From df85ff33adfc0d846513b9ebe82ca7acdb555c70 Mon Sep 17 00:00:00 2001 From: research bot Date: Thu, 29 Jul 2021 21:15:45 +0000 Subject: [PATCH] updating docs and package bits [ci skip] --- ...s_security_hub_alerts_for_ec2_instance.yml | 2 +- dist/escu/default/analytic_stories.conf | 2 +- dist/escu/default/analyticstories.conf | 4 +- dist/escu/default/app.conf | 2 +- dist/escu/default/collections.conf | 2 +- dist/escu/default/macros.conf | 2 +- dist/escu/default/savedsearches.conf | 1722 ++++------------- dist/escu/default/transforms.conf | 2 +- dist/escu/default/use_case_library.conf | 4 +- dist/saaws/default/analytic_stories.conf | 4 +- dist/saaws/default/analyticstories.conf | 4 +- dist/saaws/default/app.conf | 2 +- dist/saaws/default/collections.conf | 2 +- dist/saaws/default/macros.conf | 2 +- dist/saaws/default/savedsearches.conf | 259 +-- dist/saaws/default/transforms.conf | 2 +- dist/saaws/default/use_case_library.conf | 4 +- docs/detections.wiki | 2 +- docs/stories.wiki | 2 +- 19 files changed, 408 insertions(+), 1617 deletions(-) diff --git a/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml b/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml index 17af3e1803..f773df9d50 100644 --- a/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml +++ b/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml @@ -34,7 +34,7 @@ tags: dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/security_hub_ec2_spike/security_hub_ec2_spike.json impact: 30 - message: Spike in AWS security Hub alerts with title $Title$ for EC2 instance $dest$ + message: Spike in AWS security Hub alerts with title $Title$ for EC2 instance $dest$ nist: - DE.DP observable: diff --git a/dist/escu/default/analytic_stories.conf b/dist/escu/default/analytic_stories.conf index 0015bb3c13..d2afe1ff01 100644 --- a/dist/escu/default/analytic_stories.conf +++ b/dist/escu/default/analytic_stories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-28T20:05:49 UTC +# On Date: 2021-07-29T20:53:17 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/analyticstories.conf b/dist/escu/default/analyticstories.conf index 5f39a02620..bb9d1d57fb 100644 --- a/dist/escu/default/analyticstories.conf +++ b/dist/escu/default/analyticstories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-28T20:05:49 UTC +# On Date: 2021-07-29T20:53:17 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -2950,7 +2950,7 @@ asset_type = AWS Instance confidence = medium explanation = This search looks for a spike in number of of AWS security Hub alerts for an EC2 instance in 4 hours intervals how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security Hub inputs. The threshold_value should be tuned to your environment and schedule these searches according to the bucket span interval. -annotations = {"cis20": ["CIS 13"], "nist": ["DE.DP", "DE.AE"]} +annotations = {"cis20": ["CIS 13"], "nist": ["DE.DP"]} known_false_positives = None providing_technologies = [] diff --git a/dist/escu/default/app.conf b/dist/escu/default/app.conf index 4ea1308b60..0143fd84da 100644 --- a/dist/escu/default/app.conf +++ b/dist/escu/default/app.conf @@ -4,7 +4,7 @@ is_configured = false state = enabled state_change_requires_restart = false -build = 35181 +build = 35236 [triggers] reload.analytic_stories = simple diff --git a/dist/escu/default/collections.conf b/dist/escu/default/collections.conf index 2e6e10cfbe..2d8a2f162a 100644 --- a/dist/escu/default/collections.conf +++ b/dist/escu/default/collections.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-28T20:05:49 UTC +# On Date: 2021-07-29T20:53:17 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/macros.conf b/dist/escu/default/macros.conf index 68fc847208..e1cc5f3d30 100644 --- a/dist/escu/default/macros.conf +++ b/dist/escu/default/macros.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-28T20:05:49 UTC +# On Date: 2021-07-29T20:53:17 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/savedsearches.conf b/dist/escu/default/savedsearches.conf index 5671705689..a568e330cf 100644 --- a/dist/escu/default/savedsearches.conf +++ b/dist/escu/default/savedsearches.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-28T20:05:49 UTC +# On Date: 2021-07-29T20:53:17 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -26,9 +26,6 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS Suspicious Provisioning Activities"] action.risk = 1 -action.risk.param._risk_object = -action.risk.param._risk_object_type = -action.risk.param._risk_score = 25 action.risk.param._risk_message = action.risk.param._risk = [] action.risk.param.verbose = 0 @@ -200,11 +197,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS IAM Privilege Escalation"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 49 action.risk.param._risk_message = User $user$ created a policy version that allows them to access any resource in their account -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49, "threat_object_field": "user", "threat_object_type": "user"}] +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -242,11 +236,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS IAM Privilege Escalation"] action.risk = 1 -action.risk.param._risk_object = user_arn -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 63 action.risk.param._risk_message = User $user_arn$ is attempting to create access keys for $requestParameters.userName$ from this IP $src$ -action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 63, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 63, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 63, "threat_object_field": "user_arn", "threat_object_type": "user"}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 63, "threat_object_field": "user_arn", "threat_object_type": "user"}] +action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 63}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 63}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -284,11 +275,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS IAM Privilege Escalation"] action.risk = 1 -action.risk.param._risk_object = user_arn -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 72 action.risk.param._risk_message = User $user_arn$ is attempting to create a login profile for $requestParameters.userName$ and did a console login from this IP $src_ip$ -action.risk.param._risk = [{"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 72, "threat_object_field": "src_ip", "threat_object_type": "ip address"}, {"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 72, "threat_object_field": "src_ip", "threat_object_type": "ip address"}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 72, "threat_object_field": "user_arn", "threat_object_type": "user"}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 72, "threat_object_field": "user_arn", "threat_object_type": "user"}] +action.risk.param._risk = [{"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 72}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 72}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -326,9 +314,6 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Cloud Authentication Activities"] action.risk = 1 -action.risk.param._risk_object = -action.risk.param._risk_object_type = -action.risk.param._risk_score = 15 action.risk.param._risk_message = AWS account $requestingAccountId$ is trying to access resource from some other account $requestedAccountId$, for the first time. action.risk.param._risk = [{"threat_object_field": "requestingAccountId", "threat_object_type": "other"}, {"threat_object_field": "requestedAccountId", "threat_object_type": "other"}] action.risk.param.verbose = 0 @@ -368,11 +353,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Ransomware Cloud"] action.risk = 1 -action.risk.param._risk_object = userIdentity.principalId -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 25 action.risk.param._risk_message = AWS account is potentially compromised and user $userIdentity.principalId$ is trying to compromise other accounts. -action.risk.param._risk = [{"risk_object_field": "userIdentity.principalId", "risk_object_type": "user", "risk_score": 25, "threat_object_field": "userIdentity.principalId", "threat_object_type": "user"}, {"risk_object_field": "userIdentity.principalId", "risk_object_type": "user", "risk_score": 25, "threat_object_field": "userIdentity.principalId", "threat_object_type": "user"}] +action.risk.param._risk = [{"risk_object_field": "userIdentity.principalId", "risk_object_type": "user", "risk_score": 25}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -410,11 +392,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Ransomware Cloud"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 15 action.risk.param._risk_message = User $user$ with KMS keys is performing encryption, against S3 buckets on these files $dest_file$ -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15, "threat_object_field": "user", "threat_object_type": "user"}, {"threat_object_field": "dest_file", "threat_object_type": "file"}] +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15}, {"threat_object_field": "dest_file", "threat_object_type": "file"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -492,11 +471,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS User Monitoring"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 18 action.risk.param._risk_message = user $user$ has excessive number of api calls $dc_events$ from these IP addresses $src$, violating the threshold of 50, using the following commands $command$. -action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 18, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 18, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18, "threat_object_field": "user", "threat_object_type": "user"}] +action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 18}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -534,11 +510,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Cloud User Activities"] action.risk = 1 -action.risk.param._risk_object = userIdentity.arn -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 10 action.risk.param._risk_message = User $userIdentity.arn$ is seen to perform excessive number of discovery related api calls- $failures$, within an hour where the access was denied. -action.risk.param._risk = [{"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 10, "threat_object_field": "src_ip", "threat_object_type": "ip address"}, {"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 10, "threat_object_field": "src_ip", "threat_object_type": "ip address"}, {"risk_object_field": "userIdentity.arn", "risk_object_type": "user", "risk_score": 10, "threat_object_field": "userIdentity.arn", "threat_object_type": "user"}, {"risk_object_field": "userIdentity.arn", "risk_object_type": "user", "risk_score": 10, "threat_object_field": "userIdentity.arn", "threat_object_type": "user"}] +action.risk.param._risk = [{"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 10}, {"risk_object_field": "userIdentity.arn", "risk_object_type": "user", "risk_score": 10}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -576,11 +549,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS IAM Privilege Escalation"] action.risk = 1 -action.risk.param._risk_object = user_arn -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 28 action.risk.param._risk_message = User $user_arn$ has caused multiple failures with errorCode $errorCode$, which potentially means adversary is attempting to identify a role name. -action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 28, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 28, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 28}] +action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 28}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -618,11 +588,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS IAM Privilege Escalation"] action.risk = 1 -action.risk.param._risk_object = user_arn -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 10 action.risk.param._risk_message = User $user_arn$ has deleted AWS Policies from IP address $src$ by executing the following command $eventName$ -action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 10, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 10, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 10}] +action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 10}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -660,11 +627,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS IAM Privilege Escalation"] action.risk = 1 -action.risk.param._risk_object = group_name -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 5 action.risk.param._risk_message = User $user_arn$ has had mulitple failures while attempting to delete groups from $src$ -action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 5, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 5, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 5}, {"risk_object_field": "group_name", "risk_object_type": "user", "risk_score": 5}] +action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 5}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -702,11 +666,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS IAM Privilege Escalation"] action.risk = 1 -action.risk.param._risk_object = group_deleted -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 5 action.risk.param._risk_message = User $user_arn$ has sucessfully deleted mulitple groups $group_deleted$ from $src$ -action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 5, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 5, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 5}, {"risk_object_field": "group_deleted", "risk_object_type": "user", "risk_score": 5}] +action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 5}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -744,11 +705,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS Network ACL Activity"] action.risk = 1 -action.risk.param._risk_object = requestParameters.cidrBlock -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 48 action.risk.param._risk_message = User $user_arn$ has created network ACLs with all the ports open to a specified CIDR $requestParameters.cidrBlock$ -action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 48, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 48, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "userName", "risk_object_type": "user", "risk_score": 48}, {"risk_object_field": "requestParameters.cidrBlock", "risk_object_type": "system", "risk_score": 48}] +action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 48}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -786,11 +744,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS Network ACL Activity"] action.risk = 1 -action.risk.param._risk_object = user_arn -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 5 action.risk.param._risk_message = User $user_arn$ from $src$ has sucessfully deleted network ACLs entry (eventName= $eventName$), such that the instance is accessible from anywhere -action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 5, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 5, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 5}] +action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 5}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -828,11 +783,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Cloud Federated Credential Abuse"] action.risk = 1 -action.risk.param._risk_object = sourceIPAddress -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 64 action.risk.param._risk_message = From IP address $sourceIPAddress$, user agent $userAgent$ has trigged an event $eventName$ for account ID $recipientAccountId$ -action.risk.param._risk = [{"risk_object_field": "sourceIPAddress", "risk_object_type": "system", "risk_score": 64, "threat_object_field": "sourceIPAddress", "threat_object_type": "ip address"}, {"risk_object_field": "sourceIPAddress", "risk_object_type": "system", "risk_score": 64, "threat_object_field": "sourceIPAddress", "threat_object_type": "ip address"}, {"threat_object_field": "recipientAccountId", "threat_object_type": "other"}] +action.risk.param._risk = [{"risk_object_field": "sourceIPAddress", "risk_object_type": "system", "risk_score": 64}, {"threat_object_field": "recipientAccountId", "threat_object_type": "other"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -870,11 +822,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Cloud Federated Credential Abuse"] action.risk = 1 -action.risk.param._risk_object = userIdentity.principalId -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 64 action.risk.param._risk_message = User $userIdentity.principalId$ from IP address $sourceIPAddress$ has trigged an event $eventName$ to update the SAML provider to $requestParameters.sAMLProviderArn$ -action.risk.param._risk = [{"risk_object_field": "sourceIPAddress", "risk_object_type": "system", "risk_score": 64, "threat_object_field": "sourceIPAddress", "threat_object_type": "ip address"}, {"risk_object_field": "sourceIPAddress", "risk_object_type": "system", "risk_score": 64, "threat_object_field": "sourceIPAddress", "threat_object_type": "ip address"}, {"risk_object_field": "userIdentity.principalId", "risk_object_type": "user", "risk_score": 64}] +action.risk.param._risk = [{"risk_object_field": "sourceIPAddress", "risk_object_type": "system", "risk_score": 64}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -912,11 +861,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS IAM Privilege Escalation"] action.risk = 1 -action.risk.param._risk_object = user_arn -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 30 action.risk.param._risk_message = From IP address $sourceIPAddress$, user agent $userAgent$ has trigged an event $eventName$ for updating the the default policy version -action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 30, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 30, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 30}] +action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 30}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -954,11 +900,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS IAM Privilege Escalation"] action.risk = 1 -action.risk.param._risk_object = user_arn -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 30 action.risk.param._risk_message = From IP address $sourceIPAddress$, user agent $userAgent$ has trigged an event $eventName$ for updating the existing login profile, potentially giving user $user_arn$ more access privilleges -action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 30, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 30, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 30}] +action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 30}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -996,9 +939,6 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS Cryptomining", "Suspicious AWS EC2 Activities"] action.risk = 1 -action.risk.param._risk_object = -action.risk.param._risk_object_type = -action.risk.param._risk_score = 40 action.risk.param._risk_message = action.risk.param._risk = [] action.risk.param.verbose = 0 @@ -1043,9 +983,6 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS Cryptomining", "Suspicious AWS EC2 Activities"] action.risk = 1 -action.risk.param._risk_object = -action.risk.param._risk_object_type = -action.risk.param._risk_score = 10 action.risk.param._risk_message = action.risk.param._risk = [] action.risk.param.verbose = 0 @@ -1172,11 +1109,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Cloud User Activities"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 15 action.risk.param._risk_message = user $user$ has made $api_calls$ api calls, violating the dynamic threshold of $expected_upper_threshold$ with the following command $command$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15, "threat_object_field": "user", "threat_object_type": "user"}] +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1214,9 +1148,6 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Cloud Instance Activities"] action.risk = 1 -action.risk.param._risk_object = -action.risk.param._risk_object_type = -action.risk.param._risk_score = 10 action.risk.param._risk_message = action.risk.param._risk = [] action.risk.param.verbose = 0 @@ -1256,9 +1187,6 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Cloud Cryptomining", "Suspicious Cloud Instance Activities"] action.risk = 1 -action.risk.param._risk_object = -action.risk.param._risk_object_type = -action.risk.param._risk_score = 40 action.risk.param._risk_message = action.risk.param._risk = [] action.risk.param.verbose = 0 @@ -1298,11 +1226,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Cloud User Activities"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 15 action.risk.param._risk_message = user $user$ has made $api_calls$ api calls related to security groups, violating the dynamic threshold of $expected_upper_threshold$ with the following command $command$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15, "threat_object_field": "user", "threat_object_type": "user"}] +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1340,11 +1265,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Credential Dumping"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 63 action.risk.param._risk_message = process $SourceImage$ injected into $TargetImage$ and was attempted dump LSASS on $dest$. Adversaries tend to do this when trying to accesss credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"threat_object_field": "TargetImage", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "TargetImage", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1388,11 +1310,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Trickbot"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 5 action.risk.param._risk_message = Suspicious $process_name$ usage detected on endpoint $dest$ by user $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 5}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 5}, {"threat_object_field": "process_name", "threat_object_type": "process name"}] +action.risk.param._risk = [{"threat_object_field": "process_name", "threat_object_type": "process name"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1477,11 +1396,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Prohibited Traffic Allowed or Protocol Mismatch"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 3 action.risk.param._risk_message = Suspicious firewall modifications were detected via the registry on endpoint $dest$ by user $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 3}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 3}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1525,11 +1441,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Prohibited Traffic Allowed or Protocol Mismatch"] action.risk = 1 -action.risk.param._risk_object = ComputerName -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 3 action.risk.param._risk_message = Suspicious firewall modification detected on endpoint $ComputerName$ by user $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 3}, {"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 3}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1613,11 +1526,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Ransomware"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 25 action.risk.param._risk_message = Suspicious registry modification was performed on endpoint $dest$ by user $user$. This behavior is indicative of privilege escalation. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1741,11 +1651,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Cobalt Strike", "NOBELIUM Group"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 64 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior is indicative of suspicious loading of 7zip. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 64}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1789,11 +1696,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Malicious PowerShell", "Ingress Tool Transfer"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 56 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadFile within PowerShell. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1837,11 +1741,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Malicious PowerShell", "HAFNIUM Group", "Ingress Tool Transfer"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 56 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadString within PowerShell. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1885,11 +1786,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Monitor for Unauthorized Software", "XMRig", "SamSam Ransomware", "Unusual Processes"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 64 action.risk.param._risk_message = An attacker tool $process_name$,listed in attacker_tools.csv is executed on host $dest$ by User $user$. This process $process_name$ is known to do- $description$ -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 64}, {"threat_object_field": "parent_process", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "parent_process", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1933,11 +1831,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Disabling Security Tools"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 35 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified attempting to add a certificate to the store on endpoint $dest$ by user $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 35}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1981,11 +1876,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Disabling Security Tools", "Trickbot"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 20 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified attempting to disable security services on endpoint $dest$ by user $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 20}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 20}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -2029,11 +1921,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Credential Dumping", "DarkSide Ransomware"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 90 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to export the registry keys. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 90}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 90}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -2077,11 +1966,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Ryuk Ransomware", "Ransomware"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 80 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting disable the ability to recover the endpoint. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -2125,11 +2011,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["BITS Jobs"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 56 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to persist using BITS. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -2173,11 +2056,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Ingress Tool Transfer", "BITS Jobs", "DarkSide Ransomware"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 49 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a file. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -2221,11 +2101,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["SamSam Ransomware"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 63 action.risk.param._risk_message = A file - $file_name$ was written to system32 has occurred on endpoint $dest$ by user $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 63}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"threat_object_field": "file_name", "threat_object_type": "file name"}] +action.risk.param._risk = [{"threat_object_field": "file_name", "threat_object_type": "file name"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -2269,11 +2146,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Cobalt Strike"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 64 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ potentially performing privilege escalation using named pipes related to Cobalt Strike and other frameworks. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 64}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -2317,11 +2191,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["DarkSide Ransomware", "Ransomware"] action.risk = 1 -action.risk.param._risk_object = Computer -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 80 action.risk.param._risk_message = The following module $ImageLoaded$ was loaded by a non-standard application on endpoint $Computer$ by user $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "ImageLoaded", "threat_object_type": "other"}] +action.risk.param._risk = [{"threat_object_field": "ImageLoaded", "threat_object_type": "other"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -2364,11 +2235,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Ingress Tool Transfer", "DarkSide Ransomware"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 90 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a file. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 90}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 90}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -2412,11 +2280,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Ingress Tool Transfer", "DarkSide Ransomware"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 90 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a file. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 90}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 90}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -2460,11 +2325,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Deobfuscate-Decode Files or Information"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 40 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to decode a file. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 40}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 40}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -2508,11 +2370,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Persistence Techniques", "Cloud Federated Credential Abuse"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 63 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting export a certificate. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 63}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -2597,11 +2456,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Ransomware"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 90 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to clear the unallocated sectors of a specific disk. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 90}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 90}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -2688,11 +2544,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Clop Ransomware"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 100 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting using arguments to execute its main code or feature of its code related to Clop ransomware. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 100}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 100}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -2736,11 +2589,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Clop Ransomware"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 100 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ executing known Clop Ransomware service names. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 100}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 100}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -2783,18 +2633,15 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Cloud User Activities"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 36 action.risk.param._risk_message = User $user$ of type AssumedRole attempting to execute new API calls $command$ that have not been seen before -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36, "threat_object_field": "user", "threat_object_type": "user"}] +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Cloud API Calls From Previously Unseen User Roles - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud User Activities"], "cis20": ["CIS 1"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Recon", "Stage:Execution"], "impact": 60, "mitre_attack": ["T1078"], "nist": ["ID.AM"], "observable": [{"name": "user", "role": ["Attacker"], "type": "user"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud User Activities"], "cis20": ["CIS 1"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Recon", "Stage:Execution"], "impact": 60, "mitre_attack": ["T1078"], "nist": ["ID.AM"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -2825,11 +2672,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Cloud Cryptomining"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 18 action.risk.param._risk_message = User $user$ is creating a new instance $dest$ for the first time -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 18}] +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -2867,11 +2711,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Cloud Cryptomining"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 42 action.risk.param._risk_message = User $user$ is creating an instance $dest$ in a new region for the first time -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}] +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -2909,11 +2750,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Cloud Cryptomining"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 36 action.risk.param._risk_message = User $user$ is creating an instance $dest$ with an image that has not been previously seen. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 36}] +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -2951,18 +2789,15 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Cloud Cryptomining"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 30 action.risk.param._risk_message = User $user$ is creating an instance $dest$ with an instance type $instance_type$ that has not been previously seen. -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 30}] +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 30}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule -action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining"], "cis20": ["CIS 1"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 50, "nist": ["ID.AM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining"], "cis20": ["CIS 1"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 50, "nist": ["ID.AM"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -2993,11 +2828,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Cloud Instance Activities"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 42 action.risk.param._risk_message = User $user$ is modifying an instance $dest$ for the first time. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}] +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -3077,11 +2909,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Cloud Provisioning Activities"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 18 action.risk.param._risk_message = User $user$ is starting or creating an instance $dest$ for the first time in City $City$ from IP address $src$ -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 18, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 18, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 18}] +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 18}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -3120,11 +2949,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Cloud Provisioning Activities"] action.risk = 1 -action.risk.param._risk_object = object -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 42 action.risk.param._risk_message = User $user$ is starting or creating an instance $object$ for the first time in Country $Country$ from IP address $src$ -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 42, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 42, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "object", "risk_object_type": "system", "risk_score": 42}] +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 42}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -3163,11 +2989,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Cloud Provisioning Activities"] action.risk = 1 -action.risk.param._risk_object = object_id -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 42 action.risk.param._risk_message = User $user$ is starting or creating an instance $object_id$ for the first time from IP address $src$ -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 42, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 42, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "object_id", "risk_object_type": "system", "risk_score": 42}] +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 42}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -3206,11 +3029,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Cloud Provisioning Activities"] action.risk = 1 -action.risk.param._risk_object = object -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 42 action.risk.param._risk_message = User $user$ is starting or creating an instance $object$ for the first time in region $Region$ from IP address $src$ -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 42, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 42, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "object", "risk_object_type": "system", "risk_score": 42}] +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 42}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -3250,11 +3070,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Cobalt Strike", "Trickbot", "DarkSide Ransomware"] action.risk = 1 -action.risk.param._risk_object = Computer -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 72 action.risk.param._risk_message = An instance of $process_name$ was identified on endpoint $Computer$ by user $user$ accessing known suspicious named pipes related to Cobalt Strike. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 72}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -3303,11 +3120,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["SamSam Ransomware", "Ryuk Ransomware", "Ransomware", "Clop Ransomware"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 90 action.risk.param._risk_message = A file - $file_name$ was written to disk on endpoint $dest$ by user $user$, this is indicative of a known ransomware file extension and should be reviewed immediately. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 90}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 90}, {"threat_object_field": "file_name", "threat_object_type": "file name"}] +action.risk.param._risk = [{"threat_object_field": "file_name", "threat_object_type": "file name"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -3351,11 +3165,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["SamSam Ransomware", "Ransomware", "Ryuk Ransomware", "Clop Ransomware"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 90 action.risk.param._risk_message = A file - $file_name$ was written to disk on endpoint $dest$ by user $user$, this is indicative of a known ransomware note file and should be reviewed immediately. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 90}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 90}, {"threat_object_field": "file_name", "threat_object_type": "file name"}] +action.risk.param._risk = [{"threat_object_field": "file_name", "threat_object_type": "file name"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -3399,11 +3210,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Ransomware"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 64 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ executing specific Conti Ransomware related parameters. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 64}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -3447,11 +3255,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Credential Dumping"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 81 action.risk.param._risk_message = A process has created a remote thread into $TargetImage$ on $dest$. This behavior is indicative of credential dumping and should be investigated. -action.risk.param._risk = [{"threat_object_field": "TargetImage", "threat_object_type": "other"}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 81}] +action.risk.param._risk = [{"threat_object_field": "TargetImage", "threat_object_type": "other"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -3495,9 +3300,6 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Clop Ransomware"] action.risk = 1 -action.risk.param._risk_object = -action.risk.param._risk_object_type = -action.risk.param._risk_score = 56 action.risk.param._risk_message = A service $Service_File_Name$ was created from a non-standard path using $Service_Name$, potentially leading to a privilege escalation. action.risk.param._risk = [{"threat_object_field": "Service_File_Name", "threat_object_type": "other"}, {"threat_object_field": "Service_Name", "threat_object_type": "other"}] action.risk.param.verbose = 0 @@ -3543,11 +3345,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["DHS Report TA18-074A"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 30 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to add a user to the local Administrators group. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 30}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 30}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -3591,11 +3390,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Hidden Cobra Malware"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 25 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ enumerating Windows file shares. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -3639,11 +3435,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Credential Dumping"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 81 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to create a shadow copy to perform offline password cracking. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 81}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 81}, {"threat_object_field": "parent_process", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "parent_process", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -3687,11 +3480,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Credential Dumping"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 81 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to create a shadow copy to perform offline password cracking. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 81}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 81}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -3735,11 +3525,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Credential Dumping"] action.risk = 1 -action.risk.param._risk_object = Computer -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 80 action.risk.param._risk_message = $process_name$ was identified on endpoint $Computer$ writing $TargetFilename$ to disk. This behavior is related to dumping credentials via Task Manager. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "TargetFilename", "threat_object_type": "file name"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "TargetFilename", "threat_object_type": "file name"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -3783,11 +3570,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Credential Dumping"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 81 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to copy SAM and NTDS.dit for offline password cracking. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 81}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 81}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -3831,11 +3615,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Credential Dumping"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 81 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to create symlink to a shadow copy to grab credentials. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 81}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 81}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -3879,11 +3660,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Cobalt Strike"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 49 action.risk.param._risk_message = The process $process_name$ was spawned by $parent_image$ without any command-line arguments on $dest$ by $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"threat_object_field": "parent_image", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "parent_image", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -3927,11 +3705,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious DNS Traffic", "Dynamic DNS", "Command and Control", "Data Exfiltration"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 72 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ performing activity related to DNS exfiltration. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 72}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -4022,11 +3797,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Hidden Cobra Malware", "Suspicious DNS Traffic", "Command and Control"] action.risk = 1 -action.risk.param._risk_object = host -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 56 action.risk.param._risk_message = A dns query $query$ with 2 time standard deviation of name len of the dns query in host $host$ -action.risk.param._risk = [{"risk_object_field": "host", "risk_object_type": "system", "risk_score": 56}, {"threat_object_field": "query", "threat_object_type": "dnsquery"}] +action.risk.param._risk = [{"threat_object_field": "query", "threat_object_type": "dnsquery"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -4165,11 +3937,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Domain Trust Discovery"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 72 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified performing domain discovery on endpoint $dest$ by user $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 72}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -4218,11 +3987,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["DarkSide Ransomware", "Ransomware", "Revil Ransomware"] action.risk = 1 -action.risk.param._risk_object = ComputerName -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 81 action.risk.param._risk_message = An attempt to delete ShadowCopy was performed using PowerShell on $ComputerName$ by $User$. -action.risk.param._risk = [{"risk_object_field": "User", "risk_object_type": "user", "risk_score": 81}, {"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 81}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -4265,11 +4031,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["XMRig"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 25 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to delete accounts. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -4313,11 +4076,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Log Manipulation", "SamSam Ransomware", "Ransomware", "Clop Ransomware"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 81 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to delete shadow copies. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 81}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 81}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -4367,9 +4127,6 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS User Monitoring"] action.risk = 1 -action.risk.param._risk_object = -action.risk.param._risk_object_type = -action.risk.param._risk_score = 10 action.risk.param._risk_message = action.risk.param._risk = [] action.risk.param.verbose = 0 @@ -4462,9 +4219,6 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS User Monitoring"] action.risk = 1 -action.risk.param._risk_object = -action.risk.param._risk_object_type = -action.risk.param._risk_score = 15 action.risk.param._risk_message = action.risk.param._risk = [] action.risk.param.verbose = 0 @@ -4510,11 +4264,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Cloud Authentication Activities"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 30 action.risk.param._risk_message = User $user$ is logging into the AWS console for the first time -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 30, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 30, "threat_object_field": "user", "threat_object_type": "user"}] +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 30}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -4552,11 +4303,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious AWS Login Activities", "Suspicious Cloud Authentication Activities"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 18 action.risk.param._risk_message = User $user$ is logging into the AWS console from City $City$ for the first time -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18, "threat_object_field": "user", "threat_object_type": "user"}] +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -4594,11 +4342,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious AWS Login Activities", "Suspicious Cloud Authentication Activities"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 42 action.risk.param._risk_message = User $user$ is logging into the AWS console from Country $Country$ for the first time -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}] +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -4636,11 +4381,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious AWS Login Activities", "Suspicious Cloud Authentication Activities"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 36 action.risk.param._risk_message = User $user$ is logging into the AWS console from Region $Region$ for the first time -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36, "threat_object_field": "user", "threat_object_type": "user"}] +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -4678,11 +4420,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Lateral Movement"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 49 action.risk.param._risk_message = The following $EventCode$ occurred on $dest$ by $user$ with Logon Type 3, which may be indicative of the pass the hash technique. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"threat_object_field": "EventCode", "threat_object_type": "other"}] +action.risk.param._risk = [{"threat_object_field": "EventCode", "threat_object_type": "other"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -4726,11 +4465,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Discovery Techniques"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 80 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ using AzureHound to enumerate AzureAD. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -4774,11 +4510,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Discovery Techniques"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 63 action.risk.param._risk_message = A file - $file_name$ was written to disk that is related to AzureHound, a AzureAD enumeration utility, has occurred on endpoint $dest$ by user $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 63}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"threat_object_field": "file_name", "threat_object_type": "file name"}] +action.risk.param._risk = [{"threat_object_field": "file_name", "threat_object_type": "file name"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -4942,11 +4675,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Detect Zerologon Attack"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 49 action.risk.param._risk_message = The following $EventCode$ occurred on $dest$ by $user$ with Logon Type 3, which may be indicative of the an account or group being changed by an anonymous account. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"threat_object_field": "EventCode", "threat_object_type": "other"}] +action.risk.param._risk = [{"threat_object_field": "EventCode", "threat_object_type": "other"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -4994,11 +4724,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Credential Dumping"] action.risk = 1 -action.risk.param._risk_object = ComputerName -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 80 action.risk.param._risk_message = PowerShell was identified running a script to capture the SAM hive on endpoint $ComputerName$ by user $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 80}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -5043,11 +4770,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Credential Dumping", "Detect Zerologon Attack"] action.risk = 1 -action.risk.param._risk_object = Computer -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 80 action.risk.param._risk_message = The $source_image$ has attempted access to read $TargetImage$ was identified on endpoint $Computer$, this is indicative of credential dumping and should be investigated. -action.risk.param._risk = [{"threat_object_field": "source_image", "threat_object_type": "other"}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "TargetImage", "threat_object_type": "other"}] +action.risk.param._risk = [{"threat_object_field": "source_image", "threat_object_type": "other"}, {"threat_object_field": "TargetImage", "threat_object_type": "other"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -5140,11 +4864,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Malicious PowerShell"] action.risk = 1 -action.risk.param._risk_object = ComputerName -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 81 action.risk.param._risk_message = The following behavior was identified and typically related to PowerShell-Empire on $ComputerName$ by $User$. -action.risk.param._risk = [{"risk_object_field": "User", "risk_object_type": "user", "risk_score": 81}, {"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 81}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -5193,11 +4914,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Account Monitoring and Controls"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 36 action.risk.param._risk_message = Multiple accounts have been locked out. Review $dest$ and results related to $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 36}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -5241,11 +4959,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Account Monitoring and Controls"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 36 action.risk.param._risk_message = Multiple accounts have been locked out. Review $nodename$ and $result$ related to $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36}, {"threat_object_field": "result", "threat_object_type": "other"}] +action.risk.param._risk = [{"threat_object_field": "result", "threat_object_type": "other"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -5289,11 +5004,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["HAFNIUM Group"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 81 action.risk.param._risk_message = A file - $file_name$ was written to disk that is related to IIS exploitation previously performed by HAFNIUM. Review further file modifications on endpoint $dest$ by user $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 81}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 81}, {"threat_object_field": "file_name", "threat_object_type": "file name"}] +action.risk.param._risk = [{"threat_object_field": "file_name", "threat_object_type": "file name"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -5417,11 +5129,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Compiled HTML Activity"] action.risk = 1 -action.risk.param._risk_object = Computer -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 80 action.risk.param._risk_message = The following $process_name$ has been identified as renamed, spawning from $parent_process_name$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -5465,11 +5174,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Compiled HTML Activity"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 80 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ spawning a child process, typically not normal behavior. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -5513,11 +5219,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Compiled HTML Activity"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 90 action.risk.param._risk_message = An instance of $parent_proces_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ contacting a remote destination to potentally download a malicious payload. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 90}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 90}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -5561,11 +5264,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Compiled HTML Activity"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 72 action.risk.param._risk_message = $process_name$ has been identified using Infotech Storage Handlers to load a specific file within a CHM on $dest$ under user $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 72}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -5730,11 +5430,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious MSHTA Activity"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 80 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $est$ by user $user$ attempting to access a remote destination to download an additional payload. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -5778,11 +5475,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Credential Dumping", "Detect Zerologon Attack", "Cloud Federated Credential Abuse", "DarkSide Ransomware"] action.risk = 1 -action.risk.param._risk_object = Computer -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 64 action.risk.param._risk_message = A process, $Image$, has loaded $ImageLoaded$ that are typically related to credential dumping on $Computer$. Review for further details. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 64}, {"threat_object_field": "ImageLoaded", "threat_object_type": "parent process"}, {"threat_object_field": "Image", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "ImageLoaded", "threat_object_type": "parent process"}, {"threat_object_field": "Image", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -5870,11 +5564,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Malicious PowerShell"] action.risk = 1 -action.risk.param._risk_object = ComputerName -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 90 action.risk.param._risk_message = The following behavior was identified and typically related to MimiKatz being loaded within the context of PowerShell on $ComputerName$ by $User$. -action.risk.param._risk = [{"risk_object_field": "User", "risk_object_type": "user", "risk_score": 90}, {"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 90}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -5919,11 +5610,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["DHS Report TA18-074A", "HAFNIUM Group"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 42 action.risk.param._risk_message = A $user$ on $dest$ was added recently. Identify if this was legitimate behavior or not. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -6049,11 +5737,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious AWS S3 Activities"] action.risk = 1 -action.risk.param._risk_object = userIdentity.userName -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 48 action.risk.param._risk_message = User $userIdentity.userName$ has created an open/public bucket $bucketName$ using AWS CLI with the following permissions - $requestParameters.accessControlList.x-amz-grant-read$ $requestParameters.accessControlList.x-amz-grant-read-acp$ $requestParameters.accessControlList.x-amz-grant-write$ $requestParameters.accessControlList.x-amz-grant-write-acp$ $requestParameters.accessControlList.x-amz-grant-full-control$ -action.risk.param._risk = [{"risk_object_field": "userIdentity.userName", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "userIdentity.userName", "threat_object_type": "user"}, {"risk_object_field": "userIdentity.userName", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "userIdentity.userName", "threat_object_type": "user"}, {"threat_object_field": "bucketName", "threat_object_type": "other"}] +action.risk.param._risk = [{"risk_object_field": "userIdentity.userName", "risk_object_type": "user", "risk_score": 48}, {"threat_object_field": "bucketName", "threat_object_type": "other"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -6091,11 +5776,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious AWS S3 Activities"] action.risk = 1 -action.risk.param._risk_object = user_arn -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 48 action.risk.param._risk_message = User $user_arn$ has created an open/public bucket $bucketName$ with the following permissions $permission$ -action.risk.param._risk = [{"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "user_arn", "threat_object_type": "user"}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "user_arn", "threat_object_type": "user"}, {"threat_object_field": "bucketName", "threat_object_type": "other"}] +action.risk.param._risk = [{"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 48}, {"threat_object_field": "bucketName", "threat_object_type": "other"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -6214,11 +5896,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Persistence Techniques"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 49 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to perform privilege escalation by using unquoted service paths. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -6302,11 +5981,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Command-Line Executions", "Suspicious MSHTA Activity", "Suspicious Zoom Child Processes", "NOBELIUM Group"] action.risk = 1 -action.risk.param._risk_object = Computer -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 80 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ running prohibited applications. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -6350,11 +6026,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["SamSam Ransomware", "DHS Report TA18-074A", "HAFNIUM Group", "DarkSide Ransomware", "Lateral Movement"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 35 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ running the utility for possibly the first time. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 35}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -6398,11 +6071,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["DarkSide Ransomware", "Ransomware"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 35 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to connect to a remote cloud service to move files or folders. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 35}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -6487,11 +6157,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Regsvcs Regasm Activity"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 64 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ spawning a child process, typically not normal behavior for $parent_process_name$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 64}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -6535,11 +6202,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Regsvcs Regasm Activity"] action.risk = 1 -action.risk.param._risk_object = Computer -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 80 action.risk.param._risk_message = An instance of $process_name$ contacting a remote destination was identified on endpoint $Computer$ by user $user$. This behavior is not normal for $process_name$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -6583,11 +6247,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Regsvcs Regasm Activity"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 49 action.risk.param._risk_message = The process $process_name$ was spawned by $parent_image$ without any command-line arguments on $dest$ by $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"threat_object_field": "parent_image", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "parent_image", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -6631,11 +6292,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Regsvcs Regasm Activity"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 64 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ typically not normal for this process. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 64}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -6679,11 +6337,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Regsvcs Regasm Activity"] action.risk = 1 -action.risk.param._risk_object = Computer -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 80 action.risk.param._risk_message = An instance of $process_name$ contacting a remote destination was identified on endpoint $Computer$ by user $user$. This behavior is not normal for $process_name$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -6727,11 +6382,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Regsvcs Regasm Activity"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 49 action.risk.param._risk_message = The process $process_name$ was spawned by $parent_image$ without any command-line arguments on $dest$ by $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"threat_object_field": "parent_image", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "parent_image", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -6777,11 +6429,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Regsvr32 Activity", "Cobalt Strike"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 80 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ in an attempt to bypass detection and preventative controls was identified on endpoint $dest$ by user $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -6826,11 +6475,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Collection and Staging"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 27 action.risk.param._risk_message = The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 27}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 27}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -6874,11 +6520,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["SamSam Ransomware", "DHS Report TA18-074A", "HAFNIUM Group", "DarkSide Ransomware", "Lateral Movement"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 27 action.risk.param._risk_message = The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 27}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 27}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -6922,11 +6565,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["DarkSide Ransomware", "Ransomware"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 27 action.risk.param._risk_message = The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 27}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 27}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -6970,11 +6610,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Collection and Staging"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 27 action.risk.param._risk_message = The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 27}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 27}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -7059,11 +6696,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Rundll32 Activity"] action.risk = 1 -action.risk.param._risk_object = Computer -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 80 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ loading advpack.dll and ieadvpack.dll by calling the LaunchINFSection function on the command line was identified on endpoint $dest$ by user $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -7107,11 +6741,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Rundll32 Activity"] action.risk = 1 -action.risk.param._risk_object = Computer -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 80 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ loading setupapi.dll and iesetupapi.dll by calling the LaunchINFSection function on the command line was identified on endpoint $dest$ by user $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -7155,11 +6786,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Rundll32 Activity"] action.risk = 1 -action.risk.param._risk_object = Computer -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 80 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ loading syssetup.dll by calling the LaunchINFSection function on the command line was identified on endpoint $dest$ by user $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -7203,11 +6831,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious MSHTA Activity", "NOBELIUM Group"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 56 action.risk.param._risk_message = Suspicious rundll32.exe inline HTA execution on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -7251,9 +6876,6 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious AWS S3 Activities"] action.risk = 1 -action.risk.param._risk_object = -action.risk.param._risk_object_type = -action.risk.param._risk_score = 10 action.risk.param._risk_message = action.risk.param._risk = [] action.risk.param.verbose = 0 @@ -7338,11 +6960,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Discovery Techniques", "Ransomware"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 24 action.risk.param._risk_message = Possible SharpHound command-Line arguments identified on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 24}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -7386,11 +7005,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Discovery Techniques", "Ransomware"] action.risk = 1 -action.risk.param._risk_object = User -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 24 action.risk.param._risk_message = Potential SharpHound file modifications identified on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 24}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 24}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -7434,11 +7050,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Discovery Techniques", "Ransomware"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 24 action.risk.param._risk_message = Potential SharpHound binary identified on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 24}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -7529,9 +7142,6 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS User Monitoring"] action.risk = 1 -action.risk.param._risk_object = -action.risk.param._risk_object_type = -action.risk.param._risk_score = 10 action.risk.param._risk_message = action.risk.param._risk = [] action.risk.param.verbose = 0 @@ -7563,7 +7173,7 @@ search = `cloudtrail` eventType=AwsApiCall [search `cloudtrail` eventType=AwsApi action.escu = 0 action.escu.enabled = 1 description = This search looks for a spike in number of of AWS security Hub alerts for an EC2 instance in 4 hours intervals -action.escu.mappings = {"cis20": ["CIS 13"], "nist": ["DE.DP", "DE.AE"]} +action.escu.mappings = {"cis20": ["CIS 13"], "nist": ["DE.DP"]} action.escu.data_models = [] action.escu.eli5 = This search looks for a spike in number of of AWS security Hub alerts for an EC2 instance in 4 hours intervals action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security Hub inputs. The threshold_value should be tuned to your environment and schedule these searches according to the bucket span interval. @@ -7577,10 +7187,7 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS Security Hub Alerts"] action.risk = 1 -action.risk.param._risk_object = -action.risk.param._risk_object_type = -action.risk.param._risk_score = 20 -action.risk.param._risk_message = +action.risk.param._risk_message = Spike in AWS security Hub alerts with title $Title$ for EC2 instance $dest$ action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * @@ -7588,7 +7195,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule -action.correlationsearch.annotations = {"analytic_story": ["AWS Security Hub Alerts"], "cis20": ["CIS 13"], "nist": ["DE.DP", "DE.AE"]} +action.correlationsearch.annotations = {"analytic_story": ["AWS Security Hub Alerts"], "cis20": ["CIS 13"], "confidence": 50, "context": ["Source:Cloud Data", "Stage:Execution"], "impact": 30, "nist": ["DE.DP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -7660,9 +7267,6 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS Network ACL Activity"] action.risk = 1 -action.risk.param._risk_object = -action.risk.param._risk_object_type = -action.risk.param._risk_score = 20 action.risk.param._risk_message = action.risk.param._risk = [] action.risk.param.verbose = 0 @@ -7708,9 +7312,6 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious AWS S3 Activities"] action.risk = 1 -action.risk.param._risk_object = -action.risk.param._risk_object_type = -action.risk.param._risk_score = 10 action.risk.param._risk_message = action.risk.param._risk = [] action.risk.param.verbose = 0 @@ -7756,9 +7357,6 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS User Monitoring"] action.risk = 1 -action.risk.param._risk_object = -action.risk.param._risk_object_type = -action.risk.param._risk_score = 5 action.risk.param._risk_message = action.risk.param._risk = [] action.risk.param.verbose = 0 @@ -7804,9 +7402,6 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS Network ACL Activity", "Suspicious AWS Traffic", "Command and Control"] action.risk = 1 -action.risk.param._risk_object = -action.risk.param._risk_object_type = -action.risk.param._risk_score = 20 action.risk.param._risk_message = action.risk.param._risk = [] action.risk.param.verbose = 0 @@ -7972,11 +7567,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Emotet Malware DHS Report TA18-201A ", "Suspicious Command-Line Executions"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 35 action.risk.param._risk_message = cmd.exe launching script interpreters on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -8030,11 +7622,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious WMI Use"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 63 action.risk.param._risk_message = Possible malicious WMI Subscription created on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -8249,11 +7838,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Data Protection", "Prohibited Traffic Allowed or Protocol Mismatch", "DNS Hijacking", "Suspicious DNS Traffic", "Dynamic DNS", "Command and Control"] action.risk = 1 -action.risk.param._risk_object = host -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 56 action.risk.param._risk_message = A dns query $query$ from your infra connecting to suspicious domain in host $host$ -action.risk.param._risk = [{"risk_object_field": "host", "risk_object_type": "system", "risk_score": 56}, {"threat_object_field": "query", "threat_object_type": "dnsquery"}] +action.risk.param._risk = [{"threat_object_field": "query", "threat_object_type": "dnsquery"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -8337,11 +7923,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious MSHTA Activity"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 90 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ executing with inline HTA, indicative of defense evasion. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 90}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 90}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -8385,11 +7968,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious MSHTA Activity"] action.risk = 1 -action.risk.param._risk_object = Computer -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 80 action.risk.param._risk_message = The following $process_name$ has been identified as renamed, spawning from $parent_process_name$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -8433,9 +8013,6 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS User Monitoring"] action.risk = 1 -action.risk.param._risk_object = -action.risk.param._risk_object_type = -action.risk.param._risk_score = 5 action.risk.param._risk_message = action.risk.param._risk = [] action.risk.param.verbose = 0 @@ -8522,11 +8099,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Unusual Processes"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 32 action.risk.param._risk_message = An instance of $parent_process_name$ spawning multiple $process_name$ was identified on endpoint $dest$ by user $user$ typically not a normal behavior of the process. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 32}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 32}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -8570,11 +8144,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Cloud Instance Activities", "Data Exfiltration"] action.risk = 1 -action.risk.param._risk_object = src_ip -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 48 action.risk.param._risk_message = AWS EC2 snapshot from account $aws_account_id$ is shared with $requested_account_id$ by user $user_arn$ from $src_ip$ -action.risk.param._risk = [{"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "user_arn", "threat_object_type": "user"}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "user_arn", "threat_object_type": "user"}, {"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 48, "threat_object_field": "src_ip", "threat_object_type": "ip address"}, {"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 48, "threat_object_field": "src_ip", "threat_object_type": "ip address"}] +action.risk.param._risk = [{"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 48}, {"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 48}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -8819,11 +8390,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Ransomware"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 24 action.risk.param._risk_message = WevtUtil.exe used to disable Event Logging on $dest -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 24}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -8867,9 +8435,6 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Defense Evasion Tactics"] action.risk = 1 -action.risk.param._risk_object = -action.risk.param._risk_object_type = -action.risk.param._risk_score = 40 action.risk.param._risk_message = Disabled Registry Tools action.risk.param._risk = [] action.risk.param.verbose = 0 @@ -8915,9 +8480,6 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Defense Evasion Tactics"] action.risk = 1 -action.risk.param._risk_object = -action.risk.param._risk_object_type = -action.risk.param._risk_score = 40 action.risk.param._risk_message = Disabled 'Show Hidden Files' action.risk.param._risk = [] action.risk.param.verbose = 0 @@ -8963,9 +8525,6 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["XMRig"] action.risk = 1 -action.risk.param._risk_object = -action.risk.param._risk_object_type = -action.risk.param._risk_score = 40 action.risk.param._risk_message = Disabled 'Windows App Hotkeys' action.risk.param._risk = [] action.risk.param.verbose = 0 @@ -9011,11 +8570,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Ransomware", "Revil Ransomware"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 40 action.risk.param._risk_message = Windows Defender real time behavior monitoring disabled on $dest -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 40}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -9059,11 +8615,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Defense Evasion Tactics"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 25 action.risk.param._risk_message = The Windows Smartscreen was disabled on $dest$ by $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -9107,11 +8660,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Defense Evasion Tactics"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 25 action.risk.param._risk_message = The Windows command prompt was disabled on $dest$ by $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -9155,11 +8705,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Defense Evasion Tactics"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 25 action.risk.param._risk_message = The Windows Control Panel was disabled on $dest$ by $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -9203,11 +8750,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Defense Evasion Tactics"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 25 action.risk.param._risk_message = The Windows Firewall was disabled on $dest$ by $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -9251,11 +8795,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Defense Evasion Tactics"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 25 action.risk.param._risk_message = The Windows Folder Options, to hide files, was disabled on $dest$ by $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -9299,11 +8840,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["XMRig"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 42 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified disabling a user account on endpoint $dest$ by user $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -9347,11 +8885,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Defense Evasion Tactics"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 25 action.risk.param._risk_message = The Windows registry was modified to disable run application in window start menu on $dest$ by $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -9395,11 +8930,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Suspicious Windows Registry Activities"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 42 action.risk.param._risk_message = The Windows registry keys that control the enforcement of Windows User Account Control (UAC) were modified on $dest$ by $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -9443,11 +8975,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Defense Evasion Tactics"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 49 action.risk.param._risk_message = The Windows registry was modified to disable system restore on $dest$ by $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -9491,11 +9020,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Defense Evasion Tactics"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 42 action.risk.param._risk_message = The Windows Task Manager was disabled on $dest$ by $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -9539,11 +9065,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["XMRig"] action.risk = 1 -action.risk.param._risk_object = Computer -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 49 action.risk.param._risk_message = Suspicious files were downloaded with the Telegram application on $dest$ by $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 49}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -9586,11 +9109,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Credential Dumping", "Suspicious Rundll32 Activity", "HAFNIUM Group"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 80 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified accessing credentials using comsvcs.dll on endpoint $dest$ by user $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -9636,11 +9156,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Credential Dumping", "HAFNIUM Group"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 80 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified attempting to dump lsass.exe on endpoint $dest$ by user $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -9687,11 +9204,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Credential Dumping", "HAFNIUM Group"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 80 action.risk.param._risk_message = The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$, attempting to dump lsass.exe. -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -9736,9 +9250,6 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Unusual AWS EC2 Modifications"] action.risk = 1 -action.risk.param._risk_object = -action.risk.param._risk_object_type = -action.risk.param._risk_score = 5 action.risk.param._risk_message = action.risk.param._risk = [] action.risk.param.verbose = 0 @@ -9784,9 +9295,6 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS Cryptomining", "Suspicious AWS EC2 Activities"] action.risk = 1 -action.risk.param._risk_object = -action.risk.param._risk_object_type = -action.risk.param._risk_score = 10 action.risk.param._risk_message = action.risk.param._risk = [] action.risk.param.verbose = 0 @@ -10076,11 +9584,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Prohibited Traffic Allowed or Protocol Mismatch"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 80 action.risk.param._risk_message = RDP was moved to a non-standard port on $dest$ by $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -10124,11 +9629,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["XMRig"] action.risk = 1 -action.risk.param._risk_object = ComputerName -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 80 action.risk.param._risk_message = The Telegram application has been identified enumerating local groups on $ComputerName$ by $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 80}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -10171,11 +9673,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Defense Evasion Tactics"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 80 action.risk.param._risk_message = Registry values were modified to bypass UAC using Event Viewer on $dest$ by $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -10219,11 +9718,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Spearphishing Attachments"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 80 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$, indicating potential suspicious macro execution. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -10267,11 +9763,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Spearphishing Attachments"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 80 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$, indicating potential suspicious macro execution. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -10315,11 +9808,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["XMRig"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 80 action.risk.param._risk_message = An excessive amount of $process_name$ was executed on $dest$ attempting to disable services. -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -10403,11 +9893,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["XMRig", "Ransomware"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 80 action.risk.param._risk_message = An excessive amount of $process_name$ was executed on $dest$ attempting to disable services. -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -10451,11 +9938,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["XMRig"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 80 action.risk.param._risk_message = An excessive amount of $process_name$ was executed on $dest$ attempting to modify permissions. -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -10499,11 +9983,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["XMRig", "Ransomware"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 28 action.risk.param._risk_message = Excessive usage of net1.exe or net.exe within 1m, with command line $process$ has been detected on $dest$ by $user$ -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 28}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 28}, {"threat_object_field": "process_name", "threat_object_type": "process name"}] +action.risk.param._risk = [{"threat_object_field": "process_name", "threat_object_type": "process name"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -10587,11 +10068,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["XMRig"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 28 action.risk.param._risk_message = Excessive usage of taskkill.exe with process id $process_id$ (more than 10 within 1m) has been detected on $dest$ with a parent process of $parent_process_name$. -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 28}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 28}, {"threat_object_field": "parent_process_name", "threat_object_type": "process name"}] +action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "process name"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -10635,11 +10113,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious DNS Traffic", "Dynamic DNS", "Command and Control", "Data Exfiltration"] action.risk = 1 -action.risk.param._risk_object = Computer -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 28 action.risk.param._risk_message = Excessive usage of nslookup.exe has been detected on $Computer$. This detection is triggered as as it violates the dynamic threshold -action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 28}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -10682,11 +10157,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["meterpreter"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 80 action.risk.param._risk_message = Multiple processes were executed out of windows\temp within a short amount of time on $dest$. -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -10730,11 +10202,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Defense Evasion Tactics"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 80 action.risk.param._risk_message = An excessive amount of $process_name$ was executed on $dest$ attempting to disable services. -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -10778,11 +10247,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Meterpreter"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 56 action.risk.param._risk_message = An excessive amount of $process_name$ was executed on $dest$ indicative of suspicious behavior. -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -10826,11 +10292,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["XMRig"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 56 action.risk.param._risk_message = Suspicious executable or scripts with file name $file_name$, $file_path$ and process_id $process_id$ executed in suspicious file path in Windows by $user$ -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}, {"threat_object_field": "process_id", "threat_object_type": "process"}, {"threat_object_field": "file_name", "threat_object_type": "file name"}] +action.risk.param._risk = [{"threat_object_field": "process_id", "threat_object_type": "process"}, {"threat_object_field": "file_name", "threat_object_type": "file name"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -10874,11 +10337,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Ransomware"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 56 action.risk.param._risk_message = Suspicious process of cscript.exe with a parent process $parent_process_name$ where it tries to execute javascript using jscript.encode CLSID (COM OBJ), detected on $dest$ by $user$ -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"threat_object_field": "process_id", "threat_object_type": "process"}, {"threat_object_field": "parent_process_name", "threat_object_type": "process name"}] +action.risk.param._risk = [{"threat_object_field": "process_id", "threat_object_type": "process"}, {"threat_object_field": "parent_process_name", "threat_object_type": "process name"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -10963,11 +10423,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows File Extension and Association Abuse", "Masquerading - Rename System Utilities"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 56 action.risk.param._risk_message = process $process$ have double extensions in the file name is executed on $dest$ by $user$ -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"threat_object_field": "process", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "process", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -11052,11 +10509,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["DarkSide Ransomware", "Credential Dumping"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 56 action.risk.param._risk_message = Suspicious use of `reg.exe` exporting Windows Registry hives containing credentials executed on $dest$ by user $user$, with a parent process of $parent_process_id$ -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"threat_object_field": "parent_process_id", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "parent_process_id", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -11100,11 +10554,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["SamSam Ransomware"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 90 action.risk.param._risk_message = File writes $file_name$ with extensions consistent with a SamSam ransomware attack seen on $dest$ -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 90}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 90}, {"threat_object_field": "file_name", "threat_object_type": "file name"}] +action.risk.param._risk = [{"threat_object_field": "file_name", "threat_object_type": "file name"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -11148,11 +10599,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Zoom Child Processes"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 64 action.risk.param._risk_message = Child process $process_name$ with $process_id$ spawned by zoom.exe or zoom.us which has not been previously on host $dest$ -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 64}, {"threat_object_field": "process_name", "threat_object_type": "process name"}] +action.risk.param._risk = [{"threat_object_field": "process_name", "threat_object_type": "process name"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -11285,11 +10733,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Defense Evasion Tactics"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 81 action.risk.param._risk_message = Suspcious registy keys added by process fodhelper.exe (process_id- $process_id), with a parent_process of $parent_process_name$ that has been executed on $dest$ by $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 81}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 81}, {"threat_object_field": "parent_process_name", "threat_object_type": "process name"}] +action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "process name"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -11579,11 +11024,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Cobalt Strike"] action.risk = 1 -action.risk.param._risk_object = connection_to_CNC -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 81 action.risk.param._risk_message = Process gpupdate.exe with parent_process $parent_process_name$ is executed on $dest$ by user $user$, followed by an outbound network connection to $connection_to_CNC$ on port $dest_port$. This behaviour is seen with cobaltstrike. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 81}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 81}, {"threat_object_field": "parent_process_name", "threat_object_type": "process name"}, {"risk_object_field": "connection_to_CNC", "risk_object_type": "system", "risk_score": 81}] +action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "process name"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -11627,11 +11069,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["XMRig"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 72 action.risk.param._risk_message = Suspicious registry modification ($registry_value_name$) which is used go hide a user account on the Windows Login screen detected on $dest$ executed by $user$ -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 72}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "registry_value_name", "threat_object_type": "other"}] +action.risk.param._risk = [{"threat_object_field": "registry_value_name", "threat_object_type": "other"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -11675,11 +11114,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Windows Persistence Techniques"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 72 action.risk.param._risk_message = Attrib.exe with +h flag to hide files on $dest$ executed by $user$ is detected. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 72}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "parent_process", "threat_object_type": "other"}] +action.risk.param._risk = [{"threat_object_field": "parent_process", "threat_object_type": "other"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -11723,11 +11159,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Clop Ransomware"] action.risk = 1 -action.risk.param._risk_object = Computer -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 72 action.risk.param._risk_message = High frequency file deletion activity detected on host $Computer$ -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 72}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "deleted_files", "threat_object_type": "file name"}] +action.risk.param._risk = [{"threat_object_field": "deleted_files", "threat_object_type": "file name"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -11812,11 +11245,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Clop Ransomware"] action.risk = 1 -action.risk.param._risk_object = Computer -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 72 action.risk.param._risk_message = High frequency process termination (more than 15 processes within 3s) detected on host $Computer$ -action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "proc_terminated", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "proc_terminated", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -11899,11 +11329,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["XMRig", "Ransomware"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 49 action.risk.param._risk_message = Process name $process_name$ with grant argument executed by $user$ to change security permission of a specific file or directory on host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -11947,11 +11374,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["XMRig"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 72 action.risk.param._risk_message = Process name $process_name$ with deny argument executed by $user$ to change security permission of a specific file or directory on host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 72}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -12035,11 +11459,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Lateral Movement"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 72 action.risk.param._risk_message = Potential kerberoasting attack via service principal name requests detected on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -12082,11 +11503,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Ransomware"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 72 action.risk.param._risk_message = Known services $Message$ terminated by a potential ransomware on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "Message", "threat_object_type": "other"}] +action.risk.param._risk = [{"threat_object_field": "Message", "threat_object_type": "other"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -12978,11 +12396,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Data Exfiltration"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 72 action.risk.param._risk_message = mailsniper.ps1 functions $Message$ executed on a $ComputerName$ by user $user$. -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 72}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -13025,11 +12440,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Malicious PowerShell", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "HAFNIUM Group"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 81 action.risk.param._risk_message = PowerShell processes $process$ started with parameters to modify the execution policy of the run, run in a hidden window, and connect to the Internet on host $dest$ executed by user $user$. -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 81}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 81}, {"threat_object_field": "process", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "process", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -13073,11 +12485,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Malicious PowerShell", "NOBELIUM Group"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 35 action.risk.param._risk_message = Powershell.exe running potentially malicious encodede commands on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -13121,11 +12530,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["DHS Report TA18-074A", "HAFNIUM Group"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 42 action.risk.param._risk_message = PowerShell local execution policy bypass attempt on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -13210,11 +12616,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Malicious PowerShell"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 42 action.risk.param._risk_message = Powershell.exe running with potential obfuscated arguments on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -13258,11 +12661,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Malicious Powershell"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 72 action.risk.param._risk_message = Identifies the abuse the Windows SC.exe to execute malicious powerShell as a service $Service_File_Name$ by $user$ on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 72}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -13306,11 +12706,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Ransomware", "Revil Ransomware"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 54 action.risk.param._risk_message = Wallpaper modification on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 54}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -13353,11 +12750,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["XMRig"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 32 action.risk.param._risk_message = Suspicious ACL permission modification on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 32}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -13481,11 +12875,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Windows Registry Activities", "Windows Persistence Techniques"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 64 action.risk.param._risk_message = New print monitor added on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 64}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -13570,11 +12961,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Trickbot"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 56 action.risk.param._risk_message = a mshta parent process $parent_process_name$ spawn child process $process_name$ in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -13659,9 +13047,6 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Command and Control", "Data Exfiltration"] action.risk = 1 -action.risk.param._risk_object = -action.risk.param._risk_object_type = -action.risk.param._risk_score = 25 action.risk.param._risk_message = A http post $http_method$ sending packet with possible archive bytes header 4form_data$ in uri path $uri_path$ action.risk.param._risk = [{"threat_object_field": "uri_path", "threat_object_type": "uripath"}, {"threat_object_field": "form_data", "threat_object_type": "formdata"}] action.risk.param.verbose = 0 @@ -13712,11 +13097,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Active Directory Password Spraying"] action.risk = 1 -action.risk.param._risk_object = Client_Address -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 49 action.risk.param._risk_message = Potential Kerberos based password spraying attack from $Client_Address$ -action.risk.param._risk = [{"risk_object_field": "Client_Address", "risk_object_type": "system", "risk_score": 49}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -13768,11 +13150,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Active Directory Password Spraying"] action.risk = 1 -action.risk.param._risk_object = Client_Address -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 49 action.risk.param._risk_message = Potential Kerberos based password spraying attack from $Client_Address$ -action.risk.param._risk = [{"risk_object_field": "Client_Address", "risk_object_type": "system", "risk_score": 49}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -13824,11 +13203,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Active Directory Password Spraying"] action.risk = 1 -action.risk.param._risk_object = Source_Workstation -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 49 action.risk.param._risk_message = Potential NTLM based password spraying attack from $Source_Workstation$ -action.risk.param._risk = [{"risk_object_field": "Source_Workstation", "risk_object_type": "system", "risk_score": 49}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -13920,11 +13296,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Active Directory Password Spraying"] action.risk = 1 -action.risk.param._risk_object = ComputerName -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 49 action.risk.param._risk_message = Potential password spraying attack from $ComputerName$ -action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 49}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -13976,11 +13349,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Active Directory Password Spraying"] action.risk = 1 -action.risk.param._risk_object = Client_Address -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 49 action.risk.param._risk_message = Potential Kerberos based password spraying attack from $Client_Address$ -action.risk.param._risk = [{"risk_object_field": "Client_Address", "risk_object_type": "system", "risk_score": 49}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -14032,11 +13402,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Active Directory Password Spraying"] action.risk = 1 -action.risk.param._risk_object = Source_Workstation -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 49 action.risk.param._risk_message = Potential NTLM based password spraying attack from $Source_Workstation$ -action.risk.param._risk = [{"risk_object_field": "Source_Workstation", "risk_object_type": "system", "risk_score": 49}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -14088,11 +13455,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Active Directory Password Spraying"] action.risk = 1 -action.risk.param._risk_object = ComputerName -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 49 action.risk.param._risk_message = Potential password spraying attack from $ComputerName$ -action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 49}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -14144,11 +13508,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Active Directory Password Spraying"] action.risk = 1 -action.risk.param._risk_object = ComputerName -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 49 action.risk.param._risk_message = Potential password spraying attack on $ComputerName$ -action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 49}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -14194,11 +13555,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Defense Evasion Tactics"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 63 action.risk.param._risk_message = Suspicious modification of registry $registry_path$ with possible payload path $registry_value_name$ in $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -14242,11 +13600,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Ryuk Ransomware", "Domain Trust Discovery"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 15 action.risk.param._risk_message = Domain trust discovery execution on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -14331,11 +13686,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["HAFNIUM Group"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 42 action.risk.param._risk_message = Possible Nishang Invoke-PowerShellTCPOneLine behavior on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -14424,11 +13776,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Credential Dumping", "HAFNIUM Group"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 50 action.risk.param._risk_message = Active Directory NTDS export on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 50}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -14474,11 +13823,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Office 365 Detections", "Cloud Federated Credential Abuse"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 18 action.risk.param._risk_message = User $Actor.ID$ has created a new federation setting on $dest$ from IP Address $ActorIpAddress$ -action.risk.param._risk = [{"risk_object_field": "ActorIpAddress", "risk_object_type": "system", "risk_score": 18, "threat_object_field": "ActorIpAddress", "threat_object_type": "ip address"}, {"risk_object_field": "ActorIpAddress", "risk_object_type": "system", "risk_score": 18, "threat_object_field": "ActorIpAddress", "threat_object_type": "ip address"}, {"risk_object_field": "Actor.ID", "risk_object_type": "user", "risk_score": 18, "threat_object_field": "Actor.ID", "threat_object_type": "user"}, {"risk_object_field": "Actor.ID", "risk_object_type": "user", "risk_score": 18, "threat_object_field": "Actor.ID", "threat_object_type": "user"}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 18}] +action.risk.param._risk = [{"risk_object_field": "ActorIpAddress", "risk_object_type": "system", "risk_score": 18}, {"risk_object_field": "Actor.ID", "risk_object_type": "user", "risk_score": 18}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -14516,11 +13862,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Office 365 Detections", "Cloud Federated Credential Abuse"] action.risk = 1 -action.risk.param._risk_object = Target.ID -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 42 action.risk.param._risk_message = User $Actor.ID$ created a new federation setting on $Target.ID$ and added service principal credentials from IP Address $ActorIpAddress$ -action.risk.param._risk = [{"risk_object_field": "ActorIpAddress", "risk_object_type": "system", "risk_score": 42, "threat_object_field": "ActorIpAddress", "threat_object_type": "ip address"}, {"risk_object_field": "ActorIpAddress", "risk_object_type": "system", "risk_score": 42, "threat_object_field": "ActorIpAddress", "threat_object_type": "ip address"}, {"risk_object_field": "Target.ID", "risk_object_type": "system", "risk_score": 42}] +action.risk.param._risk = [{"risk_object_field": "ActorIpAddress", "risk_object_type": "system", "risk_score": 42}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -14558,11 +13901,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Office 365 Detections"] action.risk = 1 -action.risk.param._risk_object = user_id -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 42 action.risk.param._risk_message = User $user_id$ has added new IP addresses $ip_addresses_new_added$ to a list of trusted IPs to bypass MFA -action.risk.param._risk = [{"risk_object_field": "ip_addresses_new_added", "risk_object_type": "system", "risk_score": 42, "threat_object_field": "ip_addresses_new_added", "threat_object_type": "ip address"}, {"risk_object_field": "ip_addresses_new_added", "risk_object_type": "system", "risk_score": 42, "threat_object_field": "ip_addresses_new_added", "threat_object_type": "ip address"}, {"risk_object_field": "user_id", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user_id", "threat_object_type": "user"}, {"risk_object_field": "user_id", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user_id", "threat_object_type": "user"}] +action.risk.param._risk = [{"risk_object_field": "ip_addresses_new_added", "risk_object_type": "system", "risk_score": 42}, {"risk_object_field": "user_id", "risk_object_type": "user", "risk_score": 42}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -14600,11 +13940,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Office 365 Detections"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 64 action.risk.param._risk_message = User $user$ has executed an operation $Operation$ for this destination $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 64}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64, "threat_object_field": "user", "threat_object_type": "user"}] +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -14642,11 +13979,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Office 365 Detections"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 64 action.risk.param._risk_message = User $user$ has caused excessive number of authentication failures from $src_ip$ using UserAgent $UserAgent$. -action.risk.param._risk = [{"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 64, "threat_object_field": "src_ip", "threat_object_type": "ip address"}, {"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 64, "threat_object_field": "src_ip", "threat_object_type": "ip address"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64}] +action.risk.param._risk = [{"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 64}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -14684,11 +14018,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Office 365 Detections", "Cloud Federated Credential Abuse"] action.risk = 1 -action.risk.param._risk_object = UserId -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 64 action.risk.param._risk_message = User $UserId$ has caused excessive number of SSO logon errors from $ActorIpAddress$ using UserAgent $UserAgent$. -action.risk.param._risk = [{"risk_object_field": "ActorIpAddress", "risk_object_type": "system", "risk_score": 64, "threat_object_field": "ActorIpAddress", "threat_object_type": "ip address"}, {"risk_object_field": "ActorIpAddress", "risk_object_type": "system", "risk_score": 64, "threat_object_field": "ActorIpAddress", "threat_object_type": "ip address"}, {"risk_object_field": "UserId", "risk_object_type": "user", "risk_score": 64}] +action.risk.param._risk = [{"risk_object_field": "ActorIpAddress", "risk_object_type": "system", "risk_score": 64}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -14726,11 +14057,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Office 365 Detections", "Cloud Federated Credential Abuse"] action.risk = 1 -action.risk.param._risk_object = UserId -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 64 action.risk.param._risk_message = User $UserId$ has added a new federated domaain $Parameters.Value$ for $OrganizationName$ -action.risk.param._risk = [{"threat_object_field": "OrganizationName", "threat_object_type": "other"}, {"risk_object_field": "UserId", "risk_object_type": "user", "risk_score": 64}] +action.risk.param._risk = [{"threat_object_field": "OrganizationName", "threat_object_type": "other"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -14768,11 +14096,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Office 365 Detections", "Data Exfiltration"] action.risk = 1 -action.risk.param._risk_object = Source -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 48 action.risk.param._risk_message = User $Source$ has exported a PST file from the search using this operation- $Operation$ with a severity of $Severity$ -action.risk.param._risk = [{"risk_object_field": "Source", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "Source", "threat_object_type": "user"}, {"risk_object_field": "Source", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "Source", "threat_object_type": "user"}] +action.risk.param._risk = [{"risk_object_field": "Source", "risk_object_type": "user", "risk_score": 48}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -14810,11 +14135,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Office 365 Detections", "Data Exfiltration"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 48 action.risk.param._risk_message = User $user$ has configured a forwarding rule for multiple mailboxes to the same destination $ForwardingAddress$ -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "user", "threat_object_type": "user"}] +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 48}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -14852,11 +14174,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Office 365 Detections"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 48 action.risk.param._risk_message = User $user$ has delegated suspicious rights $AccessRights$ to user $dest_user$ that allow access to sensitive -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "user", "threat_object_type": "user"}] +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 48}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -14894,11 +14213,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Office 365 Detections", "Data Exfiltration"] action.risk = 1 -action.risk.param._risk_object = ForwardingSmtpAddress -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 48 action.risk.param._risk_message = User $user$ configured multiple users $src_user$ with a count of $count_src_user$, a forwarding rule to same destination $ForwardingSmtpAddress$ -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "ForwardingSmtpAddress", "risk_object_type": "user", "risk_score": 48}] +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 48}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -14936,11 +14252,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Spearphishing Attachments", "Trickbot"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 63 action.risk.param._risk_message = Office application spawning rundll32.exe on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -14984,11 +14297,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Spearphishing Attachments"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 49 action.risk.param._risk_message = Office document creating a schedule task on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -15031,11 +14341,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Spearphishing Attachments", "Trickbot"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 35 action.risk.param._risk_message = Office document executing a macro on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -15078,11 +14385,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Spearphishing Attachments"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 35 action.risk.param._risk_message = Office document spawning suspicious child process on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -15125,11 +14429,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Trickbot"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 56 action.risk.param._risk_message = an office product parent process $parent_process_name$ spawn child process $process_name$ in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -15173,11 +14474,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Spearphishing Attachments"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 63 action.risk.param._risk_message = office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"threat_object_field": "process_name", "threat_object_type": "process_name"}] +action.risk.param._risk = [{"threat_object_field": "process_name", "threat_object_type": "process_name"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -15221,11 +14519,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Spearphishing Attachments"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 63 action.risk.param._risk_message = office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"threat_object_field": "process_name", "threat_object_type": "process_name"}] +action.risk.param._risk = [{"threat_object_field": "process_name", "threat_object_type": "process_name"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -15269,11 +14564,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Spearphishing Attachments"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 63 action.risk.param._risk_message = office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"threat_object_field": "process_name", "threat_object_type": "process_name"}] +action.risk.param._risk = [{"threat_object_field": "process_name", "threat_object_type": "process_name"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -15317,11 +14609,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Spearphishing Attachments"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 63 action.risk.param._risk_message = office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ and no dll commandline $process$ in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"threat_object_field": "process_name", "threat_object_type": "process name"}] +action.risk.param._risk = [{"threat_object_field": "process_name", "threat_object_type": "process name"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -15365,11 +14654,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Spearphishing Attachments"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 63 action.risk.param._risk_message = office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"threat_object_field": "process_name", "threat_object_type": "process_name"}] +action.risk.param._risk = [{"threat_object_field": "process_name", "threat_object_type": "process_name"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -15614,11 +14900,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Privilege Escalation"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 72 action.risk.param._risk_message = A suspicious file modification or replace in $file_path$ in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "file_path", "threat_object_type": "file_path"}] +action.risk.param._risk = [{"threat_object_field": "file_path", "threat_object_type": "file_path"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -15662,11 +14945,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Ransomware"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 56 action.risk.param._risk_message = A suspicious of execution of $process_name$ with process id $process_id$ and commandline $process$ to modify permission of directory or files in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"threat_object_field": "process_name", "threat_object_type": "process name"}] +action.risk.param._risk = [{"threat_object_field": "process_name", "threat_object_type": "process name"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -15710,9 +14990,6 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Command and Control", "Data Exfiltration"] action.risk = 1 -action.risk.param._risk_object = -action.risk.param._risk_object_type = -action.risk.param._risk_score = 63 action.risk.param._risk_message = A http post $http_method$ sending packet with plain text of information $form_data$ in uri path $uri_path$ action.risk.param._risk = [{"threat_object_field": "uri_path", "threat_object_type": "uripath"}, {"threat_object_field": "form_data", "threat_object_type": "formdata"}] action.risk.param.verbose = 0 @@ -15761,11 +15038,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Malicious PowerShell"] action.risk = 1 -action.risk.param._risk_object = User -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 42 action.risk.param._risk_message = A suspicious powershell script contains domain enumeration command in $Message$ with EventCode $EventCode$ in host $ComputerName$ -action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 42}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 42}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -15814,11 +15088,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Malicious PowerShell"] action.risk = 1 -action.risk.param._risk_object = User -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 56 action.risk.param._risk_message = A suspicious powershell script contains reflective class assembly command in $Message$ to load .net code in memory with EventCode $EventCode$ in host $ComputerName$ -action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 56}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 56}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -15863,11 +15134,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["BITS Jobs"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 56 action.risk.param._risk_message = A suspicious process $process_name$ with commandline $process$ that are related to bittransfer functionality in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -15911,11 +15179,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Malicious PowerShell"] action.risk = 1 -action.risk.param._risk_object = User -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 40 action.risk.param._risk_message = A suspicious powershell script contains Thread Mutex in $Message$ with EventCode $EventCode$ in host $ComputerName$ -action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 40}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 40}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -16045,11 +15310,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Malicious PowerShell"] action.risk = 1 -action.risk.param._risk_object = User -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 48 action.risk.param._risk_message = A suspicious powershell script contains GetProcAddress API in $Message$ with EventCode $EventCode$ in host $ComputerName$ -action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 48}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 48}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -16101,11 +15363,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Malicious PowerShell"] action.risk = 1 -action.risk.param._risk_object = User -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 56 action.risk.param._risk_message = A suspicious powershell script contains base64 command in $Message$ with EventCode $EventCode$ in host $ComputerName$ -action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 56}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 56}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -16151,11 +15410,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Malicious PowerShell"] action.risk = 1 -action.risk.param._risk_object = User -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 40 action.risk.param._risk_message = A suspicious powershell script contains stream command in $Message$ commonly for processing compressed or to decompressed binary file with EventCode $EventCode$ in host $ComputerName$ -action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 40}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 40}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -16198,11 +15454,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Trickbot"] action.risk = 1 -action.risk.param._risk_object = Computer -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 63 action.risk.param._risk_message = A suspicious powershell process $process_name$ that tries to create a remote thread on target process $TargetImage$ with eventcode $EventCode$ in host $Computer$ -action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 63}, {"threat_object_field": "process_name", "threat_object_type": "process name"}] +action.risk.param._risk = [{"threat_object_field": "process_name", "threat_object_type": "process name"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -16245,11 +15498,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Malicious PowerShell"] action.risk = 1 -action.risk.param._risk_object = User -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 40 action.risk.param._risk_message = A suspicious powershell script contains memorystream command in $Message$ as new object backstore with EventCode $EventCode$ in host $ComputerName$ -action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 40}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 40}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -16292,11 +15542,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Ransomware"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 56 action.risk.param._risk_message = A suspicious process $process_name$ with process id $process_id$ contains commandline $process$ to ignore all bcdedit execution failure in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -16344,11 +15591,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["PrintNightmare CVE-2021-34527"] action.risk = 1 -action.risk.param._risk_object = ComputerName -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 72 action.risk.param._risk_message = Suspicious print driver was loaded on endpoint $ComputerName$. -action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 72}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -16399,11 +15643,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["PrintNightmare CVE-2021-34527"] action.risk = 1 -action.risk.param._risk_object = ComputerName -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 72 action.risk.param._risk_message = Suspicious printer spooler errors have occured on endpoint $ComputerName$ with EventCode $EventCode$. -action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 72}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -16449,11 +15690,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Spearphishing Attachments"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 63 action.risk.param._risk_message = A process $process_name$ that launching .lnk file in $file_path$ in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 63}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -16497,11 +15735,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Clop Ransomware"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 60 action.risk.param._risk_message = A process $Image$ tries to delete its process path in commandline $cmdline$ as part of defense evasion in host $Computer$ -action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 60}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 60}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -16545,11 +15780,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious WMI Use"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 49 action.risk.param._risk_message = A remote instance execution of wmic.exe that will spawn $parent_process_name$ in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -16593,11 +15825,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["XMRig"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 56 action.risk.param._risk_message = A process $process_name$ attempt to kill process by its file path using commandline $process$ in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -16722,11 +15951,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Netsh Abuse", "Disabling Security Tools", "DHS Report TA18-074A"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 42 action.risk.param._risk_message = A process $process_name$ that tries to execute netsh commandline $process$ in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -16932,11 +16158,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Clop Ransomware", "DarkSide Ransomware"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 81 action.risk.param._risk_message = A high frequency file creation of $file_name$ in different file path in host $Computer$ -action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 81}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 81}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -16979,11 +16202,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Ransomware", "Malicious PowerShell"] action.risk = 1 -action.risk.param._risk_object = User -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 56 action.risk.param._risk_message = A suspicious powershell script contains AV recon command in $Message$ with EventCode $EventCode$ in host $ComputerName$ -action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 56}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 56}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -17026,11 +16246,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Malicious PowerShell"] action.risk = 1 -action.risk.param._risk_object = User -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 60 action.risk.param._risk_message = A suspicious powershell script contains host recon command in $Message$ with EventCode $EventCode$ in host $ComputerName$ -action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 60}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 60}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -17114,11 +16331,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Service Abuse", "Windows Persistence Techniques"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 45 action.risk.param._risk_message = A reg.exe process $process_name$ with commandline $process$ in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 45}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 45}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -17203,11 +16417,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Windows Registry Activities", "Suspicious MSHTA Activity", "DHS Report TA18-074A", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Ransomware", "Windows Persistence Techniques", "Emotet Malware DHS Report TA18-201A "] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 76 action.risk.param._risk_message = A registry activity in $registry_path$ related to persistence in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 76}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 76}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -17251,11 +16462,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Privilege Escalation", "Suspicious Windows Registry Activities", "Cloud Federated Credential Abuse"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 76 action.risk.param._risk_message = A registry activity in $registry_path$ related to privilege escalation in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 76}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 76}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -17299,11 +16507,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Windows Registry Activities", "Windows Persistence Techniques"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 56 action.risk.param._risk_message = A registry activity in $registry_path$ related to shim modication in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -17470,11 +16675,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Ransomware", "Suspicious WMI Use"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 49 action.risk.param._risk_message = A wmic.exe process $process$ contain process spawn commandline $process$ in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -17559,11 +16761,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious WMI Use"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 36 action.risk.param._risk_message = A wmic.exe process $process$ contain node commandline $process$ in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 36}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -17607,11 +16806,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Clop Ransomware"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 72 action.risk.param._risk_message = A process $parent_process_name$ attempt to resize shadow copy with commandline $process$ in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 72}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -17655,11 +16851,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Ransomware", "Revil Ransomware"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 54 action.risk.param._risk_message = A process $process_name$ with commandline $process$ related to revil ransomware in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 54}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 54}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -17703,11 +16896,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Ransomware", "Revil Ransomware"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 60 action.risk.param._risk_message = A registry entry $registry_path$ with registry value $registry_value_name$ and $registry_value_name$ related to revil ransomware in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 60}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 60}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -17751,11 +16941,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Unusual Processes"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 70 action.risk.param._risk_message = A rundll32 process $process_name$ with ordinal parameter like this process commandline $process$ in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 70}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 70}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -17799,11 +16986,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Rundll32 Activity", "Cobalt Strike", "PrintNightmare CVE-2021-34527"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 70 action.risk.param._risk_message = A rundll32 process $process_name$ with no commandline argument like this process commandline $process$ in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 70}, {"threat_object_field": "process_name", "threat_object_type": "processname"}] +action.risk.param._risk = [{"threat_object_field": "process_name", "threat_object_type": "processname"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -17847,11 +17031,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Ryuk Ransomware"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 70 action.risk.param._risk_message = A creation of ryuk test file $file_path$ in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 70}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 70}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -17894,11 +17075,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Ryuk Ransomware"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 63 action.risk.param._risk_message = A process $process_name$ with wake on LAN commandline $process$ in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 63}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -17942,11 +17120,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Credential Dumping"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 80 action.risk.param._risk_message = The following process $process_name$ accessed the object $Object_Name$ attempting to gain access to credentials on $dest$ by user $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "process_name", "threat_object_type": "process"}, {"threat_object_field": "Object_Name", "threat_object_type": "file"}] +action.risk.param._risk = [{"threat_object_field": "process_name", "threat_object_type": "process"}, {"threat_object_field": "Object_Name", "threat_object_type": "file"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -17990,11 +17165,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["DarkSide Ransomware", "Windows Defense Evasion Tactics"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 63 action.risk.param._risk_message = A slui process $process_name$ with elevated commandline $process$ in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"risk_object_field": "user", "risk_object_type": "system", "risk_score": 63}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -18038,11 +17210,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["DarkSide Ransomware", "Windows Defense Evasion Tactics"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 63 action.risk.param._risk_message = A slui process $parent_process_name$ spawning child process $process_name$ in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 63}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -18212,11 +17381,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["SamSam Ransomware"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 12 action.risk.param._risk_message = A samsam ransomware test file creation in $file_path$ in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 12}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 12}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -18260,11 +17426,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Service Abuse", "DHS Report TA18-074A", "Orangeworm Attack Group", "Windows Persistence Techniques", "Disabling Security Tools", "NOBELIUM Group"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 56 action.risk.param._risk_message = A sc process $process_name$ with commandline $process$ to create of configure services in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -18308,11 +17471,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Persistence Techniques"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 63 action.risk.param._risk_message = A schedule task process commandline arguments $Arguments$ with http string on it in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"threat_object_field": "Arguments", "threat_object_type": "arguments"}] +action.risk.param._risk = [{"threat_object_field": "Arguments", "threat_object_type": "arguments"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -18355,11 +17515,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Persistence Techniques", "Trickbot"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 70 action.risk.param._risk_message = A schedule task process commandline rundll32 arguments $Arguments$ in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 70}, {"threat_object_field": "Arguments", "threat_object_type": "arguments"}] +action.risk.param._risk = [{"threat_object_field": "Arguments", "threat_object_type": "arguments"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -18402,11 +17559,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["DHS Report TA18-074A", "NOBELIUM Group"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 56 action.risk.param._risk_message = A schedule task process $process_name$ with create or delete commandline $process$ in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -18491,11 +17645,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["XMRig"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 48 action.risk.param._risk_message = A "on demand" execution of schedule task process $process_name$ using commandline $process$ in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 48}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 48}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -18539,11 +17690,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Lateral Movement", "NOBELIUM Group"] action.risk = 1 -action.risk.param._risk_object = Processes.user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 63 action.risk.param._risk_message = A schedule task process $process_name$ with remote job commandline $process$ in host $dest$ -action.risk.param._risk = [{"risk_object_field": "Processes.dest", "risk_object_type": "system", "risk_score": 63}, {"risk_object_field": "Processes.user", "risk_object_type": "user", "risk_score": 63}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -18587,11 +17735,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Persistence Techniques", "Ransomware"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 56 action.risk.param._risk_message = A schedule task process $process_name$ with force reboot commandline $process$ in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -18635,11 +17780,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious WMI Use"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 36 action.risk.param._risk_message = A wmic.exe process $process_name$ taht execute script in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 36}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -18683,11 +17825,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Defense Evasion Tactics"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 63 action.risk.param._risk_message = Suspicious modification of registry $registry_path$ with possible payload path $registry_value_name$ in $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -18731,11 +17870,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Cobalt Strike"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 70 action.risk.param._risk_message = A searchprotocolhost.exe process $process_name$ with no commandline in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 70}, {"threat_object_field": "process_name", "threat_object_type": "processname"}] +action.risk.param._risk = [{"threat_object_field": "process_name", "threat_object_type": "processname"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -18779,11 +17915,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Credential Dumping"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 80 action.risk.param._risk_message = A secretdump process $process_name$ with secretdump commandline $process$ to dump credentials in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -18827,11 +17960,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Cobalt Strike"] action.risk = 1 -action.risk.param._risk_object = Processes.user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 76 action.risk.param._risk_message = A service process $parent_process_name$ with process path $process_path$ in host $dest$ -action.risk.param._risk = [{"risk_object_field": "Processes.dest", "risk_object_type": "system", "risk_score": 76}, {"risk_object_field": "Processes.user", "risk_object_type": "user", "risk_score": 76}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -18875,11 +18005,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Malicious PowerShell", "Credential Dumping", "HAFNIUM Group"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 48 action.risk.param._risk_message = A registry modification in $registry_path$ with reg key $registry_key_name$ and reg value $registry_value_name$ in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 48}, {"threat_object_field": "registry_path", "threat_object_type": "registrypath"}] +action.risk.param._risk = [{"threat_object_field": "registry_path", "threat_object_type": "registrypath"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -18923,11 +18050,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Persistence Techniques"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 56 action.risk.param._risk_message = A process that possibly write shim database in $file_path$ in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"threat_object_field": "file_path", "threat_object_type": "file path"}] +action.risk.param._risk = [{"threat_object_field": "file_path", "threat_object_type": "file path"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -18971,11 +18095,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Persistence Techniques"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 63 action.risk.param._risk_message = A process $process_name$ that possible create a shim db silently in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 63}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -19019,11 +18140,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Account Monitoring and Controls"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 63 action.risk.param._risk_message = A user account created or delete shortly in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 63}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -19067,11 +18185,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Defense Evasion Tactics"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 63 action.risk.param._risk_message = Suspicious modification of registry $registry_path$ with possible payload path $registry_value_name$ in $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -19115,11 +18230,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["DHS Report TA18-074A"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 63 action.risk.param._risk_message = A suspicious process $process_name$ with single letter in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 63}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -19285,11 +18397,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["PrintNightmare CVE-2021-34527"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 72 action.risk.param._risk_message = $parent_process$ has spawned $process_name$ on endpoint $ComputerName$. This behavior is suspicious and related to PrintNightmare. -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "parent_process_id", "threat_object_type": "process"}, {"threat_object_field": "process_id", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "parent_process_id", "threat_object_type": "process"}, {"threat_object_field": "process_id", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -19333,11 +18442,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["PrintNightmare CVE-2021-34527"] action.risk = 1 -action.risk.param._risk_object = Computer -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 72 action.risk.param._risk_message = $Image$ with process id $process_id$ has loaded a driver from $ImageLoaded$ on endpoint $Computer$. This behavior is suspicious and related to PrintNightmare. -action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "process_id", "threat_object_type": "process name"}, {"threat_object_field": "ImageLoaded", "threat_object_type": "file"}] +action.risk.param._risk = [{"threat_object_field": "process_id", "threat_object_type": "process name"}, {"threat_object_field": "ImageLoaded", "threat_object_type": "file"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -19380,11 +18486,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["PrintNightmare CVE-2021-34527"] action.risk = 1 -action.risk.param._risk_object = Computer -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 72 action.risk.param._risk_message = $SourceImage$ was GrantedAccess open access to $TargetImage$ on endpoint $Computer$. This behavior is suspicious and related to PrintNightmare. -action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "ProcessID", "threat_object_type": "process"}, {"threat_object_field": "TargetImage", "threat_object_type": "process name"}] +action.risk.param._risk = [{"threat_object_field": "ProcessID", "threat_object_type": "process"}, {"threat_object_field": "TargetImage", "threat_object_type": "process name"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -19427,11 +18530,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["PrintNightmare CVE-2021-34527"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 72 action.risk.param._risk_message = $process_name$ has been identified writing dll's to $file_path$ on endpoint $dest$. This behavior is suspicious and related to PrintNightmare. -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "process_id", "threat_object_type": "process"}, {"threat_object_field": "file_path", "threat_object_type": "file"}] +action.risk.param._risk = [{"threat_object_field": "process_id", "threat_object_type": "process"}, {"threat_object_field": "file_path", "threat_object_type": "file"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -19475,11 +18575,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["PrintNightmare CVE-2021-34527"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 72 action.risk.param._risk_message = $process_name$ has been identified writing dll's to $file_path$ on endpoint $dest$. This behavior is suspicious and related to PrintNightmare. -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "process_id", "threat_object_type": "process"}, {"threat_object_field": "file_path", "threat_object_type": "file"}] +action.risk.param._risk = [{"threat_object_field": "process_id", "threat_object_type": "process"}, {"threat_object_field": "file_path", "threat_object_type": "file"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -19522,9 +18619,6 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Ransomware"] action.risk = 1 -action.risk.param._risk_object = -action.risk.param._risk_object_type = -action.risk.param._risk_score = 42 action.risk.param._risk_message = Safeboot registry $Registry.registry_path$ was added or modified with a new value $Registry.registry_value_name$ action.risk.param._risk = [] action.risk.param.verbose = 0 @@ -19734,11 +18828,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Cobalt Strike"] action.risk = 1 -action.risk.param._risk_object = User -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 49 action.risk.param._risk_message = Suspicious dllhost.exe process with no command line arguments executed on $dest$ by $user$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 49}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -19782,11 +18873,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["XMRig"] action.risk = 1 -action.risk.param._risk_object = Computer -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 63 action.risk.param._risk_message = Suspicious driver $ImageLoaded$ on $Computer$ -action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 63}, {"threat_object_field": "ImageLoaded", "threat_object_type": "file name"}] +action.risk.param._risk = [{"threat_object_field": "ImageLoaded", "threat_object_type": "file name"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -19912,11 +19000,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Log Manipulation", "Ransomware", "Clop Ransomware"] action.risk = 1 -action.risk.param._risk_object = ComputerName -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 9 action.risk.param._risk_message = The Windows Event Log Service shutdown on $ComputerName$ -action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 9}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -20001,11 +19086,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Cobalt Strike"] action.risk = 1 -action.risk.param._risk_object = User -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 49 action.risk.param._risk_message = Suspicious gpupdate.exe process with no command line arguments executed on $dest$ by $user$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 49}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -20090,11 +19172,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Trusted Developer Utilities Proxy Execution MSBuild", "Cobalt Strike", "Masquerading - Rename System Utilities"] action.risk = 1 -action.risk.param._risk_object = User -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 63 action.risk.param._risk_message = Suspicious renamed msbuild.exe binary ran on $dest$ by $user$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 63}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -20138,11 +19217,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Trusted Developer Utilities Proxy Execution MSBuild"] action.risk = 1 -action.risk.param._risk_object = User -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 42 action.risk.param._risk_message = Suspicious msbuild.exe process executed on $dest$ by $user$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 42}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -20309,11 +19385,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["XMRig"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 35 action.risk.param._risk_message = Suspicioues process $Processes.process_path.file_path$ running from suspicious location -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}, {"threat_object_field": "Processes.process_path.file_path", "threat_object_type": "file name"}] +action.risk.param._risk = [{"threat_object_field": "Processes.process_path.file_path", "threat_object_type": "file name"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -20357,11 +19430,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Disabling Security Tools", "DHS Report TA18-074A"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 35 action.risk.param._risk_message = Suspicious $Processes.process_path.file_path$ process running with an uncommon parent process $Processes.parent_process_name$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}, {"threat_object_field": "Processes.process_path.file_path", "threat_object_type": "file name"}] +action.risk.param._risk = [{"threat_object_field": "Processes.process_path.file_path", "threat_object_type": "file name"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -20405,11 +19475,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Regsvr32 Activity"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 35 action.risk.param._risk_message = Suspicious $Processes.process_path.file_path$ process potentially loading malicious code -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}, {"threat_object_field": "Processes.process_path.file_path", "threat_object_type": "file name"}] +action.risk.param._risk = [{"threat_object_field": "Processes.process_path.file_path", "threat_object_type": "file name"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -20453,11 +19520,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Rundll32 Activity", "Masquerading - Rename System Utilities"] action.risk = 1 -action.risk.param._risk_object = User -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 63 action.risk.param._risk_message = Suspicious renamed rundll32.exe binary ran on $dest$ by $user$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 63}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -20501,11 +19565,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Rundll32 Activity", "Cobalt Strike", "Trickbot"] action.risk = 1 -action.risk.param._risk_object = User -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 35 action.risk.param._risk_message = rundll32.exe running with suspicious parameters on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 35}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -20549,11 +19610,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Rundll32 Activity"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 35 action.risk.param._risk_message = $Processes.process_path.file_path$ process potentially loading malicious code -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}, {"threat_object_field": "Processes.process_path.file_path", "threat_object_type": "file name"}] +action.risk.param._risk = [{"threat_object_field": "Processes.process_path.file_path", "threat_object_type": "file name"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -20597,11 +19655,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Rundll32 Activity", "Cobalt Strike", "PrintNightmare CVE-2021-34527"] action.risk = 1 -action.risk.param._risk_object = User -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 49 action.risk.param._risk_message = Suspicious rundll32.exe process with no command line arguments executed on $dest$ by $user$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 49}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -20686,11 +19741,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Ransomware", "Ryuk Ransomware", "Windows Persistence Techniques"] action.risk = 1 -action.risk.param._risk_object = User -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 35 action.risk.param._risk_message = Suspicious scheduled task registered on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 35}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -20734,11 +19786,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Cobalt Strike"] action.risk = 1 -action.risk.param._risk_object = User -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 49 action.risk.param._risk_message = Suspicious searchprotocolhost.exe process with no command line arguments executed on $dest$ by $user$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 49}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -20782,11 +19831,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Trusted Developer Utilities Proxy Execution", "Cobalt Strike", "Masquerading - Rename System Utilities"] action.risk = 1 -action.risk.param._risk_object = User -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 63 action.risk.param._risk_message = Suspicious renamed microsoft.workflow.compiler.exe binary ran on $dest$ by $user$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 63}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -20830,11 +19876,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Trusted Developer Utilities Proxy Execution"] action.risk = 1 -action.risk.param._risk_object = User -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 35 action.risk.param._risk_message = Suspicious microsoft.workflow.compiler.exe process ran on $dest$ by $user$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 35}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -20878,11 +19921,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Trusted Developer Utilities Proxy Execution MSBuild", "Cobalt Strike", "Masquerading - Rename System Utilities"] action.risk = 1 -action.risk.param._risk_object = User -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 49 action.risk.param._risk_message = Msbuild.exe ran from an uncommon path on $dest$ execyted by $user$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 49}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -20926,11 +19966,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious MSHTA Activity"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 40 action.risk.param._risk_message = suspicious mshta child process detected on host $dest$ by user $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 40}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 40}, {"threat_object_field": "parent_process", "threat_object_type": "process name"}] +action.risk.param._risk = [{"threat_object_field": "parent_process", "threat_object_type": "process name"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -20974,11 +20011,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious MSHTA Activity"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 42 action.risk.param._risk_message = mshta.exe spawned by wmiprvse.exe on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -21022,11 +20056,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Log Manipulation", "Ransomware", "Clop Ransomware"] action.risk = 1 -action.risk.param._risk_object = User -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 28 action.risk.param._risk_message = Wevtutil.exe being used to clear Event Logs on $dest$ by $user$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 28}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 28}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -21110,11 +20141,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Collection and Staging"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 28 action.risk.param._risk_message = Suspicious writes to windows Recycle Bin process $Processes.process_name$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 28}, {"threat_object_field": "Processes.process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "Processes.process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -21158,11 +20186,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Discovery Techniques"] action.risk = 1 -action.risk.param._risk_object = User -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 15 action.risk.param._risk_message = Potential system information discovery behavior on $dest$ by $User$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 15, "threat_object_field": "User", "threat_object_type": "user"}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 15, "threat_object_field": "User", "threat_object_type": "user"}] +action.risk.param._risk = [{"risk_object_field": "User", "risk_object_type": "user", "risk_score": 15}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -21210,11 +20235,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Command-Line Executions", "Unusual Processes", "Ransomware", "Masquerading - Rename System Utilities"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 49 action.risk.param._risk_message = System process running from unexpected location on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"threat_object_field": "Processes.process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "Processes.process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -21300,11 +20322,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Trickbot"] action.risk = 1 -action.risk.param._risk_object = Computer -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 42 action.risk.param._risk_message = Possible Trickbot namedpipe created on $Computer$ by $Image$ -action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 42}, {"threat_object_field": "Image", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "Image", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -21347,11 +20366,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Defense Evasion Tactics"] action.risk = 1 -action.risk.param._risk_object = Computer -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 63 action.risk.param._risk_message = Suspicious unsigned $ImageLoaded$ loaded by $Image$ on endpoint $Computer$ with EventCode $EventCode$ -action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 63}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -21394,11 +20410,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Log Manipulation", "Ransomware"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 45 action.risk.param._risk_message = Possible USN journal deletion on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 45}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -21483,11 +20496,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["HAFNIUM Group"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 56 action.risk.param._risk_message = Possible CVE-2021-26857 exploitation on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -21531,11 +20541,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Disabling Security Tools"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 45 action.risk.param._risk_message = Possible Sysmon filter driver unloading on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 45}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -21583,11 +20590,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Malicious PowerShell"] action.risk = 1 -action.risk.param._risk_object = ComputerName -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 49 action.risk.param._risk_message = Possible AMSI Unloading via Reflection using PowerShell on $ComputerName$ -action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 49}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -21713,11 +20717,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Command-Line Executions", "Unusual Processes", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Ransomware"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 42 action.risk.param._risk_message = Unusually long command line $Processes.process_name$ on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}, {"threat_object_field": "Processes.process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "Processes.process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -21842,11 +20843,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["HAFNIUM Group"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 56 action.risk.param._risk_message = Possible Web Shell execution on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -21890,11 +20888,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Ryuk Ransomware", "Ransomware"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 15 action.risk.param._risk_message = System backups deletion on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -21989,11 +20984,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious WMI Use"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 30 action.risk.param._risk_message = User $user$ on $host$ executed the following suspicious WMI query: $Query$. Filter: $filter$. Consumer: $Consumer$. EventCode: $EventCode$ -action.risk.param._risk = [{"risk_object_field": "host", "risk_object_type": "system", "risk_score": 30}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 30}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -22042,11 +21034,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Malicious PowerShell"] action.risk = 1 -action.risk.param._risk_object = User -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 30 action.risk.param._risk_message = Suspicious powerShell script execution by $user$ on $ComputerName$ via EventCode 4104, where WMI is performing an event query looking for running processes or running services -action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 30}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 30}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -22129,11 +21118,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Defense Evasion Tactics"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 63 action.risk.param._risk_message = Suspicious modification of registry $registry_path$ with possible payload path $registry_value_name$ in $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -22177,11 +21163,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Ransomware", "Revil Ransomware"] action.risk = 1 -action.risk.param._risk_object = Computer -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 35 action.risk.param._risk_message = Suspicious COM Object Execution on $Computer$ -action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 35}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -22387,11 +21370,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Trickbot"] action.risk = 1 -action.risk.param._risk_object = ComputerName -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 56 action.risk.param._risk_message = Wermgr.exe process connecting IP location web services on $ComputerName$ -action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 56}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -22434,11 +21414,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Trickbot"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 56 action.risk.param._risk_message = Wermgr.exe writing executable files on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -22482,11 +21459,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Trickbot"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 56 action.risk.param._risk_message = Wermgr.exe spawning suspicious processes on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -22538,11 +21512,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Persistence Techniques", "Ransomware", "Ryuk Ransomware"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 70 action.risk.param._risk_message = A windows scheduled task was created (task name=$Task_Name$) on $dest$ by the following command: $Command$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 70}, {"threat_object_field": "Command", "threat_object_type": "command"}] +action.risk.param._risk = [{"threat_object_field": "Command", "threat_object_type": "command"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -22597,11 +21568,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Persistence Techniques", "Ransomware", "Ryuk Ransomware"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 70 action.risk.param._risk_message = A windows scheduled task was created (task name=$Task_Name$) on $dest$ by the following command: $Command$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 70}, {"threat_object_field": "Command", "threat_object_type": "command"}] +action.risk.param._risk = [{"threat_object_field": "Command", "threat_object_type": "command"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -22730,11 +21698,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Ryuk Ransomware", "Windows Defense Evasion Tactics"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 24 action.risk.param._risk_message = Windows DisableAntiSpyware registry key set to 'disabled' on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 24}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -22778,11 +21743,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Log Manipulation", "Ransomware", "Clop Ransomware"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 70 action.risk.param._risk_message = Windows event logs cleared on $dest$ via EventCode $EventCode$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 70}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -22826,11 +21788,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Ryuk Ransomware"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 70 action.risk.param._risk_message = The Windows Security Account Manager (SAM) was stopped via cli by $user$ on $dest$ by this command: $processs$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 70}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 70}, {"threat_object_field": "process", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "process", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -22955,11 +21914,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Spearphishing Attachments"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 70 action.risk.param._risk_message = $parent_process_name$ on $dest$ by $user$ launched command: $process_name$ which is very common in spearphishing attacks. -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 70}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 70}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -23003,11 +21959,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Spearphishing Attachments"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 70 action.risk.param._risk_message = $parent_process_name$ on $dest$ by $user$ launched the following powershell process: $process_name$ which is very common in spearphishing attacks -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 70}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 70}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -23051,11 +22004,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Spearphishing Attachment"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 70 action.risk.param._risk_message = User $user$ on $dest$ spawned Windows Script Host from Winword.exe -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 70}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 70}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk = [{"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -23099,11 +22049,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Trickbot"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 70 action.risk.param._risk_message = $user$ dropped or created an executable file in known sensitive SMB share. Share name=$Share_Name$, Target name=$Relative_Target_Name$, and Access mask=$Access_Mask$ -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 70}] +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -23147,11 +22094,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["XMRig"] action.risk = 1 -action.risk.param._risk_object = Computer -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 80 action.risk.param._risk_message = A driver $ImageLoaded$ related to xmrig crytominer loaded in host $Computer$ -action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "ImageLoaded", "threat_object_type": "imageloaded"}] +action.risk.param._risk = [{"threat_object_field": "ImageLoaded", "threat_object_type": "imageloaded"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m diff --git a/dist/escu/default/transforms.conf b/dist/escu/default/transforms.conf index 29bbe5999c..d86c626720 100644 --- a/dist/escu/default/transforms.conf +++ b/dist/escu/default/transforms.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-28T20:05:49 UTC +# On Date: 2021-07-29T20:53:17 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/use_case_library.conf b/dist/escu/default/use_case_library.conf index 5f39a02620..bb9d1d57fb 100644 --- a/dist/escu/default/use_case_library.conf +++ b/dist/escu/default/use_case_library.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-28T20:05:49 UTC +# On Date: 2021-07-29T20:53:17 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -2950,7 +2950,7 @@ asset_type = AWS Instance confidence = medium explanation = This search looks for a spike in number of of AWS security Hub alerts for an EC2 instance in 4 hours intervals how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security Hub inputs. The threshold_value should be tuned to your environment and schedule these searches according to the bucket span interval. -annotations = {"cis20": ["CIS 13"], "nist": ["DE.DP", "DE.AE"]} +annotations = {"cis20": ["CIS 13"], "nist": ["DE.DP"]} known_false_positives = None providing_technologies = [] diff --git a/dist/saaws/default/analytic_stories.conf b/dist/saaws/default/analytic_stories.conf index 3dde3b1120..02150efdf8 100644 --- a/dist/saaws/default/analytic_stories.conf +++ b/dist/saaws/default/analytic_stories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-28T20:06:09 UTC +# On Date: 2021-07-29T20:53:37 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -50,7 +50,7 @@ id = 2f2f610a-d64d-48c2-b57c-96722b49ab5a version = 1 reference = ["https://aws.amazon.com/security-hub/features/"] detection_searches = ["ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule"] -mappings = {"cis20": ["CIS 13"], "nist": ["DE.AE", "DE.DP"]} +mappings = {"cis20": ["CIS 13"], "nist": ["DE.DP"]} investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task"] support_searches = [] data_models = [] diff --git a/dist/saaws/default/analyticstories.conf b/dist/saaws/default/analyticstories.conf index 06008e8fdc..c941421ddb 100644 --- a/dist/saaws/default/analyticstories.conf +++ b/dist/saaws/default/analyticstories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-28T20:06:09 UTC +# On Date: 2021-07-29T20:53:37 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -553,7 +553,7 @@ asset_type = AWS Instance confidence = medium explanation = This search looks for a spike in number of of AWS security Hub alerts for an EC2 instance in 4 hours intervals how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security Hub inputs. The threshold_value should be tuned to your environment and schedule these searches according to the bucket span interval. -annotations = {"cis20": ["CIS 13"], "nist": ["DE.DP", "DE.AE"]} +annotations = {"cis20": ["CIS 13"], "nist": ["DE.DP"]} known_false_positives = None providing_technologies = [] diff --git a/dist/saaws/default/app.conf b/dist/saaws/default/app.conf index 67c95aec40..aebee6a561 100644 --- a/dist/saaws/default/app.conf +++ b/dist/saaws/default/app.conf @@ -4,7 +4,7 @@ is_configured = false state = enabled state_change_requires_restart = false -build = 35181 +build = 35236 [triggers] reload.analytic_stories = simple diff --git a/dist/saaws/default/collections.conf b/dist/saaws/default/collections.conf index 24ee68a300..722a002171 100644 --- a/dist/saaws/default/collections.conf +++ b/dist/saaws/default/collections.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-28T20:06:09 UTC +# On Date: 2021-07-29T20:53:37 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/saaws/default/macros.conf b/dist/saaws/default/macros.conf index 791e0fd57e..2a68c27d93 100644 --- a/dist/saaws/default/macros.conf +++ b/dist/saaws/default/macros.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-28T20:06:09 UTC +# On Date: 2021-07-29T20:53:37 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/saaws/default/savedsearches.conf b/dist/saaws/default/savedsearches.conf index 5444dbeeb9..20f19ea76f 100644 --- a/dist/saaws/default/savedsearches.conf +++ b/dist/saaws/default/savedsearches.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-28T20:06:09 UTC +# On Date: 2021-07-29T20:53:37 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -25,11 +25,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS IAM Privilege Escalation"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 49 action.risk.param._risk_message = User $user$ created a policy version that allows them to access any resource in their account -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49, "threat_object_field": "user", "threat_object_type": "user"}] +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -67,11 +64,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS IAM Privilege Escalation"] action.risk = 1 -action.risk.param._risk_object = user_arn -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 63 action.risk.param._risk_message = User $user_arn$ is attempting to create access keys for $requestParameters.userName$ from this IP $src$ -action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 63, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 63, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 63, "threat_object_field": "user_arn", "threat_object_type": "user"}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 63, "threat_object_field": "user_arn", "threat_object_type": "user"}] +action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 63}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 63}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -109,11 +103,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS IAM Privilege Escalation"] action.risk = 1 -action.risk.param._risk_object = user_arn -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 72 action.risk.param._risk_message = User $user_arn$ is attempting to create a login profile for $requestParameters.userName$ and did a console login from this IP $src_ip$ -action.risk.param._risk = [{"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 72, "threat_object_field": "src_ip", "threat_object_type": "ip address"}, {"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 72, "threat_object_field": "src_ip", "threat_object_type": "ip address"}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 72, "threat_object_field": "user_arn", "threat_object_type": "user"}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 72, "threat_object_field": "user_arn", "threat_object_type": "user"}] +action.risk.param._risk = [{"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 72}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 72}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -151,9 +142,6 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Cloud Authentication Activities"] action.risk = 1 -action.risk.param._risk_object = -action.risk.param._risk_object_type = -action.risk.param._risk_score = 15 action.risk.param._risk_message = AWS account $requestingAccountId$ is trying to access resource from some other account $requestedAccountId$, for the first time. action.risk.param._risk = [{"threat_object_field": "requestingAccountId", "threat_object_type": "other"}, {"threat_object_field": "requestedAccountId", "threat_object_type": "other"}] action.risk.param.verbose = 0 @@ -193,11 +181,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Ransomware Cloud"] action.risk = 1 -action.risk.param._risk_object = userIdentity.principalId -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 25 action.risk.param._risk_message = AWS account is potentially compromised and user $userIdentity.principalId$ is trying to compromise other accounts. -action.risk.param._risk = [{"risk_object_field": "userIdentity.principalId", "risk_object_type": "user", "risk_score": 25, "threat_object_field": "userIdentity.principalId", "threat_object_type": "user"}, {"risk_object_field": "userIdentity.principalId", "risk_object_type": "user", "risk_score": 25, "threat_object_field": "userIdentity.principalId", "threat_object_type": "user"}] +action.risk.param._risk = [{"risk_object_field": "userIdentity.principalId", "risk_object_type": "user", "risk_score": 25}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -235,11 +220,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Ransomware Cloud"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 15 action.risk.param._risk_message = User $user$ with KMS keys is performing encryption, against S3 buckets on these files $dest_file$ -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15, "threat_object_field": "user", "threat_object_type": "user"}, {"threat_object_field": "dest_file", "threat_object_type": "file"}] +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15}, {"threat_object_field": "dest_file", "threat_object_type": "file"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -277,11 +259,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS User Monitoring"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 18 action.risk.param._risk_message = user $user$ has excessive number of api calls $dc_events$ from these IP addresses $src$, violating the threshold of 50, using the following commands $command$. -action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 18, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 18, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18, "threat_object_field": "user", "threat_object_type": "user"}] +action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 18}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -319,11 +298,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Cloud User Activities"] action.risk = 1 -action.risk.param._risk_object = userIdentity.arn -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 10 action.risk.param._risk_message = User $userIdentity.arn$ is seen to perform excessive number of discovery related api calls- $failures$, within an hour where the access was denied. -action.risk.param._risk = [{"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 10, "threat_object_field": "src_ip", "threat_object_type": "ip address"}, {"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 10, "threat_object_field": "src_ip", "threat_object_type": "ip address"}, {"risk_object_field": "userIdentity.arn", "risk_object_type": "user", "risk_score": 10, "threat_object_field": "userIdentity.arn", "threat_object_type": "user"}, {"risk_object_field": "userIdentity.arn", "risk_object_type": "user", "risk_score": 10, "threat_object_field": "userIdentity.arn", "threat_object_type": "user"}] +action.risk.param._risk = [{"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 10}, {"risk_object_field": "userIdentity.arn", "risk_object_type": "user", "risk_score": 10}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -361,11 +337,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS IAM Privilege Escalation"] action.risk = 1 -action.risk.param._risk_object = user_arn -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 28 action.risk.param._risk_message = User $user_arn$ has caused multiple failures with errorCode $errorCode$, which potentially means adversary is attempting to identify a role name. -action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 28, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 28, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 28}] +action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 28}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -403,11 +376,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS IAM Privilege Escalation"] action.risk = 1 -action.risk.param._risk_object = user_arn -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 10 action.risk.param._risk_message = User $user_arn$ has deleted AWS Policies from IP address $src$ by executing the following command $eventName$ -action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 10, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 10, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 10}] +action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 10}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -445,11 +415,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS IAM Privilege Escalation"] action.risk = 1 -action.risk.param._risk_object = group_name -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 5 action.risk.param._risk_message = User $user_arn$ has had mulitple failures while attempting to delete groups from $src$ -action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 5, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 5, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 5}, {"risk_object_field": "group_name", "risk_object_type": "user", "risk_score": 5}] +action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 5}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -487,11 +454,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS IAM Privilege Escalation"] action.risk = 1 -action.risk.param._risk_object = group_deleted -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 5 action.risk.param._risk_message = User $user_arn$ has sucessfully deleted mulitple groups $group_deleted$ from $src$ -action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 5, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 5, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 5}, {"risk_object_field": "group_deleted", "risk_object_type": "user", "risk_score": 5}] +action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 5}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -529,11 +493,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS Network ACL Activity"] action.risk = 1 -action.risk.param._risk_object = requestParameters.cidrBlock -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 48 action.risk.param._risk_message = User $user_arn$ has created network ACLs with all the ports open to a specified CIDR $requestParameters.cidrBlock$ -action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 48, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 48, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "userName", "risk_object_type": "user", "risk_score": 48}, {"risk_object_field": "requestParameters.cidrBlock", "risk_object_type": "system", "risk_score": 48}] +action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 48}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -571,11 +532,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS Network ACL Activity"] action.risk = 1 -action.risk.param._risk_object = user_arn -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 5 action.risk.param._risk_message = User $user_arn$ from $src$ has sucessfully deleted network ACLs entry (eventName= $eventName$), such that the instance is accessible from anywhere -action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 5, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 5, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 5}] +action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 5}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -613,11 +571,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Cloud Federated Credential Abuse"] action.risk = 1 -action.risk.param._risk_object = sourceIPAddress -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 64 action.risk.param._risk_message = From IP address $sourceIPAddress$, user agent $userAgent$ has trigged an event $eventName$ for account ID $recipientAccountId$ -action.risk.param._risk = [{"risk_object_field": "sourceIPAddress", "risk_object_type": "system", "risk_score": 64, "threat_object_field": "sourceIPAddress", "threat_object_type": "ip address"}, {"risk_object_field": "sourceIPAddress", "risk_object_type": "system", "risk_score": 64, "threat_object_field": "sourceIPAddress", "threat_object_type": "ip address"}, {"threat_object_field": "recipientAccountId", "threat_object_type": "other"}] +action.risk.param._risk = [{"risk_object_field": "sourceIPAddress", "risk_object_type": "system", "risk_score": 64}, {"threat_object_field": "recipientAccountId", "threat_object_type": "other"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -655,11 +610,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Cloud Federated Credential Abuse"] action.risk = 1 -action.risk.param._risk_object = userIdentity.principalId -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 64 action.risk.param._risk_message = User $userIdentity.principalId$ from IP address $sourceIPAddress$ has trigged an event $eventName$ to update the SAML provider to $requestParameters.sAMLProviderArn$ -action.risk.param._risk = [{"risk_object_field": "sourceIPAddress", "risk_object_type": "system", "risk_score": 64, "threat_object_field": "sourceIPAddress", "threat_object_type": "ip address"}, {"risk_object_field": "sourceIPAddress", "risk_object_type": "system", "risk_score": 64, "threat_object_field": "sourceIPAddress", "threat_object_type": "ip address"}, {"risk_object_field": "userIdentity.principalId", "risk_object_type": "user", "risk_score": 64}] +action.risk.param._risk = [{"risk_object_field": "sourceIPAddress", "risk_object_type": "system", "risk_score": 64}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -697,11 +649,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS IAM Privilege Escalation"] action.risk = 1 -action.risk.param._risk_object = user_arn -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 30 action.risk.param._risk_message = From IP address $sourceIPAddress$, user agent $userAgent$ has trigged an event $eventName$ for updating the the default policy version -action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 30, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 30, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 30}] +action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 30}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -739,11 +688,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS IAM Privilege Escalation"] action.risk = 1 -action.risk.param._risk_object = user_arn -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 30 action.risk.param._risk_message = From IP address $sourceIPAddress$, user agent $userAgent$ has trigged an event $eventName$ for updating the existing login profile, potentially giving user $user_arn$ more access privilleges -action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 30, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 30, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 30}] +action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 30}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -781,11 +727,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Cloud User Activities"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 15 action.risk.param._risk_message = user $user$ has made $api_calls$ api calls, violating the dynamic threshold of $expected_upper_threshold$ with the following command $command$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15, "threat_object_field": "user", "threat_object_type": "user"}] +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -823,9 +766,6 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Cloud Instance Activities"] action.risk = 1 -action.risk.param._risk_object = -action.risk.param._risk_object_type = -action.risk.param._risk_score = 10 action.risk.param._risk_message = action.risk.param._risk = [] action.risk.param.verbose = 0 @@ -865,9 +805,6 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Cloud Cryptomining", "Suspicious Cloud Instance Activities"] action.risk = 1 -action.risk.param._risk_object = -action.risk.param._risk_object_type = -action.risk.param._risk_score = 40 action.risk.param._risk_message = action.risk.param._risk = [] action.risk.param.verbose = 0 @@ -907,11 +844,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Cloud User Activities"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 15 action.risk.param._risk_message = user $user$ has made $api_calls$ api calls related to security groups, violating the dynamic threshold of $expected_upper_threshold$ with the following command $command$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15, "threat_object_field": "user", "threat_object_type": "user"}] +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -949,18 +883,15 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Cloud User Activities"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 36 action.risk.param._risk_message = User $user$ of type AssumedRole attempting to execute new API calls $command$ that have not been seen before -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36, "threat_object_field": "user", "threat_object_type": "user"}] +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Cloud API Calls From Previously Unseen User Roles - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud User Activities"], "cis20": ["CIS 1"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Recon", "Stage:Execution"], "impact": 60, "mitre_attack": ["T1078"], "nist": ["ID.AM"], "observable": [{"name": "user", "role": ["Attacker"], "type": "user"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud User Activities"], "cis20": ["CIS 1"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Recon", "Stage:Execution"], "impact": 60, "mitre_attack": ["T1078"], "nist": ["ID.AM"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]} schedule_window = auto alert.digest_mode = 1 disabled = false @@ -991,11 +922,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Cloud Cryptomining"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 18 action.risk.param._risk_message = User $user$ is creating a new instance $dest$ for the first time -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 18}] +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1033,11 +961,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Cloud Cryptomining"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 42 action.risk.param._risk_message = User $user$ is creating an instance $dest$ in a new region for the first time -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}] +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1075,11 +1000,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Cloud Cryptomining"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 36 action.risk.param._risk_message = User $user$ is creating an instance $dest$ with an image that has not been previously seen. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 36}] +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1117,18 +1039,15 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Cloud Cryptomining"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 30 action.risk.param._risk_message = User $user$ is creating an instance $dest$ with an instance type $instance_type$ that has not been previously seen. -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 30}] +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 30}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule -action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining"], "cis20": ["CIS 1"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 50, "nist": ["ID.AM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining"], "cis20": ["CIS 1"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 50, "nist": ["ID.AM"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto alert.digest_mode = 1 disabled = false @@ -1159,11 +1078,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Cloud Instance Activities"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 42 action.risk.param._risk_message = User $user$ is modifying an instance $dest$ for the first time. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}] +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1202,11 +1118,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Cloud Provisioning Activities"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 18 action.risk.param._risk_message = User $user$ is starting or creating an instance $dest$ for the first time in City $City$ from IP address $src$ -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 18, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 18, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 18}] +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 18}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1245,11 +1158,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Cloud Provisioning Activities"] action.risk = 1 -action.risk.param._risk_object = object -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 42 action.risk.param._risk_message = User $user$ is starting or creating an instance $object$ for the first time in Country $Country$ from IP address $src$ -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 42, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 42, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "object", "risk_object_type": "system", "risk_score": 42}] +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 42}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1288,11 +1198,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Cloud Provisioning Activities"] action.risk = 1 -action.risk.param._risk_object = object_id -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 42 action.risk.param._risk_message = User $user$ is starting or creating an instance $object_id$ for the first time from IP address $src$ -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 42, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 42, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "object_id", "risk_object_type": "system", "risk_score": 42}] +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 42}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1331,11 +1238,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Cloud Provisioning Activities"] action.risk = 1 -action.risk.param._risk_object = object -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 42 action.risk.param._risk_message = User $user$ is starting or creating an instance $object$ for the first time in region $Region$ from IP address $src$ -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 42, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 42, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "object", "risk_object_type": "system", "risk_score": 42}] +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 42}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1373,11 +1277,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Cloud Authentication Activities"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 30 action.risk.param._risk_message = User $user$ is logging into the AWS console for the first time -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 30, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 30, "threat_object_field": "user", "threat_object_type": "user"}] +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 30}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1415,11 +1316,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious AWS Login Activities", "Suspicious Cloud Authentication Activities"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 18 action.risk.param._risk_message = User $user$ is logging into the AWS console from City $City$ for the first time -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18, "threat_object_field": "user", "threat_object_type": "user"}] +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1457,11 +1355,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious AWS Login Activities", "Suspicious Cloud Authentication Activities"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 42 action.risk.param._risk_message = User $user$ is logging into the AWS console from Country $Country$ for the first time -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}] +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1499,11 +1394,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious AWS Login Activities", "Suspicious Cloud Authentication Activities"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 36 action.risk.param._risk_message = User $user$ is logging into the AWS console from Region $Region$ for the first time -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36, "threat_object_field": "user", "threat_object_type": "user"}] +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1541,11 +1433,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious AWS S3 Activities"] action.risk = 1 -action.risk.param._risk_object = userIdentity.userName -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 48 action.risk.param._risk_message = User $userIdentity.userName$ has created an open/public bucket $bucketName$ using AWS CLI with the following permissions - $requestParameters.accessControlList.x-amz-grant-read$ $requestParameters.accessControlList.x-amz-grant-read-acp$ $requestParameters.accessControlList.x-amz-grant-write$ $requestParameters.accessControlList.x-amz-grant-write-acp$ $requestParameters.accessControlList.x-amz-grant-full-control$ -action.risk.param._risk = [{"risk_object_field": "userIdentity.userName", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "userIdentity.userName", "threat_object_type": "user"}, {"risk_object_field": "userIdentity.userName", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "userIdentity.userName", "threat_object_type": "user"}, {"threat_object_field": "bucketName", "threat_object_type": "other"}] +action.risk.param._risk = [{"risk_object_field": "userIdentity.userName", "risk_object_type": "user", "risk_score": 48}, {"threat_object_field": "bucketName", "threat_object_type": "other"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1583,11 +1472,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious AWS S3 Activities"] action.risk = 1 -action.risk.param._risk_object = user_arn -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 48 action.risk.param._risk_message = User $user_arn$ has created an open/public bucket $bucketName$ with the following permissions $permission$ -action.risk.param._risk = [{"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "user_arn", "threat_object_type": "user"}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "user_arn", "threat_object_type": "user"}, {"threat_object_field": "bucketName", "threat_object_type": "other"}] +action.risk.param._risk = [{"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 48}, {"threat_object_field": "bucketName", "threat_object_type": "other"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1611,7 +1497,7 @@ search = `cloudtrail` eventSource=s3.amazonaws.com eventName=PutBucketAcl | rex action.escu = 0 action.escu.enabled = 1 description = This search looks for a spike in number of of AWS security Hub alerts for an EC2 instance in 4 hours intervals -action.escu.mappings = {"cis20": ["CIS 13"], "nist": ["DE.DP", "DE.AE"]} +action.escu.mappings = {"cis20": ["CIS 13"], "nist": ["DE.DP"]} action.escu.data_models = [] action.escu.eli5 = This search looks for a spike in number of of AWS security Hub alerts for an EC2 instance in 4 hours intervals action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security Hub inputs. The threshold_value should be tuned to your environment and schedule these searches according to the bucket span interval. @@ -1625,10 +1511,7 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS Security Hub Alerts"] action.risk = 1 -action.risk.param._risk_object = -action.risk.param._risk_object_type = -action.risk.param._risk_score = 20 -action.risk.param._risk_message = +action.risk.param._risk_message = Spike in AWS security Hub alerts with title $Title$ for EC2 instance $dest$ action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * @@ -1636,7 +1519,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule -action.correlationsearch.annotations = {"analytic_story": ["AWS Security Hub Alerts"], "cis20": ["CIS 13"], "nist": ["DE.DP", "DE.AE"]} +action.correlationsearch.annotations = {"analytic_story": ["AWS Security Hub Alerts"], "cis20": ["CIS 13"], "confidence": 50, "context": ["Source:Cloud Data", "Stage:Execution"], "impact": 30, "nist": ["DE.DP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto alert.digest_mode = 1 disabled = false @@ -1667,11 +1550,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Cloud Instance Activities", "Data Exfiltration"] action.risk = 1 -action.risk.param._risk_object = src_ip -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 48 action.risk.param._risk_message = AWS EC2 snapshot from account $aws_account_id$ is shared with $requested_account_id$ by user $user_arn$ from $src_ip$ -action.risk.param._risk = [{"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "user_arn", "threat_object_type": "user"}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "user_arn", "threat_object_type": "user"}, {"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 48, "threat_object_field": "src_ip", "threat_object_type": "ip address"}, {"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 48, "threat_object_field": "src_ip", "threat_object_type": "ip address"}] +action.risk.param._risk = [{"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 48}, {"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 48}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1709,11 +1589,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Office 365 Detections", "Cloud Federated Credential Abuse"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 18 action.risk.param._risk_message = User $Actor.ID$ has created a new federation setting on $dest$ from IP Address $ActorIpAddress$ -action.risk.param._risk = [{"risk_object_field": "ActorIpAddress", "risk_object_type": "system", "risk_score": 18, "threat_object_field": "ActorIpAddress", "threat_object_type": "ip address"}, {"risk_object_field": "ActorIpAddress", "risk_object_type": "system", "risk_score": 18, "threat_object_field": "ActorIpAddress", "threat_object_type": "ip address"}, {"risk_object_field": "Actor.ID", "risk_object_type": "user", "risk_score": 18, "threat_object_field": "Actor.ID", "threat_object_type": "user"}, {"risk_object_field": "Actor.ID", "risk_object_type": "user", "risk_score": 18, "threat_object_field": "Actor.ID", "threat_object_type": "user"}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 18}] +action.risk.param._risk = [{"risk_object_field": "ActorIpAddress", "risk_object_type": "system", "risk_score": 18}, {"risk_object_field": "Actor.ID", "risk_object_type": "user", "risk_score": 18}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1751,11 +1628,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Office 365 Detections", "Cloud Federated Credential Abuse"] action.risk = 1 -action.risk.param._risk_object = Target.ID -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 42 action.risk.param._risk_message = User $Actor.ID$ created a new federation setting on $Target.ID$ and added service principal credentials from IP Address $ActorIpAddress$ -action.risk.param._risk = [{"risk_object_field": "ActorIpAddress", "risk_object_type": "system", "risk_score": 42, "threat_object_field": "ActorIpAddress", "threat_object_type": "ip address"}, {"risk_object_field": "ActorIpAddress", "risk_object_type": "system", "risk_score": 42, "threat_object_field": "ActorIpAddress", "threat_object_type": "ip address"}, {"risk_object_field": "Target.ID", "risk_object_type": "system", "risk_score": 42}] +action.risk.param._risk = [{"risk_object_field": "ActorIpAddress", "risk_object_type": "system", "risk_score": 42}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1793,11 +1667,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Office 365 Detections"] action.risk = 1 -action.risk.param._risk_object = user_id -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 42 action.risk.param._risk_message = User $user_id$ has added new IP addresses $ip_addresses_new_added$ to a list of trusted IPs to bypass MFA -action.risk.param._risk = [{"risk_object_field": "ip_addresses_new_added", "risk_object_type": "system", "risk_score": 42, "threat_object_field": "ip_addresses_new_added", "threat_object_type": "ip address"}, {"risk_object_field": "ip_addresses_new_added", "risk_object_type": "system", "risk_score": 42, "threat_object_field": "ip_addresses_new_added", "threat_object_type": "ip address"}, {"risk_object_field": "user_id", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user_id", "threat_object_type": "user"}, {"risk_object_field": "user_id", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user_id", "threat_object_type": "user"}] +action.risk.param._risk = [{"risk_object_field": "ip_addresses_new_added", "risk_object_type": "system", "risk_score": 42}, {"risk_object_field": "user_id", "risk_object_type": "user", "risk_score": 42}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1835,11 +1706,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Office 365 Detections"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 64 action.risk.param._risk_message = User $user$ has executed an operation $Operation$ for this destination $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 64}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64, "threat_object_field": "user", "threat_object_type": "user"}] +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1877,11 +1745,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Office 365 Detections"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 64 action.risk.param._risk_message = User $user$ has caused excessive number of authentication failures from $src_ip$ using UserAgent $UserAgent$. -action.risk.param._risk = [{"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 64, "threat_object_field": "src_ip", "threat_object_type": "ip address"}, {"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 64, "threat_object_field": "src_ip", "threat_object_type": "ip address"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64}] +action.risk.param._risk = [{"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 64}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1919,11 +1784,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Office 365 Detections", "Cloud Federated Credential Abuse"] action.risk = 1 -action.risk.param._risk_object = UserId -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 64 action.risk.param._risk_message = User $UserId$ has caused excessive number of SSO logon errors from $ActorIpAddress$ using UserAgent $UserAgent$. -action.risk.param._risk = [{"risk_object_field": "ActorIpAddress", "risk_object_type": "system", "risk_score": 64, "threat_object_field": "ActorIpAddress", "threat_object_type": "ip address"}, {"risk_object_field": "ActorIpAddress", "risk_object_type": "system", "risk_score": 64, "threat_object_field": "ActorIpAddress", "threat_object_type": "ip address"}, {"risk_object_field": "UserId", "risk_object_type": "user", "risk_score": 64}] +action.risk.param._risk = [{"risk_object_field": "ActorIpAddress", "risk_object_type": "system", "risk_score": 64}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1961,11 +1823,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Office 365 Detections", "Cloud Federated Credential Abuse"] action.risk = 1 -action.risk.param._risk_object = UserId -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 64 action.risk.param._risk_message = User $UserId$ has added a new federated domaain $Parameters.Value$ for $OrganizationName$ -action.risk.param._risk = [{"threat_object_field": "OrganizationName", "threat_object_type": "other"}, {"risk_object_field": "UserId", "risk_object_type": "user", "risk_score": 64}] +action.risk.param._risk = [{"threat_object_field": "OrganizationName", "threat_object_type": "other"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -2003,11 +1862,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Office 365 Detections", "Data Exfiltration"] action.risk = 1 -action.risk.param._risk_object = Source -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 48 action.risk.param._risk_message = User $Source$ has exported a PST file from the search using this operation- $Operation$ with a severity of $Severity$ -action.risk.param._risk = [{"risk_object_field": "Source", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "Source", "threat_object_type": "user"}, {"risk_object_field": "Source", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "Source", "threat_object_type": "user"}] +action.risk.param._risk = [{"risk_object_field": "Source", "risk_object_type": "user", "risk_score": 48}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -2045,11 +1901,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Office 365 Detections", "Data Exfiltration"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 48 action.risk.param._risk_message = User $user$ has configured a forwarding rule for multiple mailboxes to the same destination $ForwardingAddress$ -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "user", "threat_object_type": "user"}] +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 48}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -2087,11 +1940,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Office 365 Detections"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 48 action.risk.param._risk_message = User $user$ has delegated suspicious rights $AccessRights$ to user $dest_user$ that allow access to sensitive -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "user", "threat_object_type": "user"}] +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 48}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -2129,11 +1979,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Office 365 Detections", "Data Exfiltration"] action.risk = 1 -action.risk.param._risk_object = ForwardingSmtpAddress -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 48 action.risk.param._risk_message = User $user$ configured multiple users $src_user$ with a count of $count_src_user$, a forwarding rule to same destination $ForwardingSmtpAddress$ -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "ForwardingSmtpAddress", "risk_object_type": "user", "risk_score": 48}] +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 48}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m diff --git a/dist/saaws/default/transforms.conf b/dist/saaws/default/transforms.conf index 2b6ce63ef5..86e558b025 100644 --- a/dist/saaws/default/transforms.conf +++ b/dist/saaws/default/transforms.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-28T20:06:09 UTC +# On Date: 2021-07-29T20:53:37 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/saaws/default/use_case_library.conf b/dist/saaws/default/use_case_library.conf index 06008e8fdc..c941421ddb 100644 --- a/dist/saaws/default/use_case_library.conf +++ b/dist/saaws/default/use_case_library.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-28T20:06:09 UTC +# On Date: 2021-07-29T20:53:37 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -553,7 +553,7 @@ asset_type = AWS Instance confidence = medium explanation = This search looks for a spike in number of of AWS security Hub alerts for an EC2 instance in 4 hours intervals how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security Hub inputs. The threshold_value should be tuned to your environment and schedule these searches according to the bucket span interval. -annotations = {"cis20": ["CIS 13"], "nist": ["DE.DP", "DE.AE"]} +annotations = {"cis20": ["CIS 13"], "nist": ["DE.DP"]} known_false_positives = None providing_technologies = [] diff --git a/docs/detections.wiki b/docs/detections.wiki index 2d57e73b29..efb1d4e9ef 100644 --- a/docs/detections.wiki +++ b/docs/detections.wiki @@ -42288,7 +42288,7 @@ There might be false positives associted with this detection since items like ar 
 #############
 # Automatically generated by doc_gen.py in https://github.com/splunk/security_content''
-# On Date: 2021-07-28 20:19:18.091984 UTC''
+# On Date: 2021-07-29 21:06:56.901053 UTC''
 # Author: Splunk Security Research''
 # Contact: research@splunk.com''
 #############
diff --git a/docs/stories.wiki b/docs/stories.wiki
index 3ce8170a05..2f1a4ccc6a 100644
--- a/docs/stories.wiki
+++ b/docs/stories.wiki
@@ -7831,7 +7831,7 @@ In March of 2016, adversaries were seen using JexBoss--an open-source utility us
 
 #############
 # Automatically generated by doc_gen.py in https://github.com/splunk/security_content
-# On Date: 2021-07-28 20:19:18.414652 UTC
+# On Date: 2021-07-29 21:06:57.254832 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############