diff --git a/detections/endpoint/disable_windows_smartscreen_protection.yml b/detections/endpoint/disable_windows_smartscreen_protection.yml index c86d9eff68..0fa3d9e9d3 100644 --- a/detections/endpoint/disable_windows_smartscreen_protection.yml +++ b/detections/endpoint/disable_windows_smartscreen_protection.yml @@ -47,3 +47,24 @@ tags: - Registry.dest - Registry.registry_value_nam security_domain: endpoint + impact: 40 + confidence: 100 + # (impact * confidence)/100 + risk_score: 40 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: "$Registry.user$ on $Registry.dest$ modified registry keyname=$Registry.registry_key_name$ to disable the smartscreen protection of windows machine" + observable: + - name: Registry.dest + type: Endpoint + role: + - Victim + - name: Registry.use + type: User + role: + - Victim + - name: Registry.registry_key_name + type: Other + role: + - Target diff --git a/detections/endpoint/disabling_cmd_application.yml b/detections/endpoint/disabling_cmd_application.yml index 2fbb659e41..b11bf1cb5e 100644 --- a/detections/endpoint/disabling_cmd_application.yml +++ b/detections/endpoint/disabling_cmd_application.yml @@ -46,3 +46,25 @@ tags: - Registry.dest - Registry.registry_value_name security_domain: endpoint + impact: 40 + confidence: 100 + # (impact * confidence)/100 + risk_score: 40 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: "$Registry.user$ on $Registry.dest$ modified registry keyname=$Registry.registry_key_name$ to disable to disable the cmd prompt application of a windows machine" + observable: + - name: Registry.dest + type: Endpoint + role: + - Victim + - name: Registry.user + type: User + role: + - Victim + - name: Registry.registry_key_name + type: Other + role: + - Target + diff --git a/detections/endpoint/disabling_controlpanel.yml b/detections/endpoint/disabling_controlpanel.yml index d25066e65d..e70ccd69de 100644 --- a/detections/endpoint/disabling_controlpanel.yml +++ b/detections/endpoint/disabling_controlpanel.yml @@ -45,3 +45,24 @@ tags: - Registry.dest - Registry.registry_value_name security_domain: endpoint + impact: 40 + confidence: 100 + # (impact * confidence)/100 + risk_score: 40 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: "$Registry.user$ on $Registry.dest$ modified registry keyname=$Registry.registry_key_name$ to disable to disable the control panel window on a windows machine" + observable: + - name: Registry.dest + type: Endpoint + role: + - Victim + - name: Registry.user + type: User + role: + - Victim + - name: Registry.registry_key_name + type: Other + role: + - Target diff --git a/detections/endpoint/disabling_firewall_with_netsh.yml b/detections/endpoint/disabling_firewall_with_netsh.yml index 572993638b..5b172c085a 100644 --- a/detections/endpoint/disabling_firewall_with_netsh.yml +++ b/detections/endpoint/disabling_firewall_with_netsh.yml @@ -50,3 +50,24 @@ tags: - Processes.process_id - Processes.parent_process_id security_domain: endpoint + impact: 40 + confidence: 100 + # (impact * confidence)/100 + risk_score: 40 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: "$Processes.user$ on $Processes.dest$ used the netsh application in a suspicious manner to disable the firewall" + observable: + - name: Processes.dest + type: Endpoint + role: + - Victim + - name: Processes.user + type: User + role: + - Victim + - name: Processes.process + type: Process + role: + - Target diff --git a/detections/endpoint/disabling_folderoptions_windows_feature.yml b/detections/endpoint/disabling_folderoptions_windows_feature.yml index 25071310bb..a606dac2b6 100644 --- a/detections/endpoint/disabling_folderoptions_windows_feature.yml +++ b/detections/endpoint/disabling_folderoptions_windows_feature.yml @@ -47,3 +47,24 @@ tags: - Registry.dest - Registry.registry_value_name security_domain: endpoint + impact: 40 + confidence: 100 + # (impact * confidence)/100 + risk_score: 40 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: "$Registry.user$ on $Registry.dest modified registry key name=$Registry.registry_key_name$ to disable the folder options feature of windows to show hidden files, file extensions, etc" + observable: + - name: Registry.dest + type: Endpoint + role: + - Victim + - name: Registry.user + type: User + role: + - Victim + - name: Registry.registry_key_name + type: Other + role: + - Target diff --git a/detections/endpoint/disabling_net_user_account.yml b/detections/endpoint/disabling_net_user_account.yml index ef36c58a14..bccaf78874 100644 --- a/detections/endpoint/disabling_net_user_account.yml +++ b/detections/endpoint/disabling_net_user_account.yml @@ -48,3 +48,24 @@ tags: - Processes.process_id - Processes.parent_process security_domain: endpoint + impact: 40 + confidence: 100 + # (impact * confidence)/100 + risk_score: 40 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: "$Processes.user$ on $Processes.dest$ used a suspicious command ($Processes.process_name$) that disabled a user account using the net.exe utility native to Windows" + observable: + - name: Processes.dest + type: Endpoint + role: + - Victim + - name: Processes.user + type: User + role: + - Victim + - name: Processes.process_name + type: Process + role: + - Target diff --git a/detections/endpoint/disabling_norun_windows_app.yml b/detections/endpoint/disabling_norun_windows_app.yml index a6d5beef11..7f9dd75551 100644 --- a/detections/endpoint/disabling_norun_windows_app.yml +++ b/detections/endpoint/disabling_norun_windows_app.yml @@ -48,3 +48,24 @@ tags: - Registry.dest - Registry.registry_value_name security_domain: endpoint + impact: 40 + confidence: 100 + # (impact * confidence)/100 + risk_score: 40 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: "$Registry.user$ on $Registry.dest$ modified registry key $Registry.registry_key_name$ to disable run application in window start menu" + observable: + - name: Registry.dest + type: Endpoint + role: + - Victim + - name: Registry.use + type: User + role: + - Victim + - name: Registry.registry_key_name + type: Other + role: + - Target diff --git a/detections/endpoint/disabling_remote_user_account_control.yml b/detections/endpoint/disabling_remote_user_account_control.yml index 7983188c01..eae7094e8d 100644 --- a/detections/endpoint/disabling_remote_user_account_control.yml +++ b/detections/endpoint/disabling_remote_user_account_control.yml @@ -51,3 +51,24 @@ tags: - Registry.user - Registry.action security_domain: endpoint + impact: 40 + confidence: 100 + # (impact * confidence)/100 + risk_score: 40 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: "$Registry.user$ on $Registry.dest$ modified registry key=$Registry.registry_key_name$ that controls the enforcement of Windows User Account Control (UAC)" + observable: + - name: Registry.dest + type: Endpoint + role: + - Victim + - name: Registry.user + type: User + role: + - Victim + - name: Registry.registry_key_name + type: Other + role: + - Target diff --git a/detections/endpoint/disabling_systemrestore_in_registry.yml b/detections/endpoint/disabling_systemrestore_in_registry.yml index 0de4f02151..f64df5e37d 100644 --- a/detections/endpoint/disabling_systemrestore_in_registry.yml +++ b/detections/endpoint/disabling_systemrestore_in_registry.yml @@ -48,3 +48,24 @@ tags: - Registry.dest - Registry.registry_value_name security_domain: endpoint + impact: 70 + confidence: 100 + # (impact * confidence)/100 + risk_score: 70 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: "$Registry.user$ on $Registry.dest$ modified registry key=$Registry.registry_key_name$ which disables the system restore of a machine" + observable: + - name: Registry.dest + type: Endpoint + role: + - Victim + - name: Registry.user + type: User + role: + - Victim + - name: Registry.registry_key_name + type: Other + role: + - Target diff --git a/detections/endpoint/disabling_task_manager.yml b/detections/endpoint/disabling_task_manager.yml index 35d551fed1..a8a344d44c 100644 --- a/detections/endpoint/disabling_task_manager.yml +++ b/detections/endpoint/disabling_task_manager.yml @@ -47,3 +47,24 @@ tags: - Registry.dest - Registry.registry_value_name security_domain: endpoint + impact: 40 + confidence: 100 + # (impact * confidence)/100 + risk_score: 40 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: "$Registry.user$ on $Registry.dest$ modified registry key=$Registry.registry_key_name$ which disables the task manager of windows operating system" + observable: + - name: Registry.dest + type: Endpoint + role: + - Victim + - name: Registry.user + type: User + role: + - Victim + - name: Registry.registry_key_name + type: Other + role: + - Target diff --git a/detections/endpoint/winword_spawning_windows_script_host.yml b/detections/endpoint/winword_spawning_windows_script_host.yml index dfa44f671d..42d2694dc2 100644 --- a/detections/endpoint/winword_spawning_windows_script_host.yml +++ b/detections/endpoint/winword_spawning_windows_script_host.yml @@ -52,3 +52,25 @@ tags: - user - parent_process_id security_domain: endpoint + impact: 70 + confidence: 100 + # (impact * confidence)/100 + risk_score: 70 + context: + - Source:Endpoint + - Stage:Initial Access + message: "User $user$ on $dest$ spawned Windows Script Host from Winword.exe" + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: user + type: User + role: + - Victim + - name: process_name + type: Process + role: + - Target + diff --git a/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml b/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml index eaa0d67527..09af59939d 100644 --- a/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml +++ b/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml @@ -73,3 +73,22 @@ tags: - Consumer - Filter security_domain: endpoint + impact: 30 + confidence: 100 + # (impact * confidence)/100 + risk_score: 30 + context: + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Persistence + message: "User $user$ on $host$ executed the following suspicious WMI query: $Query$. Filter: $filter$. Consumer: $Consumer$. EventCode: $EventCode$" + observable: + - name: host + type: Endpoint + role: + - Victim + - name: user + type: User + role: + - Victim + diff --git a/detections/endpoint/wmi_recon_running_process_or_services.yml b/detections/endpoint/wmi_recon_running_process_or_services.yml index 8fd1c719fb..dadc57a7f0 100644 --- a/detections/endpoint/wmi_recon_running_process_or_services.yml +++ b/detections/endpoint/wmi_recon_running_process_or_services.yml @@ -45,3 +45,20 @@ tags: - ComputerName - User security_domain: endpoint + impact: 30 + confidence: 100 + # (impact * confidence)/100 + risk_score: 30 + context: + - Source:Endpoint + - Stage:Recon + message: "Suspicious powerShell script execution by $user$ on $ComputerName$ via EventCode 4104, where WMI is performing an event query looking for running processes or running services" + observable: + - name: ComputerName + type: Endpoint + role: + - Victim + - name: User + type: User + role: + - Victim diff --git a/detections/endpoint/write_executable_in_smb_share.yml b/detections/endpoint/write_executable_in_smb_share.yml index 52e1962464..ac41d9fef2 100644 --- a/detections/endpoint/write_executable_in_smb_share.yml +++ b/detections/endpoint/write_executable_in_smb_share.yml @@ -47,3 +47,16 @@ tags: - src_port - Source_Address security_domain: endpoint + impact: 70 + confidence: 100 + # (impact * confidence)/100 + risk_score: 70 + context: + - Source:Endpoint + - Stage:Lateral Movement + message: "$user$ dropped or created an executable file in known sensitive SMB share. Share name=$Share_Name$, Target name=$Relative_Target_Name$, and Access mask=$Access_Mask$" + observable: + - name: user + type: User + role: + - Victim