = mitre_attacks

+        # enrich the cve object
+        cves = []
+        if 'cve' in detection_yaml['tags']:
+            for cve_id in detection_yaml['tags']['cve']:
+                cve = get_cve_enrichment_new(cve_id)
+                cves.append(cve)
+            detection_yaml['cve'] = cves
+
        # grab the kind
        detection_yaml['kind'] = manifest_file.split('/')[-2]

@@ -329,6 +336,71 @@ def generate_doc_detections(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, attack, messag
    messages.append("doc_gen.py wrote {0} detections documentation in mediawiki to: {1}".format(len(detections),output_path))

    return sorted_detections, messages
+
+def generate_doc_playbooks(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, sorted_detections, messages, VERBOSE):
+    manifest_files = []
+    for root, dirs, files in walk(REPO_PATH + '/playbooks/'):
+        for file in files:
+            if file.endswith(".yml"):
+                manifest_files.append((path.join(root, file)))
+
+    playbooks = []
+    for manifest_file in manifest_files:
+        detection_yaml = dict()
+        if VERBOSE:
+            print("processing manifest {0}".format(manifest_file))
+
+        with open(manifest_file, 'r') as stream:
+            try:
+                object = list(yaml.safe_load_all(stream))[0]
+            except yaml.YAMLError as exc:
+                print(exc)
+                print("Error reading {0}".format(manifest_file))
+                sys.exit(1)
+
+        playbooks.append(object)
+
+    sorted_playbooks = sorted(playbooks, key=lambda i: i['name'])
+
+    j2_env = Environment(loader=FileSystemLoader(TEMPLATE_PATH), # nosemgrep
+                             trim_blocks=False, autoescape=True)
+
+    # write markdown
+    template = j2_env.get_template('doc_playbooks_markdown.j2')
+    for playbook in sorted_playbooks:
+        file_name = playbook['name'].lower().replace(" ","_") + '.md'
+        output_path = path.join(OUTPUT_DIR + '/_playbooks/' + file_name)
+        output = template.render(playbook=playbook, detections=sorted_detections, time=datetime.datetime.now())
+        with open(output_path, 'w', encoding="utf-8") as f:
+            f.write(output)
+    messages.append("doc_gen.py wrote {0} playbook documentation in markdown to: {1}".format(len(sorted_playbooks),OUTPUT_DIR + '/_playbooks/'))
+
+    # write markdown detection page
+    template = j2_env.get_template('doc_playbooks_page_markdown.j2')
+    output_path = path.join(OUTPUT_DIR + '/_pages/playbooks.md')
+    output = template.render(playbooks=sorted_playbooks, detections=sorted_detections, time=datetime.datetime.now())
+    with open(output_path, 'w', encoding="utf-8") as f:
+        f.write(output)
+    messages.append("doc_gen.py wrote playbooks.md page to: {0}".format(output_path))
+
+    return sorted_playbooks, messages
+
+
+def generate_doc_index(OUTPUT_DIR, TEMPLATE_PATH, sorted_detections, sorted_stories, sorted_playbooks, messages, VERBOSE):
+
+    j2_env = Environment(loader=FileSystemLoader(TEMPLATE_PATH), # nosemgrep
+                             trim_blocks=False, autoescape=True)
+
+    # write index updated metrics
+    template = j2_env.get_template('doc_index_markdown.j2')
+    output_path = path.join(OUTPUT_DIR + '/index.markdown')
+    output = template.render(detection_count=len(sorted_detections), story_count=len(sorted_stories), playbook_count=len(sorted_playbooks))
+    with open(output_path, 'w', encoding="utf-8") as f:
+        f.write(output)
+    messages.append("doc_gen.py wrote site index page to: {0}".format(output_path))
+
+    return messages
+
 if __name__ == "__main__":

    # grab arguments
@@ -355,6 +427,8 @@ if __name__ == "__main__":
    messages = []
    sorted_detections, messages = generate_doc_detections(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, techniques, messages, VERBOSE)
    sorted_stories, messages = generate_doc_stories(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, techniques, sorted_detections, messages, VERBOSE)
+    sorted_playbooks, messages = generate_doc_playbooks(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, sorted_detections, messages, VERBOSE)
+    messages = generate_doc_index(OUTPUT_DIR, TEMPLATE_PATH, sorted_detections, sorted_stories, sorted_playbooks, messages, VERBOSE)

    # print all the messages from generation
    for m in messages:
@@ -67,7 +67,7 @@ def generate_transforms_conf(lookups, TEMPLATE_PATH, OUTPUT_PATH):
    utc_time = datetime.datetime.utcnow().replace(microsecond=0).isoformat()

    j2_env = Environment(loader=FileSystemLoader(TEMPLATE_PATH), # nosemgrep
-                         trim_blocks=True) 
+                         trim_blocks=True)
    template = j2_env.get_template('transforms.j2')
    output_path = path.join(OUTPUT_PATH, 'default/transforms.conf')
    output = template.render(lookups=sorted_lookups, time=utc_time)
@@ -230,7 +230,7 @@ def get_deployments(object, deployments):
    for deployment in deployments:

        for tag in object['tags'].keys():
-            
+
            if tag in deployment['tags'].keys():
                if type(object['tags'][tag]) is str:
                    tag_array = [object['tags'][tag]]
@@ -325,7 +325,7 @@ def add_annotations(detection):
    # changes to this data structure separate from the mappings generation
    # @todo expose the JSON data structure for newer risk type

-    annotation_keys = ['mitre_attack', 'kill_chain_phases', 'cis20', 'nist', 'analytic_story', 'observable', 'context', 'impact', 'confidence']
+    annotation_keys = ['mitre_attack', 'kill_chain_phases', 'cis20', 'nist', 'analytic_story', 'observable', 'context', 'impact', 'confidence', 'cve']
    savedsearch_annotations = {}
    for key in annotation_keys:
        if key == 'mitre_attack':
@@ -364,7 +364,7 @@ def add_rba(detection):

            # determine if is a user type, create risk
            if entity['type'].lower() in risk_object_user_types:
-                
+
                for r in entity['role']:
                    if 'attacker' == r.lower() or 'victim' ==r.lower():

@@ -376,10 +376,10 @@ def add_rba(detection):

            # determine if is a system type, create risk
            elif entity['type'].lower() in risk_object_system_types:
-                
+
                for r in entity['role']:
                    if 'attacker' == r.lower() or 'victim' ==r.lower():
-                        
+
                        risk_object['risk_object_type'] = 'system'
                        risk_object['risk_object_field'] = entity['name']
                        risk_object['risk_score'] = detection['tags']['risk_score']
@@ -393,12 +393,12 @@ def add_rba(detection):
                continue

    detection['risk'] = risk_objects
-    
+
    return detection

 def add_playbook(detection, playbooks):
    preface = " The following Splunk SOAR playbook can be used to respond to this detection: "
-    
+
    for playbook in playbooks:
        if detection['name'] in playbook['tags']['detections']:
            detection['how_to_implement'] = detection['how_to_implement'] + preface + playbook['name']
@@ -456,7 +456,7 @@ def prepare_detections(detections, deployments, playbooks, OUTPUT_PATH):
                    if key in detection['tags']:
                        mappings[key] = detection['tags'][key]
            detection['mappings'] = mappings
-            
+
            detection = add_annotations(detection)
            detection = add_rba(detection)
            detection = add_playbook(detection, playbooks)
@@ -698,7 +698,7 @@ if __name__ == "__main__":
    parser.add_argument("-v", "--verbose", required=False, default=False, action='store_true', help="prints verbose output")
    parser.add_argument("--product", required=True, default="ESCU", help="package type")

-    
+
    # parse them
    args = parser.parse_args()
    REPO_PATH = args.path
@@ -706,4 +706,4 @@ if __name__ == "__main__":
    VERBOSE = args.verbose
    PRODUCT = args.product

-    main(REPO_PATH, OUTPUT_PATH, PRODUCT, VERBOSE)
+    main(REPO_PATH, OUTPUT_PATH, PRODUCT, VERBOSE)
@@ -8,12 +8,12 @@ sidebar:
  nav: "detections"
 ---

-| Name    |   Technique |     Tactic   |        Type   |
-| ----------- | ----------- |--------------| --------------|
+| Name    | Technique | Type       |
+| --------| --------- |------------|
 {%- for detection in detections -%}
 {% if detection.mitre_attacks %}
-| [{{ detection.name }}](/{{ detection.kind }}/{{ detection.name | lower | replace(' ', '_') }}/) | {% for attack in detection.mitre_attacks -%} [{{ attack.technique }}](/tags/#{{ attack.technique | lower | replace(" ", "-") }}){% if not loop.last -%}, {% endif -%}{%- endfor %} | [{{ detection.mitre_attacks[0].tactic[0] }}](/tags/#{{ detection.mitre_attacks[0].tactic[0] | lower | replace(" ", "-") }}) | {{ detection.type }} |
+| [{{ detection.name }}](/{{ detection.kind }}/{{ detection.name | lower | replace(' ', '_') }}/) | {% for attack in detection.mitre_attacks -%} [{{ attack.technique }}](/tags/#{{ attack.technique | lower | replace(" ", "-") }}){% if not loop.last -%}, {% endif -%}{%- endfor %} | {{ detection.type }} |
 {%- else %}
-| [{{ detection.name }}]() | None | None | {{ detection.type }} |
+| [{{ detection.name }}]() | None | {{ detection.type }} |
 {%- endif -%}
 {%- endfor -%}
@@ -10,6 +10,7 @@ categories:
  - {{detection.kind|capitalize}}
 last_modified_at: {{detection.date}}
 toc: true
+toc_label: ""
 tags:
  - {{ detection.type }}
 {%- for attack in detection.mitre_attacks %}
@@ -22,6 +23,9 @@ tags:
 {%- for product in detection.tags.product %}
  - {{ product }}
 {%- endfor -%}
+{%- for cve in detection.cve %}
+  - {{ cve.id }}
+{%- endfor -%}
 {%- for datamodel in detection.datamodel %}
  - {{ datamodel }}
 {%- endfor -%}
@@ -49,20 +53,21 @@ We have not been able to test, simulate or build datasets for it, use at your ow
 - **ID**: {{ detection.id }}

 {% if detection.mitre_attacks %}
-#### ATT&CK
+#### [ATT&CK](https://attack.mitre.org/)

-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic      |
+| ----------- | ----------- | ----------- |
 {% for attack in detection.mitre_attacks -%}
 {% if attack.technique_id -%}
-{%- set sub_technique = attack.technique_id.split('.') -%}{%- if sub_technique | length > 1 -%}
+{% set sub_technique = attack.technique_id.split('.') -%}
+{% if sub_technique | length > 1 -%}
 | [{{ attack.technique_id }}](https://attack.mitre.org/techniques/{{sub_technique[0]}}/{{sub_technique[1]}}/) | {{ attack.technique }} | {{ attack.tactic|join(', ') }} |
-{%- else -%}
+{% else -%}
 | [{{ attack.technique_id }}](https://attack.mitre.org/techniques/{{attack.technique_id}}/) | {{ attack.technique }} | {{ attack.tactic|join(', ') }} |
 {% endif -%}
-{%- endif -%}
-{%- endfor %}
-{% endif %}
+{% endif -%}
+{% endfor %}
+{% endif -%}

 #### Search

@@ -91,14 +96,22 @@ We have not been able to test, simulate or build datasets for it, use at your ow
 #### Known False Positives
 {{ detection.known_false_positives}}

-
 {% if detection.tags.observable %}
 #### RBA

 | Risk Score  | Impact      | Confidence   | Message      |
 | ----------- | ----------- |--------------|--------------|
 | {{(detection.tags.impact * detection.tags.confidence)/100}} | {{ detection.tags.impact }} | {{ detection.tags.confidence }} | {{detection.tags.message}} |
+{% endif %}

+{% if detection.cve %}
+#### CVE
+
+| ID          | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
+| ----------- | ----------- | -------------- |
+{% for cve in detection.cve -%}
+| [{{ cve.id }}](https://nvd.nist.gov/vuln/detail/{{cve.id}}) | {{ cve.summary }} | {{ cve.cvss }} |
+{% endfor %}
 {% endif %}

 #### Reference
@@ -9,7 +9,7 @@ header:
  actions:
    - label: "Download"
      url: "https://splunkbase.splunk.com/app/3449/"
-excerpt: "Get the latest **FREE** Enterprise Security Content Update (ESCU) App with over 400+ detections for Splunk."
+excerpt: "Get the latest **FREE** Enterprise Security Content Update (ESCU) App with **{{ detection_count }}** detections for Splunk."
 feature_row:
  - image_path: /static/feature_detection.png
    alt: "customizable"
@@ -28,7 +28,7 @@ feature_row:
  - image_path: /static/feature_playbooks.png
    alt: "100% free"
    title: "Playbooks"
-    excerpt: "See all **2** sets of steps 🐾 to automatically response to a threat."
+    excerpt: "See all **{{ playbook_count }}** sets of steps 🐾 to automatically response to a threat."
    url: "/playbooks"
    btn_class: "btn--primary"
    btn_label: "Explore"
@@ -44,9 +44,9 @@ This project gives you access to our repository of Analytic Stories that are sec
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

 ## [Detection Coverage](https://mitremap.splunkresearch.com/) 🗺
-Below is a snapshot in time of what technique we currently have some detection coverage for. The darker the shade of blue the more detections we have for this particular technique. This map is automatically updated on every release and generated from the [generate-coverage-map.py](https://github.com/splunk/security_content/blob/develop/bin/generate-coverage-map.py).
+Below is a snapshot in time of what technique we currently have some detection coverage for. The darker the shade of blue the more detections we have for this particular technique.

-![](mitre-map/coverage.png)
+[![](mitre-map/coverage.png)](https://mitremap.splunkresearch.com/)

 ## View Our Content 🔎

@@ -37,3 +37,10 @@ stories:
      - title: {{ category }}
        url: /stories/{{ category | lower | replace(" ", "_") }}/
    {%- endfor %}
+playbooks:
+  - title: "Type"
+    children:
+      - title: "Response"
+        url: /tags/#response/
+      - title: "Investigation"
+        url: /tags/#investigation/
@@ -0,0 +1,57 @@
+---
+title: "{{playbook.name}}"
+last_modified_at: {{playbook.date}}
+toc: true
+toc_label: ""
+tags:
+  - {{ playbook.type }}
+{%- for product in playbook.tags.product %}
+  - {{ product }}
+{%- endfor -%}
+{%- for app in playbook.app_list %}
+  - {{ app }}
+{%- endfor %}
+---
+
+[Try in Splunk SOAR](https://www.splunk.com/en_us/software/splunk-security-orchestration-and-automation.html){: .btn .btn--success}
+
+#### Description
+
+{{ playbook.description }}
+
+- **Type**: {{ playbook.type }}
+- **Product**: {{ playbook.tags.product|join(', ') }}
+- **Apps**: {% for app in playbook.app_list %}[{{ app }}](https://splunkbase.splunk.com/apps/#/search/{{ app }}/product/soar){% if not loop.last %}, {% endif %}{%-endfor %}
+- **Last Updated**: {{ playbook.date }}
+- **Author**: {{playbook.author}}
+- **ID**: {{ playbook.id }}
+
+#### Associated Detections
+{% for detection in playbook.tags.detections -%}
+{% for d in detections -%}
+{% if d.name == detection -%}
+* [{{ detection }}](/detections/{{ d.type }}/{{detection|lower|replace(" ", "_")}})
+{% endif %}
+{% endfor %}
+{% endfor %}
+
+#### How To Implement
+{{ playbook.how_to_implement}}
+
+#### Playbooks
+![](https://raw.githubusercontent.com/splunk/security_content/develop/playbooks/{{ playbook.name | lower | replace(" ", "_")}}.png)
+
+#### Required field
+{% for field in playbook.tags.playbook_fields -%}
+* {{ field }}
+{% endfor %}
+
+#### Reference
+{% if playbook.references %}
+{% for reference in playbook.references -%}
+* [{{ reference }}]({{ reference }})
+{% endfor %}
+{% endif %}
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/playbooks/{{ playbook.name | lower | replace (" ", "_") }}.yml) \| *version*: **{{playbook.version}}**
@@ -0,0 +1,19 @@
+---
+title: "Playbooks"
+layout: collection
+author_profile: false
+permalink: /playbooks/
+classes: wide
+sidebar:
+  nav: "playbooks"
+---
+
+| Name    | Detections | Type        |
+| --------| ---------- | ----------- |
+{% for playbook in playbooks -%}
+{% if playbook.tags.detections -%}
+| [{{ playbook.name }}](/playbooks/{{ playbook.name|lower|replace(' ', '_') }}/)|{% for detection in playbook.tags.detections -%}{% for d in detections -%}{% if d.name == detection -%}[{{ detection }}](/detections/{{ d.type }}/{{detection|lower|replace(" ", "_")}}){% endif -%}{%- endfor -%}{%- endfor -%} | {{ playbook.type }} |
+{% else -%}
+| [{{ playbook.name }}](/playbooks/{{ playbook.name|lower|replace(' ', '_') }}/)| None | {{ playbook.type }} |
+{% endif -%}
+{%- endfor -%}
@@ -2,6 +2,7 @@
 title: "{{story.name}}"
 last_modified_at: {{story.date}}
 toc: true
+toc_label: ""
 tags:
 {%- for product in story.tags.product %}
  - {{ product }}
@@ -44,6 +44,7 @@ tags:
    of $expected_upper_threshold$ with the following command $command$.
  mitre_attack_id:
  - T1078.004
+  - T1078
  nist:
  - DE.DP
  - DE.CM
@@ -49,6 +49,7 @@ tags:
    command $command$.
  mitre_attack_id:
  - T1078.004
+  - T1078
  nist:
  - DE.DP
  - DE.CM
@@ -46,6 +46,7 @@ tags:
    in their account
  mitre_attack_id:
  - T1078.004
+  - T1078
  nist:
  - PR.DS
  - PR.AC
@@ -43,6 +43,7 @@ tags:
    from this IP $src$
  mitre_attack_id:
  - T1136.003
+  - T1136
  nist:
  - PR.DS
  - PR.AC
@@ -46,6 +46,7 @@ tags:
    and did a console login from this IP $src_ip$
  mitre_attack_id:
  - T1136.003
+  - T1136
  nist:
  - PR.DS
  - PR.AC
@@ -37,6 +37,7 @@ tags:
  message: Vulnerabilities with severity high found in image $image$
  mitre_attack_id:
  - T1204.003
+  - T1204
  nist:
  - PR.DS
  - PR.AC
@@ -36,6 +36,7 @@ tags:
  message: Vulnerabilities with severity high found in repository $repositoryName$
  mitre_attack_id:
  - T1204.003
+  - T1204
  nist:
  - PR.DS
  - PR.AC
@@ -35,6 +35,7 @@ tags:
  message: Vulnerabilities with severity high found in image $image$
  mitre_attack_id:
  - T1204.003
+  - T1204
  nist:
  - PR.DS
  - PR.AC
@@ -33,6 +33,7 @@ tags:
  message: Container uploaded outside business hours from $user$
  mitre_attack_id:
  - T1204.003
+  - T1204
  nist:
  - PR.DS
  - PR.AC
@@ -33,6 +33,7 @@ tags:
  message: Container uploaded from unknown user $user$
  mitre_attack_id:
  - T1204.003
+  - T1204
  nist:
  - PR.DS
  - PR.AC
@@ -42,6 +42,7 @@ tags:
  mitre_attack_id:
  - T1069.003
  - T1098
+  - T1069
  observable:
  - name: src
    type: IP Address
@@ -46,6 +46,7 @@ tags:
    CIDR $requestParameters.cidrBlock$
  mitre_attack_id:
  - T1562.007
+  - T1562
  nist:
  - DE.DP
  - DE.AE
@@ -41,6 +41,7 @@ tags:
    $eventName$), such that the instance is accessible from anywhere
  mitre_attack_id:
  - T1562.007
+  - T1562
  nist:
  - DE.DP
  - DE.AE
@@ -45,6 +45,7 @@ tags:
    event $eventName$ for updating the the default policy version
  mitre_attack_id:
  - T1078.004
+  - T1078
  nist:
  - PR.DS
  - PR.AC
@@ -39,6 +39,7 @@ tags:
    user $user_arn$ more access privilleges
  mitre_attack_id:
  - T1136.003
+  - T1136
  nist:
  - PR.DS
  - PR.AC
@@ -44,6 +44,7 @@ tags:
  message: User $user$ is creating a new instance $dest$ for the first time
  mitre_attack_id:
  - T1078.004
+  - T1078
  nist:
  - ID.AM
  observable:
@@ -44,6 +44,7 @@ tags:
  message: User $user$ is modifying an instance $dest$ for the first time.
  mitre_attack_id:
  - T1078.004
+  - T1078
  nist:
  - ID.AM
  observable:
@@ -27,6 +27,7 @@ tags:
  message: Correlation triggered for user $user$
  mitre_attack_id:
  - T1204.003
+  - T1204
  nist:
  - PR.DS
  - PR.AC
@@ -27,6 +27,7 @@ tags:
  message: Correlation triggered for user $user$
  mitre_attack_id:
  - T1204.003
+  - T1204
  nist:
  - PR.DS
  - PR.AC
@@ -23,7 +23,7 @@ references:
 - https://www.redhat.com/en/topics/devops/what-is-devsecops
 tags:
  analytic_story:
-  - DevSecOps
+  - Dev Sec Ops
  automated_detection_testing: passed
  confidence: 30
  context:
@@ -22,7 +22,7 @@ references:
 - https://www.redhat.com/en/topics/devops/what-is-devsecops
 tags:
  analytic_story:
-  - DevSecOps
+  - Dev Sec Ops
  automated_detection_testing: passed
  confidence: 30
  context:
@@ -33,6 +33,7 @@ tags:
  message: Vulnerabilities found in packages used by GitHub repository $repository$
  mitre_attack_id:
  - T1195.001
+  - T1195
  nist:
  - PR.DS
  - PR.AC
@@ -33,6 +33,7 @@ tags:
  message: Vulnerabilities found in packages used by GitHub repository $repository$
  mitre_attack_id:
  - T1195.001
+  - T1195
  nist:
  - PR.DS
  - PR.AC
@@ -19,14 +19,14 @@ search: '`gsuite_drive` NOT (email IN("", "null")) | rex field=parameters.owner
  | `gsuite_drive_share_in_external_email_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
  logs related to gsuite having the file attachment metadata like file type, file
-  extension, source email, destination email, num of attachment and etc.
+  extension, source email, destination email, num of attachment and etc. In order for the search to work for your environment, please edit the query to use your company specific email domain instead of `internal_test_email.com`.
 known_false_positives: network admin or normal user may share files to customer and
  external team.
 references:
 - https://www.redhat.com/en/topics/devops/what-is-devsecops
 tags:
  analytic_story:
-  - DevSecOps
+  - Dev Sec Ops
  confidence: 90
  context:
  - Source:Endpoint
@@ -41,11 +41,12 @@ tags:
  message: suspicious share gdrive from $parameters.owner$ to $email$ namely as $parameters.doc_title$
  mitre_attack_id:
  - T1567.002
+  - T1567
  observable:
  - name: parameters.owner
    type: User
    role:
-    - attacker
+    - Attacker
  - name: email
    type: User
    role:
@@ -66,3 +67,4 @@ tags:
  - parameters.doc_type
  risk_score: 72
  security_domain: endpoint
+
@@ -28,7 +28,7 @@ references:
 - https://www.redhat.com/en/topics/devops/what-is-devsecops
 tags:
  analytic_story:
-  - DevSecOps
+  - Dev Sec Ops
  confidence: 70
  context:
  - Source:Endpoint
@@ -41,6 +41,7 @@ tags:
  message: suspicious email from $source.address$ to $destination{}.address$
  mitre_attack_id:
  - T1566.001
+  - T1566
  observable:
  - name: source.address
    type: User
@@ -35,7 +35,7 @@ references:
 - https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-top-spear-phishing-words.pdf
 tags:
  analytic_story:
-  - DevSecOps
+  - Dev Sec Ops
  automated_detection_testing: passed
  confidence: 50
  context:
@@ -49,6 +49,7 @@ tags:
  message: suspicious email from $source.address$ to $destination{}.address$
  mitre_attack_id:
  - T1566.001
+  - T1566
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
@@ -26,7 +26,7 @@ references:
 - https://news.sophos.com/en-us/2021/07/22/malware-increasingly-targets-discord-for-abuse/
 tags:
  analytic_story:
-  - DevSecOps
+  - Dev Sec Ops
  automated_detection_testing: passed
  confidence: 50
  context:
@@ -40,6 +40,7 @@ tags:
  message: suspicious email from $source.address$ to $destination{}.address$
  mitre_attack_id:
  - T1566.001
+  - T1566
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
@@ -27,7 +27,7 @@ references:
 - https://www.redhat.com/en/topics/devops/what-is-devsecops
 tags:
  analytic_story:
-  - DevSecOps
+  - Dev Sec Ops
  confidence: 30
  context:
  - Source:Endpoint
@@ -40,6 +40,7 @@ tags:
  message: suspicious email from $source.address$ to $destination{}.address$
  mitre_attack_id:
  - T1048.003
+  - T1048
  observable:
  - name: source.address
    type: User
@@ -24,7 +24,7 @@ search: '`gsuite_drive` parameters.owner_is_team_drive=false "parameters.doc_tit
  | `gsuite_suspicious_shared_file_name_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
  logs related to gsuite having the file attachment metadata like file type, file
-  extension, source email, destination email, num of attachment and etc.
+  extension, source email, destination email, num of attachment and etc. In order for the search to work for your environment, please edit the query to use your company specific email domain instead of `internal_test_email.com`.
 known_false_positives: normal user or normal transaction may contain the subject and
  file type attachment that this detection try to search
 references:
@@ -32,7 +32,7 @@ references:
 - https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-top-spear-phishing-words.pdf
 tags:
  analytic_story:
-  - DevSecOps
+  - Dev Sec Ops
  automated_detection_testing: passed
  confidence: 70
  context:
@@ -46,6 +46,7 @@ tags:
  message: suspicious share gdrive from $parameters.owner$ to $email$ namely as $parameters.doc_title$
  mitre_attack_id:
  - T1566.001
+  - T1566
  observable:
  - name: parameters.owner
    type: User
@@ -41,6 +41,7 @@ tags:
    Address $ActorIpAddress$
  mitre_attack_id:
  - T1136.003
+  - T1136
  observable:
  - name: ActorIpAddress
    type: IP Address
@@ -44,6 +44,7 @@ tags:
    service principal credentials from IP Address $ActorIpAddress$
  mitre_attack_id:
  - T1136.003
+  - T1136
  observable:
  - name: ActorIpAddress
    type: IP Address
@@ -45,6 +45,7 @@ tags:
    list of trusted IPs to bypass MFA
  mitre_attack_id:
  - T1562.007
+  - T1562
  observable:
  - name: ip_addresses_new_added
    type: IP Address
@@ -44,6 +44,7 @@ tags:
    $OrganizationName$
  mitre_attack_id:
  - T1136.003
+  - T1136
  observable:
  - name: OrganizationName
    type: Other
@@ -39,6 +39,7 @@ tags:
    the same destination $ForwardingAddress$
  mitre_attack_id:
  - T1114.003
+  - T1114
  nist:
  - DE.DP
  - DE.AE
@@ -38,6 +38,7 @@ tags:
    that allow access to sensitive
  mitre_attack_id:
  - T1114.002
+  - T1114
  nist:
  - DE.DP
  - DE.AE
@@ -39,6 +39,7 @@ tags:
    a forwarding rule to same destination $ForwardingSmtpAddress$
  mitre_attack_id:
  - T1114.003
+  - T1114
  nist:
  - DE.DP
  - DE.AE
@@ -35,3 +35,5 @@ tags:
  required_fields:
  - _time
  security_domain: network
+  cve:
+  - CVE-2016-4859
@@ -36,3 +36,5 @@ tags:
  required_fields:
  - _time
  security_domain: endpoint
+  cve:
+  - CVE-2017-5753
@@ -42,3 +42,6 @@ tags:
  required_fields:
  - _time
  security_domain: network
+  cve:
+  - CVE-2018-11409
+ 
@@ -44,6 +44,7 @@ tags:
    $dest$
  mitre_attack_id:
  - T1560.001
+  - T1560
  observable:
  - name: dest
    type: Hostname
@@ -43,6 +43,7 @@ tags:
    Service (LSASS).
  mitre_attack_id:
  - T1003.001
+  - T1003
  nist:
  - DE.CM
  observable:
@@ -47,6 +47,7 @@ tags:
  message: Suspicious $process_name$ usage detected on endpoint $dest$ by user $user$.
  mitre_attack_id:
  - T1087.002
+  - T1087
  observable:
  - name: user
    type: User
@@ -0,0 +1,71 @@
+name: Active Setup Registry Autostart
+id: f64579c0-203f-11ec-abcc-acde48001122
+version: 1
+date: '2021-09-28'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic is to detect a suspicious modification of the active setup
+  registry for persistence and privilege escalation. This technique was seen in several
+  malware (poisonIvy), adware and APT to gain persistence to the compromised machine
+  upon boot up. This TTP is a good indicator to further check the process id that
+  do the modification since modification of this registry is not commonly done. check
+  the legitimacy of the file and process involve in this rules to check if it is a
+  valid setup installer that creating or modifying this registry.
+search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime
+  max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_value_name
+  = "StubPath" Registry.registry_key_name = "*\\SOFTWARE\\Microsoft\\Active Setup\\Installed
+  Components*" by Registry.dest  Registry.user Registry.registry_path Registry.registry_key_name
+  Registry.registry_value_name | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`
+  | `drop_dm_object_name(Registry)` | `active_setup_registry_autostart_filter`'
+how_to_implement: To successfully implement this search, you must be ingesting data
+  that records registry activity from your hosts to populate the endpoint data model
+  in the registry node. This is typically populated via endpoint detection-and-response
+  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
+  used for this search is typically generated via logs that report reads and writes
+  to the registry.
+known_false_positives: Active setup installer may add or modify this registry.
+references:
+- https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor%3aWin32%2fPoisonivy.E
+- https://attack.mitre.org/techniques/T1547/014/
+tags:
+  analytic_story:
+  - Windows Persistence Techniques
+  - Windows Privilege Escalation
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/t1547.014/active_setup_stubpath/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1547.014
+  - T1547
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.dest
+  - Registry.user
+  - Registry.registry_path
+  - Registry.registry_key_name
+  - Registry.registry_value_name
+  security_domain: endpoint
+  impact: 80
+  confidence: 80
+  risk_score: 64
+  context:
+  - source:endpoint
+  - stage:Privilege Escalation Persistence
+  message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: user
+    role:
+    - Victim
+  automated_detection_testing: passed
@@ -42,6 +42,7 @@ tags:
    to prepare autoadminlogon
  mitre_attack_id:
  - T1552.002
+  - T1552
  observable:
  - name: dest
    type: Endpoint
@@ -38,6 +38,7 @@ tags:
  message: powershell process having commandline $Message$ for user enumeration
  mitre_attack_id:
  - T1087.002
+  - T1087
  observable:
  - name: ComputerName
    type: Hostname
@@ -36,6 +36,7 @@ tags:
  - Exploitation
  mitre_attack_id:
  - T1562.007
+  - T1562
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
@@ -42,6 +42,7 @@ tags:
    $dest$ by user $user$.
  mitre_attack_id:
  - T1021.001
+  - T1021
  observable:
  - name: user
    type: User
@@ -38,6 +38,7 @@ tags:
    user $user$.
  mitre_attack_id:
  - T1021.001
+  - T1021
  observable:
  - name: user
    type: User
@@ -38,6 +38,7 @@ tags:
  - Exploitation
  mitre_attack_id:
  - T1562.007
+  - T1562
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
@@ -47,6 +47,7 @@ tags:
    of 7zip.
  mitre_attack_id:
  - T1560.001
+  - T1560
  observable:
  - name: user
    type: User
@@ -47,6 +47,7 @@ tags:
    on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadFile
    within PowerShell.
  mitre_attack_id:
+  - T1059
  - T1059.001
  observable:
  - name: user
@@ -44,6 +44,7 @@ tags:
    on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadString
    within PowerShell.
  mitre_attack_id:
+  - T1059
  - T1059.001
  observable:
  - name: user
@@ -51,8 +51,9 @@ tags:
    on host $dest$ by User $user$. This process $process_name$ is known to do- $description$
  mitre_attack_id:
  - T1036.005
-  - T1595
+  - T1036
  - T1003
+  - T1595
  nist:
  - ID.AM
  - PR.DS
@@ -46,6 +46,7 @@ tags:
    attempting to add a certificate to the store on endpoint $dest$ by user $user$.
  mitre_attack_id:
  - T1553.004
+  - T1553
  nist:
  - PR.PT
  - DE.CM
@@ -49,6 +49,7 @@ tags:
    attempting to disable security services on endpoint $dest$ by user $user$.
  mitre_attack_id:
  - T1562.001
+  - T1562
  nist:
  - PR.PT
  - DE.CM
@@ -47,6 +47,7 @@ tags:
    on endpoint $dest$ by user $user$ attempting to export the registry keys.
  mitre_attack_id:
  - T1003.002
+  - T1003
  nist:
  - DE.CM
  observable:
@@ -42,6 +42,7 @@ tags:
    to prepare autoadminlogon
  mitre_attack_id:
  - T1552.002
+  - T1552
  observable:
  - name: dest
    type: Endpoint
@@ -50,6 +50,7 @@ tags:
  message: A file - $file_name$ was written to system32 has occurred on endpoint $dest$
    by user $user$.
  mitre_attack_id:
+  - T1204
  - T1204.002
  nist:
  - PR.PT
@@ -0,0 +1,68 @@
+name: Change Default File Association
+id: 462d17d8-1f71-11ec-ad07-acde48001122
+version: 1
+date: '2021-09-27'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic is developed to detect suspicious registry modification
+  to change the default file association of windows to malicious payload. This techninique
+  was seen in some APT where it modify the default process to run file association,
+  like .txt to notepad.exe. Instead notepad.exe it will point to a Script or other
+  payload that will load malicious command to the compromised host.
+search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime
+  max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path
+  ="*\\shell\\open\\command\\*" Registry.registry_path = "*HKCR\\*" by Registry.dest  Registry.user
+  Registry.registry_path Registry.registry_key_name Registry.registry_value_name |
+  `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)`
+  | `change_default_file_association_filter`'
+how_to_implement: To successfully implement this search, you must be ingesting data
+  that records registry activity from your hosts to populate the endpoint data model
+  in the registry node. This is typically populated via endpoint detection-and-response
+  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
+  used for this search is typically generated via logs that report reads and writes
+  to the registry.
+known_false_positives: unknown
+references:
+- https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/privilege-escalation/untitled-3/accessibility-features
+tags:
+  analytic_story:
+  - Windows Persistence Techniques
+  - Windows Privilege Escalation
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.001/txtfile_reg/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1546.001
+  - T1546
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.dest
+  - Registry.user
+  - Registry.registry_path
+  - Registry.registry_key_name
+  - Registry.registry_value_name
+  security_domain: endpoint
+  impact: 80
+  confidence: 100
+  risk_score: 80
+  context:
+  - source:endpoint
+  - stage:Privilege Escalation Persistence
+  message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: user
+    role:
+    - Victim
+  automated_detection_testing: passed
@@ -40,6 +40,7 @@ tags:
    of a specific disk.
  mitre_attack_id:
  - T1070.004
+  - T1070
  observable:
  - name: user
    type: User
@@ -44,8 +44,10 @@ tags:
    on endpoint $dest$ by user $user$ potentially performing privilege escalation
    using named pipes related to Cobalt Strike and other frameworks.
  mitre_attack_id:
+  - T1059
  - T1059.003
  - T1543.003
+  - T1543
  observable:
  - name: user
    type: User
@@ -44,6 +44,7 @@ tags:
  message: parent process name $parent_process_name$ with child process $process_name$
    to execute commandline tool in $dest$
  mitre_attack_id:
+  - T1059
  - T1059.007
  observable:
  - name: dest
@@ -38,6 +38,7 @@ tags:
  message: The following module $ImageLoaded$ was loaded by a non-standard application
    on endpoint $Computer$ by user $user$.
  mitre_attack_id:
+  - T1218
  - T1218.003
  observable:
  - name: user
@@ -47,6 +47,7 @@ tags:
  message: An instance of $parent_process_name$ spawning $process_name$ was identified
    on endpoint $dest$ by user $user$ attempting to load a suspicious file from disk.
  mitre_attack_id:
+  - T1218
  - T1218.002
  observable:
  - name: user
@@ -83,3 +84,5 @@ tags:
  - Processes.parent_process_id
  risk_score: 80
  security_domain: endpoint
+  cve:
+  - CVE-2021-40444
@@ -46,6 +46,7 @@ tags:
    group.
  mitre_attack_id:
  - T1136.001
+  - T1136
  nist:
  - PR.PT
  - DE.CM
@@ -42,6 +42,7 @@ tags:
  message: An instance of $parent_process_name$ spawning $process_name$ was identified
    on endpoint $dest$ by user $user$ enumerating Windows file shares.
  mitre_attack_id:
+  - T1070
  - T1070.005
  nist:
  - PR.PT
@@ -41,6 +41,7 @@ tags:
    behavior is indicative of credential dumping and should be investigated.
  mitre_attack_id:
  - T1003.001
+  - T1003
  nist:
  - DE.CM
  observable:
@@ -36,6 +36,7 @@ tags:
  message: A service $Service_File_Name$ was created from a non-standard path using
    $Service_Name$, potentially leading to a privilege escalation.
  mitre_attack_id:
+  - T1569
  - T1569.002
  observable:
  - name: Service_File_Name
@@ -47,6 +47,7 @@ tags:
    to disk. This behavior is related to dumping credentials via Task Manager.
  mitre_attack_id:
  - T1003.001
+  - T1003
  nist:
  - DE.CM
  observable:
@@ -45,6 +45,7 @@ tags:
    offline password cracking.
  mitre_attack_id:
  - T1003.003
+  - T1003
  nist:
  - DE.CM
  observable:
@@ -43,6 +43,7 @@ tags:
    offline password cracking.
  mitre_attack_id:
  - T1003.003
+  - T1003
  nist:
  - DE.CM
  observable:
@@ -45,6 +45,7 @@ tags:
    password cracking.
  mitre_attack_id:
  - T1003.003
+  - T1003
  nist:
  - DE.CM
  observable:
@@ -43,6 +43,7 @@ tags:
    to grab credentials.
  mitre_attack_id:
  - T1003.003
+  - T1003
  nist:
  - DE.CM
  observable:
@@ -38,6 +38,7 @@ tags:
  message: The following $EventCode$ occurred on $dest$ by $user$ with Logon Type
    3, which may be indicative of the pass the hash technique.
  mitre_attack_id:
+  - T1550
  - T1550.002
  nist:
  - PR.PT
@@ -42,10 +42,12 @@ tags:
    on endpoint $dest$ by user $user$ using AzureHound to enumerate AzureAD.
  mitre_attack_id:
  - T1087.002
-  - T1087.001
-  - T1482
-  - T1069.002
  - T1069.001
+  - T1482
+  - T1087.001
+  - T1087
+  - T1069.002
+  - T1069
  observable:
  - name: user
    type: User
@@ -45,10 +45,12 @@ tags:
    a AzureAD enumeration utility, has occurred on endpoint $dest$ by user $user$.
  mitre_attack_id:
  - T1087.002
-  - T1087.001
-  - T1482
-  - T1069.002
  - T1069.001
+  - T1482
+  - T1087.001
+  - T1087
+  - T1069.002
+  - T1069
  observable:
  - name: user
    type: User
@@ -67,3 +67,5 @@ tags:
  - user
  risk_score: 49
  security_domain: endpoint
+  cve:
+  - CVE-2020-1472
@@ -49,6 +49,7 @@ tags:
    $ComputerName$ by user $user$.
  mitre_attack_id:
  - T1003.002
+  - T1003
  observable:
  - name: user
    type: User
@@ -71,3 +72,5 @@ tags:
  - EventCode
  risk_score: 80
  security_domain: endpoint
+  cve:
+  - CVE-2021-36934
@@ -47,6 +47,7 @@ tags:
    investigated.
  mitre_attack_id:
  - T1003.001
+  - T1003
  nist:
  - PR.IP
  - PR.AC
@@ -51,6 +51,7 @@ tags:
  message: The following behavior was identified and typically related to PowerShell-Empire
    on $ComputerName$ by $User$.
  mitre_attack_id:
+  - T1059
  - T1059.001
  observable:
  - name: User
@@ -49,6 +49,7 @@ tags:
  message: Multiple accounts have been locked out. Review $dest$ and results related
    to $user$.
  mitre_attack_id:
+  - T1078
  - T1078.002
  nist:
  - PR.IP
@@ -38,6 +38,7 @@ tags:
  message: Multiple accounts have been locked out. Review $nodename$ and $result$
    related to $user$.
  mitre_attack_id:
+  - T1078
  - T1078.003
  nist:
  - PR.IP
@@ -65,6 +65,7 @@ tags:
    previously performed by HAFNIUM. Review further file modifications on endpoint
    $dest$ by user $user$.
  mitre_attack_id:
+  - T1505
  - T1505.003
  observable:
  - name: user
@@ -53,6 +53,7 @@ tags:
  message: The following $process_name$ has been identified as renamed, spawning from
    $parent_process_name$.
  mitre_attack_id:
+  - T1218
  - T1218.001
  nist:
  - PR.PT
@@ -53,6 +53,7 @@ tags:
    on endpoint $dest$ by user $user$ spawning a child process, typically not normal
    behavior.
  mitre_attack_id:
+  - T1218
  - T1218.001
  nist:
  - PR.PT
@@ -57,6 +57,7 @@ tags:
    on endpoint $dest$ by user $user$ contacting a remote destination to potentally
    download a malicious payload.
  mitre_attack_id:
+  - T1218
  - T1218.001
  nist:
  - PR.PT
@@ -58,6 +58,7 @@ tags:
  message: $process_name$ has been identified using Infotech Storage Handlers to load
    a specific file within a CHM on $dest$ under user $user$.
  mitre_attack_id:
+  - T1218
  - T1218.001
  nist:
  - PR.PT
@@ -48,6 +48,7 @@ tags:
    to credential dumping on $Computer$. Review for further details.
  mitre_attack_id:
  - T1003.001
+  - T1003
  nist:
  - DE.AE
  - DE.CM
--- a/Show More
+++ b/Show More