Branch was auto-updated.

detections/endpoint/disable_windows_smartscreen_protection.yml

@@ -47,3 +47,24 @@ tags:
   - Registry.dest
   - Registry.registry_value_nam
   security_domain: endpoint
+  impact: 40
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 40
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: "$Registry.user$ on $Registry.dest$ modified registry keyname=$Registry.registry_key_name$ to disable the smartscreen protection of windows machine"
+  observable:
+  - name: Registry.dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: Registry.use
+    type: User
+    role:
+    - Victim
+  - name: Registry.registry_key_name
+    type: Other
+    role:
+    - Target

detections/endpoint/disabling_cmd_application.yml

@@ -46,3 +46,25 @@ tags:
   - Registry.dest
   - Registry.registry_value_name
   security_domain: endpoint
+  impact: 40
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 40
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: "$Registry.user$ on $Registry.dest$ modified registry keyname=$Registry.registry_key_name$ to disable to disable the cmd prompt application of a windows machine"
+  observable:
+  - name: Registry.dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: Registry.user
+    type: User
+    role:
+    - Victim
+  - name: Registry.registry_key_name
+    type: Other
+    role:
+    - Target
+

detections/endpoint/disabling_controlpanel.yml

@@ -45,3 +45,24 @@ tags:
   - Registry.dest
   - Registry.registry_value_name
   security_domain: endpoint
+  impact: 40
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 40
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: "$Registry.user$ on $Registry.dest$ modified registry keyname=$Registry.registry_key_name$ to disable to disable the control panel window on a windows machine"
+  observable:
+  - name: Registry.dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: Registry.user 
+    type: User
+    role:
+    - Victim
+  - name: Registry.registry_key_name
+    type: Other
+    role:
+    - Target

detections/endpoint/disabling_firewall_with_netsh.yml

@@ -50,3 +50,24 @@ tags:
   - Processes.process_id
   - Processes.parent_process_id
   security_domain: endpoint
+  impact: 40
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 40
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: "$Processes.user$ on $Processes.dest$ used the netsh application in a suspicious manner to disable the firewall"
+  observable:
+  - name: Processes.dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: Processes.user
+    type: User
+    role:
+    - Victim
+  - name: Processes.process
+    type: Process
+    role:
+    - Target

detections/endpoint/disabling_folderoptions_windows_feature.yml

@@ -47,3 +47,24 @@ tags:
   - Registry.dest
   - Registry.registry_value_name
   security_domain: endpoint
+  impact: 40
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 40
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: "$Registry.user$ on $Registry.dest modified registry key name=$Registry.registry_key_name$ to disable the folder options feature of windows to show hidden files, file extensions, etc"
+  observable:
+  - name: Registry.dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: Registry.user
+    type: User
+    role:
+    - Victim
+  - name: Registry.registry_key_name
+    type: Other
+    role:
+    - Target

detections/endpoint/disabling_net_user_account.yml

@@ -48,3 +48,24 @@ tags:
   - Processes.process_id
   - Processes.parent_process
   security_domain: endpoint
+  impact: 40
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 40
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: "$Processes.user$ on $Processes.dest$ used a suspicious command ($Processes.process_name$) that disabled a user account using the net.exe utility native to Windows"
+  observable:
+  - name: Processes.dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: Processes.user
+    type: User
+    role:
+    - Victim
+  - name: Processes.process_name
+    type: Process
+    role:
+    - Target

detections/endpoint/disabling_norun_windows_app.yml

@@ -48,3 +48,24 @@ tags:
   - Registry.dest
   - Registry.registry_value_name
   security_domain: endpoint
+  impact: 40
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 40
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: "$Registry.user$ on $Registry.dest$ modified registry key $Registry.registry_key_name$ to disable run application in window start menu"
+  observable:
+  - name: Registry.dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: Registry.use
+    type: User
+    role:
+    - Victim
+  - name: Registry.registry_key_name
+    type: Other
+    role:
+    - Target

detections/endpoint/disabling_remote_user_account_control.yml

@@ -51,3 +51,24 @@ tags:
   - Registry.user
   - Registry.action
   security_domain: endpoint
+  impact: 40
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 40
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: "$Registry.user$ on $Registry.dest$ modified registry key=$Registry.registry_key_name$ that controls the enforcement of Windows User Account Control (UAC)"
+  observable:
+  - name: Registry.dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: Registry.user
+    type: User
+    role:
+    - Victim
+  - name: Registry.registry_key_name
+    type: Other
+    role:
+    - Target

detections/endpoint/disabling_systemrestore_in_registry.yml

@@ -48,3 +48,24 @@ tags:
   - Registry.dest
   - Registry.registry_value_name
   security_domain: endpoint
+  impact: 70
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 70
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: "$Registry.user$ on $Registry.dest$ modified registry key=$Registry.registry_key_name$ which disables the system restore of a machine"
+  observable:
+  - name: Registry.dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: Registry.user
+    type: User
+    role:
+    - Victim
+  - name: Registry.registry_key_name
+    type: Other
+    role:
+    - Target

detections/endpoint/disabling_task_manager.yml

@@ -47,3 +47,24 @@ tags:
   - Registry.dest
   - Registry.registry_value_name
   security_domain: endpoint
+  impact: 40
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 40
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: "$Registry.user$ on $Registry.dest$ modified registry key=$Registry.registry_key_name$ which disables the task manager of windows operating system"
+  observable:
+  - name: Registry.dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: Registry.user
+    type: User
+    role:
+    - Victim
+  - name: Registry.registry_key_name
+    type: Other
+    role:
+    - Target

detections/endpoint/winword_spawning_windows_script_host.yml

@@ -52,3 +52,25 @@ tags:
   - user
   - parent_process_id
   security_domain: endpoint
+  impact: 70
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 70
+  context:
+  - Source:Endpoint
+  - Stage:Initial Access
+  message: "User $user$ on $dest$ spawned Windows Script Host from Winword.exe"
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Target
+

detections/endpoint/wmi_permanent_event_subscription___sysmon.yml

@@ -73,3 +73,22 @@ tags:
   - Consumer
   - Filter
   security_domain: endpoint
+  impact: 30
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 30
+  context:
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  - Stage:Persistence
+  message: "User $user$ on $host$ executed the following suspicious WMI query: $Query$.  Filter: $filter$. Consumer: $Consumer$.  EventCode: $EventCode$"
+  observable:
+  - name: host
+    type: Endpoint
+    role:
+    - Victim
+  - name: user
+    type: User
+    role:
+    - Victim
+

detections/endpoint/wmi_recon_running_process_or_services.yml

@@ -45,3 +45,20 @@ tags:
   - ComputerName
   - User
   security_domain: endpoint
+  impact: 30
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 30
+  context:
+  - Source:Endpoint
+  - Stage:Recon
+  message: "Suspicious powerShell script execution by $user$ on $ComputerName$ via EventCode 4104, where WMI is performing an event query looking for running processes or running services"
+  observable:
+  - name: ComputerName
+    type: Endpoint
+    role:
+    - Victim
+  - name: User
+    type: User
+    role:
+    - Victim

detections/endpoint/write_executable_in_smb_share.yml

@@ -47,3 +47,16 @@ tags:
   - src_port
   - Source_Address
   security_domain: endpoint
+  impact: 70
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 70
+  context:
+  - Source:Endpoint
+  - Stage:Lateral Movement
+  message: "$user$ dropped or created an executable file in known sensitive SMB share.  Share name=$Share_Name$, Target name=$Relative_Target_Name$, and Access mask=$Access_Mask$"
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim