minor_ssa_update

detections/endpoint/ssa___attempt_to_delete_services.yml

@@ -1,4 +1,4 @@
-name: Attempt To delete Services
+name: Attempt To Delete Services
 id: a0c8c292-d01a-11eb-aa18-acde48001122
 version: 2
 date: '2021-06-18'
@@ -57,3 +57,16 @@ tags:
   - process
   risk_severity: high
   security_domain: endpoint
+  impact: 70
+  confidence: 70
+  # (impact * confidence)/100
+  risk_score: 49
+  context:
+  - Source:Endpoint
+  - stage:Defense Evasion
+  message: deleted service with commandline $process$ on $dest$ by $user$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim

detections/endpoint/ssa___attempt_to_disable_services.yml

@@ -59,3 +59,16 @@ tags:
   - process
   risk_severity: medium
   security_domain: endpoint
+  impact: 70
+  confidence: 70
+  # (impact * confidence)/100
+  risk_score: 49
+  context:
+  - Source:Endpoint
+  - stage:Defense Evasion
+  message: disable service with commandline $process$ on $dest$ by $user$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim

detections/endpoint/ssa___delete_a_net_user.yml

@@ -18,7 +18,7 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
   "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
   null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
   null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
-  cmd_line IS NOT NULL AND like(cmd_line, "%/delete%") AND (process_name="net1.exe"
+  cmd_line IS NOT NULL AND like(cmd_line, "%/delete%") AND like(cmd_line, "%user%") AND (process_name="net1.exe"
   OR process_name="net.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
   "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
@@ -41,10 +41,11 @@ tags:
   - CIS 16
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/net_user_del.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1531/atomic_red_team/security.log
   kill_chain_phases:
   - Exploitation
   mitre_attack_id:
-  - T1489
+  - T1531
   nist:
   - PR.AC
   - PR.IP
@@ -60,3 +61,16 @@ tags:
   - process
   risk_severity: high
   security_domain: endpoint
+  impact: 70
+  confidence: 70
+  # (impact * confidence)/100
+  risk_score: 49
+  context:
+  - Source:Endpoint
+  - stage:Defense Evasion
+  message: deleted net users with commandline $process$ on $dest$ by $user$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim

detections/endpoint/ssa___disable_net_user_account.yml

@@ -16,7 +16,7 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
   "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
   null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
   null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
-  cmd_line IS NOT NULL AND like(cmd_line, "%/active:no%") AND (process_name="net1.exe"
+  cmd_line IS NOT NULL AND like(cmd_line, "%/active:no%") AND like(cmd_line, "%user%") AND (process_name="net1.exe"
   OR process_name="net.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
   "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
@@ -59,3 +59,16 @@ tags:
   - process
   risk_severity: medium
   security_domain: endpoint
+  impact: 70
+  confidence: 70
+  # (impact * confidence)/100
+  risk_score: 49
+  context:
+  - Source:Endpoint
+  - stage:Defense Evasion
+  message: disable net users with commandline $process$ on $dest$ by $user$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim

detections/endpoint/ssa___resize_shadowstorage_volume.yml

@@ -61,3 +61,16 @@ tags:
   - process
   risk_severity: high
   security_domain: endpoint
+  impact: 80
+  confidence: 80
+  # (impact * confidence)/100
+  risk_score: 64
+  context:
+  - Source:Endpoint
+  - stage:Defense Evasion
+  message: resize shadow copy made by process$process_name$ with commandline $process$ on $dest$ by $user$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim

tests/endpoint/ssa___delete_a_net_user.test.yml

@@ -7,4 +7,7 @@ tests:
     attack_data:
       - file_name: net_user_del.log
         data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/net_user_del.log
+        source: WinEventLog:Security
+      - file_name: security.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1531/atomic_red_team/security.log
         source: WinEventLog:Security