Branch was auto-updated.

detections/endpoint/office_product_spawning_bitsadmin.yml

@@ -52,3 +52,20 @@ tags:
   - user
   - parent_process_id
   security_domain: endpoint
+  impact: 70 
+  confidence: 90  
+  # (impact * confidence)/100
+  risk_score: 63 
+  context:
+  - source:endpoint
+  - stage: recon
+  message: office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ in host $dest$ 
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: process_name
+    role:
+    - Attacker

detections/endpoint/office_product_spawning_certutil.yml

@@ -52,3 +52,20 @@ tags:
   - user
   - parent_process_id
   security_domain: endpoint
+  impact: 70 
+  confidence: 90  
+  # (impact * confidence)/100
+  risk_score: 63 
+  context:
+  - source:endpoint
+  - stage: recon
+  message: office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ in host $dest$ 
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: process_name
+    role:
+    - Attacker

detections/endpoint/office_product_spawning_mshta.yml

@@ -51,3 +51,20 @@ tags:
   - user
   - parent_process_id
   security_domain: endpoint
+  impact: 70 
+  confidence: 90  
+  # (impact * confidence)/100
+  risk_score: 63 
+  context:
+  - source:endpoint
+  - stage: recon
+  message: office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ in host $dest$ 
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: process_name
+    role:
+    - Attacker

detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml

@@ -55,3 +55,20 @@ tags:
   - user
   - parent_process_id
   security_domain: endpoint
+  impact: 70 
+  confidence: 90  
+  # (impact * confidence)/100
+  risk_score: 63 
+  context:
+  - source:endpoint
+  - stage: recon
+  message: office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ and no dll commandline $process$ in host $dest$ 
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: process name 
+    role:
+    - Attacker

detections/endpoint/office_product_spawning_wmic.yml

@@ -53,3 +53,20 @@ tags:
   - user
   - parent_process_id
   security_domain: endpoint
+  impact: 70 
+  confidence: 90  
+  # (impact * confidence)/100
+  risk_score: 63 
+  context:
+  - source:endpoint
+  - stage: recon
+  message: office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ in host $dest$ 
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: process_name
+    role:
+    - Attacker

detections/endpoint/overwriting_accessibility_binaries.yml

@@ -52,3 +52,20 @@ tags:
   - Filesystem.file_name
   - Filesystem.dest
   security_domain: endpoint
+  impact: 80 
+  confidence: 90  
+  # (impact * confidence)/100
+  risk_score: 72 
+  context:
+  - source:endpoint
+  - stage: privilege escalation
+  message: A suspicious file modification or replace in $file_path$  in host $dest$ 
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: file_path
+    type: file_path
+    role:
+    - Attacker

detections/endpoint/permission_modification_using_takeown_app.yml

@@ -48,3 +48,20 @@ tags:
   - Processes.process_id
   - Processes.process_guid
   security_domain: endpoint
+  impact: 70 
+  confidence: 80  
+  # (impact * confidence)/100
+  risk_score: 56
+  context:
+  - source:endpoint
+  - stage: Defense Evasion
+  message: A suspicious of execution of $process_name$ with process id $process_id$ and commandline $process$ to modify permission of directory or files in host $dest$ 
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: process name
+    role:
+    - Attacker

detections/endpoint/powershell_creating_thread_mutex.yml

@@ -46,3 +46,20 @@ tags:
   - ComputerName
   - User
   security_domain: endpoint
+  impact: 50 
+  confidence: 80  
+  # (impact * confidence)/100
+  risk_score: 40 
+  context:
+  - source:endpoint
+  - stage: Defense Evasion
+  message: A suspicious powershell script contains Thread Mutex in $Message$ with EventCode $EventCode$ in host $ComputerName$ 
+  observable:
+  - name: ComputerName
+    type: Hostname
+    role:
+    - Victim
+  - name: User
+    type: User
+    role:
+    - Victim

detections/endpoint/powershell_domain_enumeration.yml

@@ -52,3 +52,20 @@ tags:
   - User
   - EventCode
   security_domain: endpoint
+  impact: 60 
+  confidence: 70  
+  # (impact * confidence)/100
+  risk_score: 42 
+  context:
+  - source:endpoint
+  - stage: recon
+  message: A suspicious powershell script contains domain enumeration command in $Message$ with EventCode $EventCode$ in host $ComputerName$ 
+  observable:
+  - name: ComputerName
+    type: Hostname
+    role:
+    - Victim
+  - name: User
+    type: User
+    role:
+    - Victim

detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml

@@ -56,3 +56,20 @@ tags:
   - User
   - EventCode
   security_domain: endpoint
+  impact: 60 
+  confidence: 80  
+  # (impact * confidence)/100
+  risk_score: 48 
+  context:
+  - source:endpoint
+  - stage: recon
+  message: A suspicious powershell script contains GetProcAddress API in $Message$ with EventCode $EventCode$ in host $ComputerName$ 
+  observable:
+  - name: ComputerName
+    type: Hostname
+    role:
+    - Victim
+  - name: User
+    type: User
+    role:
+    - Victim

detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml

@@ -56,3 +56,20 @@ tags:
   - User
   - EventCode
   security_domain: endpoint
+  impact: 70 
+  confidence: 80  
+  # (impact * confidence)/100
+  risk_score: 56 
+  context:
+  - source:endpoint
+  - stage: Defense Evasion
+  message: A suspicious powershell script contains base64 command in $Message$ with EventCode $EventCode$ in host $ComputerName$ 
+  observable:
+  - name: ComputerName
+    type: Hostname
+    role:
+    - Victim
+  - name: User
+    type: User
+    role:
+    - Victim

detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml

@@ -55,3 +55,20 @@ tags:
   - User
   - EventCode
   security_domain: endpoint
+  impact: 70 
+  confidence: 80  
+  # (impact * confidence)/100
+  risk_score: 56 
+  context:
+  - source:endpoint
+  - stage: Defense Evasion
+  message: A suspicious powershell script contains reflective class assembly  command in $Message$ to load .net code in memory with EventCode $EventCode$ in host $ComputerName$ 
+  observable:
+  - name: ComputerName
+    type: Hostname
+    role:
+    - Victim
+  - name: User
+    type: User
+    role:
+    - Victim

detections/endpoint/powershell_processing_stream_of_data.yml

@@ -47,3 +47,20 @@ tags:
   - User
   - Score
   security_domain: endpoint
+  impact: 50 
+  confidence: 80  
+  # (impact * confidence)/100
+  risk_score: 40 
+  context:
+  - source:endpoint
+  - stage: Defense Evasion
+  message: A suspicious powershell script contains stream command in $Message$ commonly for processing compressed or to decompressed binary file with EventCode $EventCode$ in host $ComputerName$ 
+  observable:
+  - name: ComputerName
+    type: Hostname
+    role:
+    - Victim
+  - name: User
+    type: User
+    role:
+    - Victim

detections/endpoint/powershell_remote_thread_to_known_windows_process.yml

@@ -51,3 +51,21 @@ tags:
   - Computer
   - EventCode
   security_domain: endpoint
+  impact: 70 
+  confidence: 90  
+  # (impact * confidence)/100
+  risk_score: 63 
+  context:
+  - source:endpoint
+  - stage: Defense Evasion
+  - Privilege Escalation
+  message: A suspicious powershell process $process_name$ that tries to create a remote thread on target process $TargetImage$ with eventcode $EventCode$ in host $Computer$ 
+  observable:
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: process name
+    role:
+    - Attacker

detections/endpoint/powershell_start_bitstransfer.yml

@@ -50,3 +50,21 @@ tags:
   - Processes.user
   - Processes.dest
   security_domain: endpoint
+  impact: 70 
+  confidence: 80  
+  # (impact * confidence)/100
+  risk_score: 56 
+  context:
+  - source:endpoint
+  - stage:  Defense Evasion
+  - Persistence
+  message: A suspicious process $process_name$ with commandline $process$ that are related to bittransfer functionality in host $dest$ 
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: user
+    role:
+    - Victim

detections/endpoint/powershell_using_memory_as_backing_store.yml

@@ -46,3 +46,20 @@ tags:
   - ComputerName
   - User
   security_domain: endpoint
+  impact: 50 
+  confidence: 80  
+  # (impact * confidence)/100
+  risk_score: 40 
+  context:
+  - source:endpoint
+  - stage: Defense Evasion
+  message: A suspicious powershell script contains memorystream command in $Message$ as new object backstore with EventCode $EventCode$ in host $ComputerName$ 
+  observable:
+  - name: ComputerName
+    type: Hostname
+    role:
+    - Victim
+  - name: User
+    type: User
+    role:
+    - Victim

detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml

@@ -49,3 +49,20 @@ tags:
   - Processes.process_id
   - Processes.process_guid
   security_domain: endpoint
+  impact: 70 
+  confidence: 80  
+  # (impact * confidence)/100
+  risk_score: 56 
+  context:
+  - source:endpoint
+  - stage: Impact
+  message: A suspicious process $process_name$ with process id $process_id$ contains commandline $process$ to ignore all bcdedit execution failure in host $dest$ 
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: user
+    role:
+    - Victim

detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml

@@ -60,3 +60,20 @@ tags:
   - Filesystem.file_hash
   - Filesystem.user
   security_domain: network
+  impact: 70 
+  confidence: 90  
+  # (impact * confidence)/100
+  risk_score: 63 
+  context:
+  - source:endpoint
+  - stage: Initial Access
+  message: A process $process_name$ that launching .lnk file in $file_path$ in host $dest$ 
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: user
+    role:
+    - Victim

detections/endpoint/process_deleting_its_process_file_path.yml

@@ -51,3 +51,20 @@ tags:
   - result
   - _time
   security_domain: endpoint
+  impact: 60 
+  confidence: 100  
+  # (impact * confidence)/100
+  risk_score: 60 
+  context:
+  - source:endpoint
+  - stage: Credential Access
+  message: A process $Image$ tries to delete its process path in commandline $cmdline$ as part of defense evasion in host $Computer$ 
+  observable:
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: user
+    role:
+    - Victim

detections/endpoint/process_execution_via_wmi.yml

@@ -54,3 +54,20 @@ tags:
   - Processes.dest
   - Processes.process_name
   security_domain: endpoint
+  impact: 70 
+  confidence: 70  
+  # (impact * confidence)/100
+  risk_score: 49 
+  context:
+  - source:endpoint
+  - stage: Execution
+  message: A remote instance execution of wmic.exe that will spawn $parent_process_name$ in host $dest$ 
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: user
+    role:
+    - Victim

detections/endpoint/process_kill_base_on_file_path.yml

@@ -46,3 +46,20 @@ tags:
   - Processes.process
   - Processes.process_id
   security_domain: endpoint
+  impact: 70 
+  confidence: 80  
+  # (impact * confidence)/100
+  risk_score: 56 
+  context:
+  - source:endpoint
+  - stage:  Defense Evasion
+  message: A process $process_name$ attempt to kill process by its file path using commandline $process$ in host $dest$ 
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: user
+    role:
+    - Victim

detections/endpoint/processes_launching_netsh.yml

@@ -54,3 +54,20 @@ tags:
   - Processes.user
   - Processes.dest
   security_domain: endpoint
+  impact: 60 
+  confidence: 70  
+  # (impact * confidence)/100
+  risk_score: 42 
+  context:
+  - source:endpoint
+  - stage: Defense Evasion
+  message: A process $process_name$ that tries to execute netsh commandline $process$ in host $dest$ 
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: user
+    role:
+    - Victim

detections/endpoint/ransomware_notes_bulk_creation.yml

@@ -48,3 +48,20 @@ tags:
   - Image
   - user
   security_domain: endpoint
+  impact: 90 
+  confidence: 90  
+  # (impact * confidence)/100
+  risk_score: 81 
+  context:
+  - source:endpoint
+  - stage: Impact
+  message: A high frequency file creation of $file_name$ in different file path in host $Computer$ 
+  observable:
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: user
+    role:
+    - Victim

detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml

@@ -47,3 +47,20 @@ tags:
   - ComputerName
   - User
   security_domain: endpoint
+  impact: 70 
+  confidence: 80  
+  # (impact * confidence)/100
+  risk_score: 56
+  context:
+  - source:endpoint
+  - stage: Reconnaissance
+  message: A suspicious powershell script contains AV recon command in $Message$ with EventCode $EventCode$ in host $ComputerName$ 
+  observable:
+  - name: ComputerName
+    type: Hostname
+    role:
+    - Victim
+  - name: User
+    type: User
+    role:
+    - Victim

detections/endpoint/recon_using_wmi_class.yml

@@ -48,3 +48,20 @@ tags:
   - ComputerName
   - User
   security_domain: endpoint
+  impact: 75 
+  confidence: 80  
+  # (impact * confidence)/100
+  risk_score: 60 
+  context:
+  - source:endpoint
+  - stage: Reconnaissance
+  message: A suspicious powershell script contains host recon command in $Message$ with EventCode $EventCode$ in host $ComputerName$ 
+  observable:
+  - name: ComputerName
+    type: Hostname
+    role:
+    - Victim
+  - name: User
+    type: User
+    role:
+    - Victim

detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml

@@ -60,3 +60,22 @@ tags:
   - Processes.process_id
   - Processes.dest
   security_domain: endpoint
+  impact: 75 
+  confidence: 60  
+  # (impact * confidence)/100
+  risk_score: 45 
+  context:
+  - source:endpoint
+  - stage: Persistence
+  - Privilege Escalation
+  - Defense Evasion
+  message: A reg.exe process $process_name$ with commandline $process$ in host $dest$ 
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: user
+    role:
+    - Victim

detections/endpoint/registry_keys_for_creating_shim_databases.yml

@@ -48,3 +48,21 @@ tags:
   - Registry.dest
   - Registry.user
   security_domain: endpoint
+  impact: 70 
+  confidence: 80  
+  # (impact * confidence)/100
+  risk_score: 56 
+  context:
+  - source:endpoint
+  - stage: Privilege Escalation
+  - Persistence
+  message: A registry activity in $registry_path$ related to shim modication in host $dest$ 
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: user
+    role:
+    - Victim

detections/endpoint/registry_keys_used_for_persistence.yml

@@ -61,3 +61,21 @@ tags:
   - Registry.dest
   - Registry.user
   security_domain: endpoint
+  impact: 80 
+  confidence: 95  
+  # (impact * confidence)/100
+  risk_score: 76 
+  context:
+  - source:endpoint
+  - stage: Persistence
+  - Privilege Escalation
+  message: A registry activity in $registry_path$ related to persistence in host $dest$ 
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: user
+    role:
+    - Victim

detections/endpoint/registry_keys_used_for_privilege_escalation.yml

@@ -53,3 +53,21 @@ tags:
   - Registry.dest
   - Registry.user
   security_domain: endpoint
+  impact: 80 
+  confidence: 95  
+  # (impact * confidence)/100
+  risk_score: 76 
+  context:
+  - source:endpoint
+  - stage: Persistence
+  - Privilege Escalation
+  message: A registry activity in $registry_path$ related to privilege escalation in host $dest$ 
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: user
+    role:
+    - Victim

detections/endpoint/remote_process_instantiation_via_wmi.yml

@@ -55,3 +55,20 @@ tags:
   - Processes.dest
   - Processes.user
   security_domain: endpoint
+  impact: 70 
+  confidence: 70  
+  # (impact * confidence)/100
+  risk_score: 49 
+  context:
+  - source:endpoint
+  - stage: Execution
+  message: A wmic.exe process $process$ contain process spawn commandline $process$ in host $dest$ 
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: user
+    role:
+    - Victim

detections/endpoint/remote_wmi_command_attempt.yml

@@ -59,3 +59,20 @@ tags:
   - Processes.parent_process_id
   - Processes.process_id
   security_domain: endpoint
+  impact: 60 
+  confidence: 60  
+  # (impact * confidence)/100
+  risk_score: 36 
+  context:
+  - source:endpoint
+  - stage: Execution
+  message: A wmic.exe process $process$ contain node commandline $process$ in host $dest$ 
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: user
+    role:
+    - Victim

detections/endpoint/resize_shadowstorage_volume.yml

@@ -53,3 +53,20 @@ tags:
   - Processes.dest
   - Processes.user
   security_domain: endpoint
+  impact: 80 
+  confidence: 90  
+  # (impact * confidence)/100
+  risk_score: 72 
+  context:
+  - source:endpoint
+  - stage: Impact
+  message: A process $parent_process_name$ attempt to resize shadow copy with commandline $process$ in host $dest$ 
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: user
+    role:
+    - Victim

detections/endpoint/revil_common_exec_parameter.yml

@@ -50,3 +50,20 @@ tags:
   - Processes.process_id
   - Processes.process_guid
   security_domain: endpoint
+  impact: 60 
+  confidence: 90  
+  # (impact * confidence)/100
+  risk_score: 54 
+  context:
+  - source:endpoint
+  - stage: Execution
+  message: A process $process_name$ with commandline $process$ related to revil ransomware in host $dest$ 
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: user
+    role:
+    - Victim

detections/endpoint/revil_registry_entry.yml

@@ -48,3 +48,20 @@ tags:
   - Registry.registry_path
   - Registry.registry_key_name
   security_domain: endpoint
+  impact: 60 
+  confidence: 100  
+  # (impact * confidence)/100
+  risk_score: 60 
+  context:
+  - source:endpoint
+  - stage: Defense Evasion
+  message: A registry entry $registry_path$ with registry value $registry_value_name$ and $registry_value_name$ related to revil ransomware in host $dest$ 
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: user
+    role:
+    - Victim

detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml

@@ -56,4 +56,22 @@ tags:
   - parent_process_name
   - dest_port
   - process_path
+  - Processes.dest
   security_domain: endpoint
+  impact: 70 
+  confidence: 100  
+  # (impact * confidence)/100
+  risk_score: 70 
+  context:
+  - source:endpoint
+  - stage: Defense Evasion
+  message: A rundll32 process $process_name$ with no commandline argument like this process commandline $process$ in host $dest$ 
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: processname
+    role:
+    - Attacker

detections/endpoint/rundll_loading_dll_by_ordinal.yml

@@ -52,3 +52,20 @@ tags:
   - Processes.dest
   - Processes.user
   security_domain: endpoint
+  impact: 70 
+  confidence: 100  
+  # (impact * confidence)/100
+  risk_score: 70 
+  context:
+  - source:endpoint
+  - stage: Defense Evasion
+  message: A rundll32 process $process_name$ with ordinal parameter like this process commandline $process$ in host $dest$ 
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: user
+    role:
+    - Victim

detections/endpoint/ryuk_test_files_detected.yml

@@ -44,3 +44,20 @@ tags:
   - Filesystem.dest
   - Filesystem.user
   security_domain: endpoint
+  impact: 70 
+  confidence: 100  
+  # (impact * confidence)/100
+  risk_score: 70 
+  context:
+  - source:endpoint
+  - stage: Impact
+  message: A creation of ryuk test file $file_path$ in host $dest$ 
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: user
+    role:
+    - Victim

detections/endpoint/ryuk_wake_on_lan_command.yml

@@ -55,3 +55,20 @@ tags:
   - Processes.process_id
   - Processes.parent_process_id
   security_domain: endpoint
+  impact: 70 
+  confidence: 90  
+  # (impact * confidence)/100
+  risk_score: 63
+  context:
+  - source:endpoint
+  - stage: Execution
+  message: A process $process_name$ with wake on LAN commandline $process$ in host $dest$ 
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: user
+    role:
+    - Victim

detections/endpoint/samsam_test_file_write.yml

@@ -46,3 +46,20 @@ tags:
   - Filesystem.file_name
   - Filesystem.file_path
   security_domain: endpoint
+  impact: 60 
+  confidence: 20  
+  # (impact * confidence)/100
+  risk_score: 12 
+  context:
+  - source:endpoint
+  - stage: Impact
+  message: A samsam ransomware test file creation in $file_path$ in host $dest$ 
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: user
+    role:
+    - Victim

detections/endpoint/sc_exe_manipulating_windows_services.yml

@@ -59,3 +59,21 @@ tags:
   - Processes.dest
   - Processes.user
   security_domain: endpoint
+  impact: 70 
+  confidence: 80  
+  # (impact * confidence)/100
+  risk_score: 56 
+  context:
+  - source:endpoint
+  - stage: Persistence
+  - Privilege Escalation
+  message: A sc process $process_name$ with commandline $process$ to create of configure services in host $dest$ 
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: user
+    role:
+    - Victim

detections/endpoint/schedule_task_with_http_command_arguments.yml

@@ -54,3 +54,22 @@ tags:
   - Hidden
   - Arguments
   security_domain: endpoint
+  impact: 70 
+  confidence: 90  
+  # (impact * confidence)/100
+  risk_score: 63 
+  context:
+  - source:endpoint
+  - stage: Execution
+  - Persistence
+  - Privilege Escalation
+  message: A schedule task process commandline arguments $Arguments$ with http string on it in host $dest$ 
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: Arguments
+    type: Arguments
+    role:
+    - Attacker

detections/endpoint/schedule_task_with_rundll32_command_trigger.yml

@@ -56,3 +56,20 @@ tags:
   - Hidden
   - Arguments
   security_domain: endpoint
+  impact: 70 
+  confidence: 100 
+  # (impact * confidence)/100
+  risk_score: 70
+  context:
+  - source:endpoint
+  - stage: Defense Evasion
+  message: A schedule task process commandline rundll32 arguments $Arguments$ in host $dest$ 
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: Arguments
+    type: Arguments
+    role:
+    - Attacker

detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml

@@ -51,3 +51,22 @@ tags:
   - Processes.parent_process_name
   - Processes.dest
   security_domain: endpoint
+  impact: 70 
+  confidence: 80  
+  # (impact * confidence)/100
+  risk_score: 56 
+  context:
+  - source:endpoint
+  - stage: Execution
+  - Persistence
+  - Privilege Escalation
+  message: A schedule task process $process_name$ with create or delete commandline $process$ in host $dest$ 
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: user
+    role:
+    - Victim

detections/endpoint/schtasks_run_task_on_demand.yml

@@ -47,3 +47,22 @@ tags:
   - Processes.dest
   - Processes.user
   security_domain: endpoint
+  impact: 60 
+  confidence: 80  
+  # (impact * confidence)/100
+  risk_score: 48 
+  context:
+  - source:endpoint
+  - stage: Execution
+  - Persistence
+  - Privilege Escalation
+  message: A "on demand" execution of schedule task process $process_name$  using commandline $process$ in host $dest$ 
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: user
+    role:
+    - Victim

detections/endpoint/schtasks_scheduling_job_on_remote_system.yml

@@ -51,3 +51,22 @@ tags:
   - Processes.dest
   - Processes.user
   security_domain: endpoint
+  impact: 70 
+  confidence: 90  
+  # (impact * confidence)/100
+  risk_score: 63 
+  context:
+  - source:endpoint
+  - stage:  Execution
+  - Persistence
+  - Privilege Escalation
+  message: A schedule task process $process_name$ with remote job commandline $process$ in host $dest$ 
+  observable:
+  - name: Processes.dest
+    type: Hostname
+    role:
+    - Victim
+  - name: Processes.user
+    type: user
+    role:
+    - Victim

detections/endpoint/schtasks_used_for_forcing_a_reboot.yml

@@ -48,3 +48,22 @@ tags:
   - Processes.dest
   - Processes.user
   security_domain: endpoint
+  impact: 70 
+  confidence: 80  
+  # (impact * confidence)/100
+  risk_score: 56 
+  context:
+  - source:endpoint
+  - stage: Execution
+  - Persistence
+  - Privilege Escalation
+  message: A schedule task process $process_name$ with force reboot commandline $process$ in host $dest$ 
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: user
+    role:
+    - Victim

detections/endpoint/script_execution_via_wmi.yml

@@ -49,3 +49,20 @@ tags:
   - Processes.user
   - Processes.dest
   security_domain: endpoint
+  impact: 60 
+  confidence: 60  
+  # (impact * confidence)/100
+  risk_score: 36 
+  context:
+  - source:endpoint
+  - stage: Execution
+  message: A wmic.exe process $process_name$ taht execute script in host $dest$ 
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: user
+    role:
+    - Victim

detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml

@@ -51,3 +51,21 @@ tags:
   - dest_port
   - process_path
   security_domain: endpoint
+  impact: 70 
+  confidence: 100  
+  # (impact * confidence)/100
+  risk_score: 70 
+  context:
+  - source:endpoint
+  - stage: Defense Evasion
+  - Privilege Escalation
+  message: A searchprotocolhost.exe process $process_name$ with no commandline in host $dest$ 
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: processname
+    role:
+    - Attacker

detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml

@@ -45,7 +45,25 @@ tags:
   - Processes.process
   - Processes.parent_process_name
   - Processes.parent_process
-  - Processes.dest Processes.user
+  - Processes.dest 
+  - Processes.user
   - Processes.process_id
   - Processes.process_guid
   security_domain: endpoint
+  impact: 80 
+  confidence: 100  
+  # (impact * confidence)/100
+  risk_score: 80 
+  context:
+  - source:endpoint
+  - stage: Credential Access
+  message: A secretdump process $process_name$ with secretdump commandline $process$ to dump credentials in host $dest$ 
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: user
+    role:
+    - Victim

detections/endpoint/services_escalate_exe.yml

@@ -57,3 +57,21 @@ tags:
   - Processes.process_id
   - Processes.parent_process_id
   security_domain: endpoint
+  impact: 80 
+  confidence: 95  
+  # (impact * confidence)/100
+  risk_score: 76 
+  context:
+  - source:endpoint
+  - stage: Privilege Escalation
+  - Defense Evasion
+  message: A service process $parent_process_name$ with process path $process_path$ in host $dest$ 
+  observable:
+  - name: Processes.dest
+    type: Hostname
+    role:
+    - Victim
+  - name: Processes.user
+    type: user
+    role:
+    - Victim

detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml

@@ -53,3 +53,20 @@ tags:
   - Registry.registry_value_name
   - Registry.dest
   security_domain: endpoint
+  impact: 60 
+  confidence: 80  
+  # (impact * confidence)/100
+  risk_score: 48 
+  context:
+  - source:endpoint
+  - stage: Execution
+  message: A registry modification in $registry_path$ with reg key $registry_key_name$ and reg value $registry_value_name$ in host $dest$ 
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: registry_path
+    type: RegistryPath
+    role:
+    - Others

detections/endpoint/shim_database_file_creation.yml

@@ -49,3 +49,21 @@ tags:
   - Filesystem.file_name
   - Filesystem.dest
   security_domain: endpoint
+  impact: 70 
+  confidence: 80  
+  # (impact * confidence)/100
+  risk_score: 56 
+  context:
+  - source:endpoint
+  - stage: Privilege Escalation
+  - Persistence
+  message: A process that possibly write shim database in $file_path$ in host $dest$ 
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: file_path
+    type: file path
+    role:
+    - Others

detections/endpoint/shim_database_installation_with_suspicious_parameters.yml

@@ -49,3 +49,21 @@ tags:
   - Processes.dest
   - Processes.user
   security_domain: endpoint
+  impact: 70 
+  confidence: 90  
+  # (impact * confidence)/100
+  risk_score: 63 
+  context:
+  - source:endpoint
+  - stage: Privilege Escalation
+  - Persistence
+  message: A process $process_name$ that possible create a shim db silently in host $dest$ 
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: user
+    role:
+    - Victim

detections/endpoint/short_lived_windows_accounts.yml

@@ -46,3 +46,20 @@ tags:
   - All_Changes.user
   - All_Changes.dest
   security_domain: access
+  impact: 70 
+  confidence: 90  
+  # (impact * confidence)/100
+  risk_score: 63 
+  context:
+  - source:endpoint
+  - stage: Persistence
+  message: A user account created or delete shortly in host $dest$ 
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: user
+    role:
+    - Victim

detections/endpoint/single_letter_process_on_endpoint.yml

@@ -49,3 +49,20 @@ tags:
   - Processes.process
   - Processes.process_name
   security_domain: endpoint
+  impact: 70 
+  confidence: 90  
+  # (impact * confidence)/100
+  risk_score: 63
+  context:
+  - source:endpoint
+  - stage: Execution
+  message: A suspicious process $process_name$ with single letter in host $dest$ 
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: user
+    role:
+    - Victim

detections/endpoint/slui_runas_elevated.yml

@@ -54,3 +54,20 @@ tags:
   - Processes.process_id
   - Processes.parent_process_id
   security_domain: endpoint
+  impact: 70 
+  confidence: 90  
+  # (impact * confidence)/100
+  risk_score: 63 
+  context:
+  - source:endpoint
+  - stage: Privilege Escalation
+  message: A slui process $process_name$ with elevated commandline $process$ in host $dest$ 
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: Hostname
+    role:
+    - Victim

detections/endpoint/slui_spawning_a_process.yml

@@ -52,3 +52,20 @@ tags:
   - Processes.process_id
   - Processes.parent_process_id
   security_domain: endpoint
+  impact: 70 
+  confidence: 90  
+  # (impact * confidence)/100
+  risk_score: 63 
+  context:
+  - source:endpoint
+  - stage: Privilege Escalation
+  message: A slui process $parent_process_name$ spawning child process $process_name$ in host $dest$ 
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: user
+    role:
+    - Victim

detections/endpoint/ssa___deny_permission_using_cacls_utility.yml

@@ -49,3 +49,20 @@ tags:
   - dest_user_id
   - process
   security_domain: endpoint
+  impact: 50 
+  confidence: 70  
+  # (impact * confidence)/100
+  risk_score: 35 
+  context:
+  - source:endpoint
+  - stage: Defense Evasion
+  message: A cacls process $process_name$ with commandline $cmd_line$ try to deny a permission of a file or directory in host $dest_device_id$ 
+  observable:
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: dest_user_id
+    type: user
+    role:
+    - Victim

detections/endpoint/ssa___first_time_seen_cmd_line.yml

@@ -58,3 +58,20 @@ tags:
   - process
   risk_severity: low
   security_domain: endpoint
+  impact: 50 
+  confidence: 60  
+  # (impact * confidence)/100
+  risk_score: 30 
+  context:
+  - source:endpoint
+  - stage: Defense Evasion
+  message: A cmd process $process_name$ with commandline $cmd_line$ try to execute command has not previously seen in host $dest_device_id$ 
+  observable:
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: dest_user_id
+    type: user
+    role:
+    - Victim

detections/endpoint/ssa___grant_permission_using_cacls_utility.yml

@@ -49,3 +49,20 @@ tags:
   - dest_user_id
   - process
   security_domain: endpoint
+  impact: 50 
+  confidence: 70  
+  # (impact * confidence)/100
+  risk_score: 35 
+  context:
+  - source:endpoint
+  - stage: Defense Evasion
+  message: A cacls process $process_name$ with commandline $cmd_line$ try to grant user a permission to a file or directory in host $dest_device_id$ 
+  observable:
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: dest_user_id
+    type: user
+    role:
+    - Victim

detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml

@@ -52,3 +52,20 @@ tags:
   - dest_user_id
   - process
   security_domain: endpoint
+  impact: 50 
+  confidence: 70  
+  # (impact * confidence)/100
+  risk_score: 35 
+  context:
+  - source:endpoint
+  - stage: Defense Evasion
+  message: A cacls process $process_name$ with commandline $cmd_line$ try to modify a permission of a file or directory in host $dest_device_id$ 
+  observable:
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: dest_user_id
+    type: user
+    role:
+    - Victim

detections/endpoint/ssa___system_process_running_unexpected_location.yml

@@ -257,3 +257,20 @@ tags:
   - process_path
   risk_severity: low
   security_domain: endpoint
+  impact: 70 
+  confidence: 80  
+  # (impact * confidence)/100
+  risk_score: 56 
+  context:
+  - source:endpoint
+  - stage: Defense Evasion
+  message: A system process $process_name$ with commandline $cmd_line$ spawn in non-default folder path in host $dest_device_id$ 
+  observable:
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: dest_user_id
+    type: user
+    role:
+    - Victim

detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml

@@ -71,3 +71,20 @@ tags:
   - process_name
   risk_severity: low
   security_domain: endpoint
+  impact: 50 
+  confidence: 50  
+  # (impact * confidence)/100
+  risk_score: 25 
+  context:
+  - source:endpoint
+  - stage: Defense Evasion
+  message: A system process $process_name$ with commandline $cmd_line$ spawn iin short period of time in host $dest_device_id$ 
+  observable:
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: processname
+    role:
+    - Others

detections/endpoint/ssa___unusually_long_command_line.yml

@@ -52,3 +52,20 @@ tags:
   - process
   risk_severity: low
   security_domain: endpoint
+  impact: 30 
+  confidence: 40  
+  # (impact * confidence)/100
+  risk_score: 12 
+  context:
+  - source:endpoint
+  - stage: Defense Evasion
+  message: A  process $process_name$ with a long commandline $cmd_line$ executed in host $dest_device_id$ 
+  observable:
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: dest_user_id
+    type: user
+    role:
+    - Victim

detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml

@@ -53,3 +53,20 @@ tags:
   - dest_user_id
   - process
   security_domain: endpoint
+  impact: 70 
+  confidence: 90  
+  # (impact * confidence)/100
+  risk_score: 63 
+  context:
+  - source:endpoint
+  - stage: Defense Evasion
+  message: A wevtutil process $process_name$ with commandline $cmd_line$ to clear event logs in host $dest_device_id$ 
+  observable:
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: dest_user_id
+    type: user
+    role:
+    - Victim

detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml

@@ -50,3 +50,20 @@ tags:
   - dest_user_id
   - process
   security_domain: endpoint
+  impact: 70 
+  confidence: 90  
+  # (impact * confidence)/100
+  risk_score: 63 
+  context:
+  - source:endpoint
+  - stage: Defense Evasion
+  message: A wevtutil process $process_name$ with commandline $cmd_line$ to disable event logs in host $dest_device_id$ 
+  observable:
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: dest_user_id
+    type: user
+    role:
+    - Victim

detections/endpoint/xmrig_driver_loaded.yml

@@ -42,3 +42,21 @@ tags:
   - Signature
   - Signed
   security_domain: endpoint
+  impact: 80 
+  confidence: 100  
+  # (impact * confidence)/100
+  risk_score: 80 
+  context:
+  - source:endpoint
+  - stage: Privilege Escalation
+  - Persistence
+  message: A driver $ImageLoaded$ related to xmrig crytominer loaded in host $Computer$ 
+  observable:
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  - name: ImageLoaded
+    type: ImageLoaded
+    role:
+    - Attacker

detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml

@@ -80,3 +80,20 @@ tags:
   - DNS.query
   - host
   security_domain: network
+  impact: 70 
+  confidence: 80  
+  # (impact * confidence)/100
+  risk_score: 56 
+  context:
+  - source:endpoint
+  - stage: Initial Access
+  message: A dns query $query$ from your infra connecting to suspicious domain in host  $host$ 
+  observable:
+  - name: host
+    type: Hostname
+    role:
+    - Victim
+  - name: query
+    type: dnsquery
+    role:
+    - Attacker

detections/network/dns_query_length_with_high_standard_deviation.yml

@@ -46,3 +46,20 @@ tags:
   - _time
   - DNS.query
   security_domain: network
+  impact: 70
+  confidence: 80
+  # (impact * confidence)/100
+  risk_score: 56
+  context:
+  - Source:Endpoint
+  -  Stage:Exfiltration
+  message: A dns query $query$ with 2 time standard deviation of name len of the dns query in host  $host$
+  observable:
+  - name: host
+    type: Hostname
+    role:
+    - Victim
+  - name: query
+    type: dnsquery
+    role:
+    - Attacker

detections/network/multiple_archive_files_http_post_traffic.yml

@@ -56,4 +56,22 @@ tags:
   - bytes_out
   - archive_hdr1
   - archive_hdr2
+  - form_data
   security_domain: network
+  impact: 50 
+  confidence: 50  
+  # (impact * confidence)/100
+  risk_score: 25 
+  context:
+  - Source:Endpoint
+  -  Stage:Exfiltration
+  message: A http post $http_method$ sending packet with possible archive bytes header 4form_data$ in uri path $uri_path$ 
+  observable:
+  - name: uri_path
+    type: UriPath
+    role:
+    - Attacker
+  - name: form_data
+    type: formdata
+    role:
+    - Attacker

detections/network/plain_http_post_exfiltrated_data.yml

@@ -45,3 +45,21 @@ tags:
   - bytes_in
   - bytes_out
   security_domain: network
+  impact: 70 
+  confidence: 90  
+  # (impact * confidence)/100
+  risk_score: 63 
+  context:
+  - Source:Endpoint
+  -  Stage:Exfiltration
+  message: A http post $http_method$ sending packet with plain text of information $form_data$ in uri path $uri_path$ 
+  observable:
+  - name: uri_path
+    type: UriPath
+    role:
+    - Attacker
+  - name: form_data
+    type: formdata
+    role:
+    - Attacker
+