From b37882f7e768b1ef7c97bd294f481d6dac75a9bc Mon Sep 17 00:00:00 2001
From: "jim@apger.com" <jim@apger.com>
Date: Wed, 14 Jul 2021 20:58:54 -0500
Subject: [PATCH] Apger's second round of detection content updates

---
 ...disable_windows_smartscreen_protection.yml | 21 ++++++++++++++++++
 .../endpoint/disabling_cmd_application.yml    | 22 ++++++++++++++++++-
 .../endpoint/disabling_controlpanel.yml       | 21 ++++++++++++++++++
 .../disabling_firewall_with_netsh.yml         | 21 ++++++++++++++++++
 ...isabling_folderoptions_windows_feature.yml | 21 ++++++++++++++++++
 .../endpoint/disabling_net_user_account.yml   | 21 ++++++++++++++++++
 .../endpoint/disabling_norun_windows_app.yml  | 21 ++++++++++++++++++
 .../disabling_remote_user_account_control.yml | 21 ++++++++++++++++++
 .../disabling_systemrestore_in_registry.yml   | 21 ++++++++++++++++++
 .../endpoint/disabling_task_manager.yml       | 21 ++++++++++++++++++
 .../winword_spawning_windows_script_host.yml  | 22 +++++++++++++++++++
 ..._permanent_event_subscription___sysmon.yml | 19 ++++++++++++++++
 .../wmi_recon_running_process_or_services.yml | 17 ++++++++++++++
 .../write_executable_in_smb_share.yml         | 13 +++++++++++
 14 files changed, 281 insertions(+), 1 deletion(-)

diff --git a/detections/endpoint/disable_windows_smartscreen_protection.yml b/detections/endpoint/disable_windows_smartscreen_protection.yml
index c86d9eff68..0fa3d9e9d3 100644
--- a/detections/endpoint/disable_windows_smartscreen_protection.yml
+++ b/detections/endpoint/disable_windows_smartscreen_protection.yml
@@ -47,3 +47,24 @@ tags:
   - Registry.dest
   - Registry.registry_value_nam
   security_domain: endpoint
+  impact: 40
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 40
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: "$Registry.user$ on $Registry.dest$ modified registry keyname=$Registry.registry_key_name$ to disable the smartscreen protection of windows machine"
+  observable:
+  - name: Registry.dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: Registry.use
+    type: User
+    role:
+    - Victim
+  - name: Registry.registry_key_name
+    type: Other
+    role:
+    - Target
diff --git a/detections/endpoint/disabling_cmd_application.yml b/detections/endpoint/disabling_cmd_application.yml
index 4d6167884d..292270cc41 100644
--- a/detections/endpoint/disabling_cmd_application.yml
+++ b/detections/endpoint/disabling_cmd_application.yml
@@ -46,4 +46,24 @@ tags:
   - Registry.dest
   - Registry.registry_value_name
   security_domain: endpoint
-
+  impact: 40
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 40
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: "$Registry.user$ on $Registry.dest$ modified registry keyname=$Registry.registry_key_name$ to disable to disable the cmd prompt application of a windows machine"
+  observable:
+  - name: Registry.dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: Registry.user
+    type: User
+    role:
+    - Victim
+  - name: Registry.registry_key_name
+    type: Other
+    role:
+    - Target
diff --git a/detections/endpoint/disabling_controlpanel.yml b/detections/endpoint/disabling_controlpanel.yml
index d25066e65d..e70ccd69de 100644
--- a/detections/endpoint/disabling_controlpanel.yml
+++ b/detections/endpoint/disabling_controlpanel.yml
@@ -45,3 +45,24 @@ tags:
   - Registry.dest
   - Registry.registry_value_name
   security_domain: endpoint
+  impact: 40
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 40
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: "$Registry.user$ on $Registry.dest$ modified registry keyname=$Registry.registry_key_name$ to disable to disable the control panel window on a windows machine"
+  observable:
+  - name: Registry.dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: Registry.user 
+    type: User
+    role:
+    - Victim
+  - name: Registry.registry_key_name
+    type: Other
+    role:
+    - Target
diff --git a/detections/endpoint/disabling_firewall_with_netsh.yml b/detections/endpoint/disabling_firewall_with_netsh.yml
index 572993638b..5b172c085a 100644
--- a/detections/endpoint/disabling_firewall_with_netsh.yml
+++ b/detections/endpoint/disabling_firewall_with_netsh.yml
@@ -50,3 +50,24 @@ tags:
   - Processes.process_id
   - Processes.parent_process_id
   security_domain: endpoint
+  impact: 40
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 40
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: "$Processes.user$ on $Processes.dest$ used the netsh application in a suspicious manner to disable the firewall"
+  observable:
+  - name: Processes.dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: Processes.user
+    type: User
+    role:
+    - Victim
+  - name: Processes.process
+    type: Process
+    role:
+    - Target
diff --git a/detections/endpoint/disabling_folderoptions_windows_feature.yml b/detections/endpoint/disabling_folderoptions_windows_feature.yml
index 25071310bb..a606dac2b6 100644
--- a/detections/endpoint/disabling_folderoptions_windows_feature.yml
+++ b/detections/endpoint/disabling_folderoptions_windows_feature.yml
@@ -47,3 +47,24 @@ tags:
   - Registry.dest
   - Registry.registry_value_name
   security_domain: endpoint
+  impact: 40
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 40
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: "$Registry.user$ on $Registry.dest modified registry key name=$Registry.registry_key_name$ to disable the folder options feature of windows to show hidden files, file extensions, etc"
+  observable:
+  - name: Registry.dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: Registry.user
+    type: User
+    role:
+    - Victim
+  - name: Registry.registry_key_name
+    type: Other
+    role:
+    - Target
diff --git a/detections/endpoint/disabling_net_user_account.yml b/detections/endpoint/disabling_net_user_account.yml
index ef36c58a14..bccaf78874 100644
--- a/detections/endpoint/disabling_net_user_account.yml
+++ b/detections/endpoint/disabling_net_user_account.yml
@@ -48,3 +48,24 @@ tags:
   - Processes.process_id
   - Processes.parent_process
   security_domain: endpoint
+  impact: 40
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 40
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: "$Processes.user$ on $Processes.dest$ used a suspicious command ($Processes.process_name$) that disabled a user account using the net.exe utility native to Windows"
+  observable:
+  - name: Processes.dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: Processes.user
+    type: User
+    role:
+    - Victim
+  - name: Processes.process_name
+    type: Process
+    role:
+    - Target
diff --git a/detections/endpoint/disabling_norun_windows_app.yml b/detections/endpoint/disabling_norun_windows_app.yml
index a6d5beef11..7f9dd75551 100644
--- a/detections/endpoint/disabling_norun_windows_app.yml
+++ b/detections/endpoint/disabling_norun_windows_app.yml
@@ -48,3 +48,24 @@ tags:
   - Registry.dest
   - Registry.registry_value_name
   security_domain: endpoint
+  impact: 40
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 40
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: "$Registry.user$ on $Registry.dest$ modified registry key $Registry.registry_key_name$ to disable run application in window start menu"
+  observable:
+  - name: Registry.dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: Registry.use
+    type: User
+    role:
+    - Victim
+  - name: Registry.registry_key_name
+    type: Other
+    role:
+    - Target
diff --git a/detections/endpoint/disabling_remote_user_account_control.yml b/detections/endpoint/disabling_remote_user_account_control.yml
index 7983188c01..eae7094e8d 100644
--- a/detections/endpoint/disabling_remote_user_account_control.yml
+++ b/detections/endpoint/disabling_remote_user_account_control.yml
@@ -51,3 +51,24 @@ tags:
   - Registry.user
   - Registry.action
   security_domain: endpoint
+  impact: 40
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 40
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: "$Registry.user$ on $Registry.dest$ modified registry key=$Registry.registry_key_name$ that controls the enforcement of Windows User Account Control (UAC)"
+  observable:
+  - name: Registry.dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: Registry.user
+    type: User
+    role:
+    - Victim
+  - name: Registry.registry_key_name
+    type: Other
+    role:
+    - Target
diff --git a/detections/endpoint/disabling_systemrestore_in_registry.yml b/detections/endpoint/disabling_systemrestore_in_registry.yml
index 0de4f02151..f64df5e37d 100644
--- a/detections/endpoint/disabling_systemrestore_in_registry.yml
+++ b/detections/endpoint/disabling_systemrestore_in_registry.yml
@@ -48,3 +48,24 @@ tags:
   - Registry.dest
   - Registry.registry_value_name
   security_domain: endpoint
+  impact: 70
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 70
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: "$Registry.user$ on $Registry.dest$ modified registry key=$Registry.registry_key_name$ which disables the system restore of a machine"
+  observable:
+  - name: Registry.dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: Registry.user
+    type: User
+    role:
+    - Victim
+  - name: Registry.registry_key_name
+    type: Other
+    role:
+    - Target
diff --git a/detections/endpoint/disabling_task_manager.yml b/detections/endpoint/disabling_task_manager.yml
index 35d551fed1..a8a344d44c 100644
--- a/detections/endpoint/disabling_task_manager.yml
+++ b/detections/endpoint/disabling_task_manager.yml
@@ -47,3 +47,24 @@ tags:
   - Registry.dest
   - Registry.registry_value_name
   security_domain: endpoint
+  impact: 40
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 40
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: "$Registry.user$ on $Registry.dest$ modified registry key=$Registry.registry_key_name$ which disables the task manager of windows operating system"
+  observable:
+  - name: Registry.dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: Registry.user
+    type: User
+    role:
+    - Victim
+  - name: Registry.registry_key_name
+    type: Other
+    role:
+    - Target
diff --git a/detections/endpoint/winword_spawning_windows_script_host.yml b/detections/endpoint/winword_spawning_windows_script_host.yml
index dfa44f671d..42d2694dc2 100644
--- a/detections/endpoint/winword_spawning_windows_script_host.yml
+++ b/detections/endpoint/winword_spawning_windows_script_host.yml
@@ -52,3 +52,25 @@ tags:
   - user
   - parent_process_id
   security_domain: endpoint
+  impact: 70
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 70
+  context:
+  - Source:Endpoint
+  - Stage:Initial Access
+  message: "User $user$ on $dest$ spawned Windows Script Host from Winword.exe"
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Target
+
diff --git a/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml b/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml
index 8aa300e28e..6fb1c6d9d8 100644
--- a/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml
+++ b/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml
@@ -73,3 +73,22 @@ tags:
   - Consumer
   - Filter
   security_domain: endpoint
+  impact: 30
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 30
+  context:
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  - Stage:Persistence
+  message: "User $user$ on $host$ executed the following suspicious WMI query: $Query$.  Filter: $filter$. Consumer: $Consumer$.  EventCode: $EventCode$"
+  observable:
+  - name: host
+    type: Endpoint
+    role:
+    - Victim
+  - name: user
+    type: User
+    role:
+    - Victim
+
diff --git a/detections/endpoint/wmi_recon_running_process_or_services.yml b/detections/endpoint/wmi_recon_running_process_or_services.yml
index 8fd1c719fb..dadc57a7f0 100644
--- a/detections/endpoint/wmi_recon_running_process_or_services.yml
+++ b/detections/endpoint/wmi_recon_running_process_or_services.yml
@@ -45,3 +45,20 @@ tags:
   - ComputerName
   - User
   security_domain: endpoint
+  impact: 30
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 30
+  context:
+  - Source:Endpoint
+  - Stage:Recon
+  message: "Suspicious powerShell script execution by $user$ on $ComputerName$ via EventCode 4104, where WMI is performing an event query looking for running processes or running services"
+  observable:
+  - name: ComputerName
+    type: Endpoint
+    role:
+    - Victim
+  - name: User
+    type: User
+    role:
+    - Victim
diff --git a/detections/endpoint/write_executable_in_smb_share.yml b/detections/endpoint/write_executable_in_smb_share.yml
index 52e1962464..ac41d9fef2 100644
--- a/detections/endpoint/write_executable_in_smb_share.yml
+++ b/detections/endpoint/write_executable_in_smb_share.yml
@@ -47,3 +47,16 @@ tags:
   - src_port
   - Source_Address
   security_domain: endpoint
+  impact: 70
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 70
+  context:
+  - Source:Endpoint
+  - Stage:Lateral Movement
+  message: "$user$ dropped or created an executable file in known sensitive SMB share.  Share name=$Share_Name$, Target name=$Relative_Target_Name$, and Access mask=$Access_Mask$"
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim