+
+
+
+ATT&CK
+ +
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* ID.RA
+* RS.MI
+* PR.IP
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 4
+
+
+
+
+
+
+
#### Search
```
@@ -43,10 +106,10 @@ The search is used to detect systems that are still vulnerable to the Spectre an
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `spectre_and_meltdown_vulnerable_systems_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **spectre_and_meltdown_vulnerable_systems_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -62,9 +125,6 @@ It is possible that your vulnerability scanner is not detecting that the patches
* [Spectre And Meltdown Vulnerabilities](/stories/spectre_and_meltdown_vulnerabilities)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -74,19 +134,11 @@ It is possible that your vulnerability scanner is not detecting that the patches
| 25.0 | 50 | 50 | tbd |
-#### CVE
-
-| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
-| ----------- | ----------- | -------------- |
-| [CVE-2017-5753](https://nvd.nist.gov/vuln/detail/CVE-2017-5753) | Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis. | 4.7 |
-
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md b/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md
index 77db541995..0917a3d674 100644
--- a/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md
+++ b/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md
@@ -23,14 +23,72 @@ We have not been able to test, simulate, or build datasets for this object. Use
The search queries the authentication logs for assets that are categorized as routers in the ES Assets and Identity Framework, to identify connections that have not been seen before in the last 30 days.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Authentication](https://docs.splunk.com/Documentation/CIM/latest/User/Authentication)
-
- **Last Updated**: 2017-09-12
- **Author**: Bhavin Patel, Splunk
- **ID**: bce3ed7c-9b1f-42a0-abdf-d8b123a34836
+
+#### Annotations
+
+CVE
+ +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
+| ----------- | ----------- | -------------- |
+| [CVE-2017-5753](https://nvd.nist.gov/vuln/detail/CVE-2017-5753) | Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis. | 4.7 |
+
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* PR.AC
+* PR.IP
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 11
+
+
+
+
+
+
+
#### Search
```
@@ -46,10 +104,10 @@ The search queries the authentication logs for assets that are categorized as ro
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_new_login_attempts_to_routers_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_new_login_attempts_to_routers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -68,9 +126,6 @@ Legitimate router connections may appear as new connections
* [Router and Infrastructure Security](/stories/router_and_infrastructure_security)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -80,13 +135,11 @@ Legitimate router connections may appear as new connections
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2017-09-12-extended_period_without_successful_netbackup_backups.md b/docs/_posts/2017-09-12-extended_period_without_successful_netbackup_backups.md
index 13ee1d05bb..b62622a8d1 100644
--- a/docs/_posts/2017-09-12-extended_period_without_successful_netbackup_backups.md
+++ b/docs/_posts/2017-09-12-extended_period_without_successful_netbackup_backups.md
@@ -20,14 +20,70 @@ tags:
This search returns a list of hosts that have not successfully completed a backup in over a week. Deprecated because it's a infrastructure monitoring.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2017-09-12
- **Author**: David Dorsey, Splunk
- **ID**: a34aae96-ccf8-4aef-952c-3ea214444440
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* PR.IP
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 10
+
+
+
+
+
+
+
#### Search
```
@@ -43,10 +99,10 @@ This search returns a list of hosts that have not successfully completed a backu
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [netbackup](https://github.com/splunk/security_content/blob/develop/macros/netbackup.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `extended_period_without_successful_netbackup_backups_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **extended_period_without_successful_netbackup_backups_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -64,9 +120,6 @@ None identified
* [Monitor Backup Solution](/stories/monitor_backup_solution)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -76,13 +129,11 @@ None identified
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2017-09-12-identify_new_user_accounts.md b/docs/_posts/2017-09-12-identify_new_user_accounts.md
index 1c42a5becd..4cd639a7ed 100644
--- a/docs/_posts/2017-09-12-identify_new_user_accounts.md
+++ b/docs/_posts/2017-09-12-identify_new_user_accounts.md
@@ -26,21 +26,75 @@ tags:
This detection search will help profile user accounts in your environment by identifying newly created accounts that have been added to your network in the past week.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2017-09-12
- **Author**: Bhavin Patel, Splunk
- **ID**: 475b9e27-17e4-46e2-b7e2-648221be3b89
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1078.002](https://attack.mitre.org/techniques/T1078/002/) | Domain Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* PR.IP
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -58,7 +112,7 @@ This detection search will help profile user accounts in your environment by ide
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `identify_new_user_accounts_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **identify_new_user_accounts_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -74,9 +128,6 @@ If the Identity_Management data model is not updated regularly, this search coul
* [Account Monitoring and Controls](/stories/account_monitoring_and_controls)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -86,13 +137,11 @@ If the Identity_Management data model is not updated regularly, this search coul
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2017-09-12-unsuccessful_netbackup_backups.md b/docs/_posts/2017-09-12-unsuccessful_netbackup_backups.md
index 5f5b08deef..0e4e2f3e76 100644
--- a/docs/_posts/2017-09-12-unsuccessful_netbackup_backups.md
+++ b/docs/_posts/2017-09-12-unsuccessful_netbackup_backups.md
@@ -20,14 +20,70 @@ tags:
This search gives you the hosts where a backup was attempted and then failed.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2017-09-12
- **Author**: David Dorsey, Splunk
- **ID**: a34aae96-ccf8-4aaa-952c-3ea21444444f
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* PR.IP
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 10
+
+
+
+
+
+
+
#### Search
```
@@ -42,10 +98,10 @@ This search gives you the hosts where a backup was attempted and then failed.
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [netbackup](https://github.com/splunk/security_content/blob/develop/macros/netbackup.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `unsuccessful_netbackup_backups_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **unsuccessful_netbackup_backups_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -61,9 +117,6 @@ None identified
* [Monitor Backup Solution](/stories/monitor_backup_solution)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -73,13 +126,11 @@ None identified
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md b/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md
index 5bb6c25e69..11d626a206 100644
--- a/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md
+++ b/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md
@@ -23,14 +23,73 @@ We have not been able to test, simulate, or build datasets for this object. Use
By populating the organization's assets within the assets_by_str.csv, we will be able to detect unauthorized devices that are trying to connect with the organization's network by inspecting DHCP request packets, which are issued by devices when they attempt to obtain an IP address from the DHCP server. The MAC address associated with the source of the DHCP request is checked against the list of known devices, and reports on those that are not found.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Network_Sessions](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkSessions)
-
- **Last Updated**: 2017-09-13
- **Author**: Bhavin Patel, Splunk
- **ID**: dcfd6b40-42f9-469d-a433-2e53f7489ff4
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+* Delivery
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* ID.AM
+* PR.DS
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 1
+
+
+
+
+
+
+
#### Search
```
@@ -50,7 +109,7 @@ By populating the organization's assets within the assets_by_str.csv, we will be
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `detect_unauthorized_assets_by_mac_address_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_unauthorized_assets_by_mac_address_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -69,11 +128,6 @@ This search might be prone to high false positives. Please consider this when co
* [Asset Tracking](/stories/asset_tracking)
-#### Kill Chain Phase
-* Reconnaissance
-* Delivery
-* Actions on Objectives
-
#### RBA
@@ -83,13 +137,11 @@ This search might be prone to high false positives. Please consider this when co
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md b/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md
index 8f3da14f0b..e5c9ae0f7f 100644
--- a/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md
+++ b/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md
@@ -23,14 +23,71 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search looks for Windows endpoints that have not generated an event indicating a successful Windows update in the last 60 days. Windows updates are typically released monthly and applied shortly thereafter. An endpoint that has not successfully applied an update in this time frame indicates the endpoint is not regularly being patched for some reason.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Updates](https://docs.splunk.com/Documentation/CIM/latest/User/Updates)
-
- **Last Updated**: 2017-09-15
- **Author**: Bhavin Patel, Splunk
- **ID**: 1a77c08c-2f56-409c-a2d3-7d64617edd4f
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* PR.MA
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 18
+
+
+
+
+
+
+
#### Search
```
@@ -49,10 +106,10 @@ This search looks for Windows endpoints that have not generated an event indicat
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `no_windows_updates_in_a_time_frame_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **no_windows_updates_in_a_time_frame_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -71,9 +128,6 @@ None identified
* [Monitor for Updates](/stories/monitor_for_updates)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -83,13 +137,11 @@ None identified
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md b/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md
index 309c3f1e42..bf41182a1c 100644
--- a/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md
+++ b/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md
@@ -23,14 +23,70 @@ We have not been able to test, simulate, or build datasets for this object. Use
Attackers often use spaces as a means to obfuscate an attachment's file extension. This search looks for messages with email attachments that have many spaces within the file names.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Email](https://docs.splunk.com/Documentation/CIM/latest/User/Email)
-
- **Last Updated**: 2017-09-19
- **Author**: David Dorsey, Splunk
- **ID**: 56e877a6-1455-4479-ada6-0550dc1e22f8
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Delivery
+
+
+
+
+
+
+NIST
+ +
+
+* PR.IP
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 7
+
+
+
+
+
+
+
#### Search
```
@@ -47,10 +103,10 @@ Attackers often use spaces as a means to obfuscate an attachment's file extensio
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `email_attachments_with_lots_of_spaces_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **email_attachments_with_lots_of_spaces_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -74,9 +130,6 @@ None at this time
* [Suspicious Emails](/stories/suspicious_emails)
-#### Kill Chain Phase
-* Delivery
-
#### RBA
@@ -86,13 +139,11 @@ None at this time
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2017-09-19-open_redirect_in_splunk_web.md b/docs/_posts/2017-09-19-open_redirect_in_splunk_web.md
index d1172e8f46..42b0015a29 100644
--- a/docs/_posts/2017-09-19-open_redirect_in_splunk_web.md
+++ b/docs/_posts/2017-09-19-open_redirect_in_splunk_web.md
@@ -21,14 +21,81 @@ tags:
This search allows you to look for evidence of exploitation for CVE-2016-4859, the Splunk Open Redirect Vulnerability.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2017-09-19
- **Author**: Bhavin Patel, Splunk
- **ID**: d199fb99-2312-451a-9daa-e5efa6ed76a7
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Delivery
+
+
+
+
+
+
+NIST
+ +
+
+* ID.RA
+* RS.MI
+* PR.PT
+* PR.AC
+* PR.IP
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 4
+* CIS 18
+
+
+
+
+
+
+
#### Search
```
@@ -39,7 +106,7 @@ index=_internal sourcetype=splunk_web_access return_to="/%09/*"
#### Macros
The SPL above uses the following Macros:
-Note that `open_redirect_in_splunk_web_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **open_redirect_in_splunk_web_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -55,9 +122,6 @@ None identified
* [Splunk Vulnerabilities](/stories/splunk_vulnerabilities)
-#### Kill Chain Phase
-* Delivery
-
#### RBA
@@ -67,19 +131,11 @@ None identified
| 25.0 | 50 | 50 | tbd |
-#### CVE
-
-| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
-| ----------- | ----------- | -------------- |
-| [CVE-2016-4859](https://nvd.nist.gov/vuln/detail/CVE-2016-4859) | Open redirect vulnerability in Splunk Enterprise 6.4.x prior to 6.4.3, Splunk Enterprise 6.3.x prior to 6.3.6, Splunk Enterprise 6.2.x prior to 6.2.10, Splunk Enterprise 6.1.x prior to 6.1.11, Splunk Enterprise 6.0.x prior to 6.0.12, Splunk Enterprise 5.0.x prior to 5.0.16 and Splunk Light prior to 6.4.3 allows to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. | 5.8 |
-
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md b/docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md
index 67c3810afb..cff978ec0b 100644
--- a/docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md
+++ b/docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md
@@ -29,16 +29,21 @@ We have not been able to test, simulate, or build datasets for this object. Use
The search is used to identify attempts to use your DNS Infrastructure for DDoS purposes via a DNS amplification attack leveraging ANY queries.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Network_Resolution](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkResolution)
-
- **Last Updated**: 2017-09-20
- **Author**: Bhavin Patel, Splunk
- **ID**: 8fa891f7-a533-4b3c-af85-5aa2e7c1f1eb
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
+| ----------- | ----------- | -------------- |
+| [CVE-2016-4859](https://nvd.nist.gov/vuln/detail/CVE-2016-4859) | Open redirect vulnerability in Splunk Enterprise 6.4.x prior to 6.4.3, Splunk Enterprise 6.3.x prior to 6.3.6, Splunk Enterprise 6.2.x prior to 6.2.10, Splunk Enterprise 6.1.x prior to 6.1.11, Splunk Enterprise 6.0.x prior to 6.0.12, Splunk Enterprise 5.0.x prior to 5.0.16 and Splunk Light prior to 6.4.3 allows to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. | 5.8 |
+
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,58 @@ The search is used to identify attempts to use your DNS Infrastructure for DDoS
| [T1498.002](https://attack.mitre.org/techniques/T1498/002/) | Reflection Amplification | Impact |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.AE
+* PR.IP
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 11
+* CIS 12
+
+
+
+
+
+
+
#### Search
```
@@ -60,7 +117,7 @@ The search is used to identify attempts to use your DNS Infrastructure for DDoS
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `large_volume_of_dns_any_queries_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **large_volume_of_dns_any_queries_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -79,9 +136,6 @@ Legitimate ANY requests may trigger this search, however it is unusual to see a
* [DNS Amplification Attacks](/stories/dns_amplification_attacks)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -91,13 +145,11 @@ Legitimate ANY requests may trigger this search, however it is unusual to see a
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md b/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md
index a334f45f22..4598b7b4fb 100644
--- a/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md
+++ b/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md
@@ -26,21 +26,71 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search looks for specific GET or HEAD requests to web servers that are indicative of reconnaissance attempts to identify vulnerable JBoss servers. JexBoss is described as the exploit tool of choice for this malicious activity.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Web](https://docs.splunk.com/Documentation/CIM/latest/User/Web)
-
- **Last Updated**: 2017-09-23
- **Author**: Bhavin Patel, Splunk
- **ID**: 104658f4-afdc-499e-9719-17243f982681
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1082](https://attack.mitre.org/techniques/T1082/) | System Information Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -54,10 +104,10 @@ This search looks for specific GET or HEAD requests to web servers that are indi
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_attackers_scanning_for_vulnerable_jboss_servers_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_attackers_scanning_for_vulnerable_jboss_servers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -78,9 +128,6 @@ It's possible for legitimate HTTP requests to be made to URLs containing the sus
* [SamSam Ransomware](/stories/samsam_ransomware)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -90,13 +137,11 @@ It's possible for legitimate HTTP requests to be made to URLs containing the sus
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md b/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md
index 0529aa15c5..c015834cab 100644
--- a/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md
+++ b/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md
@@ -23,14 +23,77 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search is used to detect malicious HTTP requests crafted to exploit jmx-console in JBoss servers. The malicious requests have a long URL length, as the payload is embedded in the URL.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Web](https://docs.splunk.com/Documentation/CIM/latest/User/Web)
-
- **Last Updated**: 2017-09-23
- **Author**: Bhavin Patel, Splunk
- **ID**: c8bff7a4-11ea-4416-a27d-c5bca472913d
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Delivery
+
+
+
+
+
+
+NIST
+ +
+
+* ID.RA
+* PR.PT
+* PR.IP
+* DE.AE
+* PR.MA
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 12
+* CIS 4
+* CIS 18
+
+
+
+
+
+
+
#### Search
```
@@ -46,10 +109,10 @@ This search is used to detect malicious HTTP requests crafted to exploit jmx-con
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_malicious_requests_to_exploit_jboss_servers_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_malicious_requests_to_exploit_jboss_servers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -71,9 +134,6 @@ No known false positives for this detection.
* [SamSam Ransomware](/stories/samsam_ransomware)
-#### Kill Chain Phase
-* Delivery
-
#### RBA
@@ -83,13 +143,11 @@ No known false positives for this detection.
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2017-09-23-monitor_dns_for_brand_abuse.md b/docs/_posts/2017-09-23-monitor_dns_for_brand_abuse.md
index bc0bde8edf..163e5617e9 100644
--- a/docs/_posts/2017-09-23-monitor_dns_for_brand_abuse.md
+++ b/docs/_posts/2017-09-23-monitor_dns_for_brand_abuse.md
@@ -21,14 +21,67 @@ tags:
This search looks for DNS requests for faux domains similar to the domains that you want to have monitored for abuse.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Network_Resolution](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkResolution)
-
- **Last Updated**: 2017-09-23
- **Author**: David Dorsey, Splunk
- **ID**: 24dd17b1-e2fb-4c31-878c-d4f746595bfa
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Delivery
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -42,11 +95,11 @@ This search looks for DNS requests for faux domains similar to the domains that
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [brand_abuse_dns](https://github.com/splunk/security_content/blob/develop/macros/brand_abuse_dns.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `monitor_dns_for_brand_abuse_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **monitor_dns_for_brand_abuse_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -62,10 +115,6 @@ None at this time
* [Brand Monitoring](/stories/brand_monitoring)
-#### Kill Chain Phase
-* Delivery
-* Actions on Objectives
-
#### RBA
@@ -75,13 +124,11 @@ None at this time
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md b/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md
index 6df571f788..c5aaa2b026 100644
--- a/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md
+++ b/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md
@@ -23,14 +23,70 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search looks for Web requests to faux domains similar to the one that you want to have monitored for abuse.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Web](https://docs.splunk.com/Documentation/CIM/latest/User/Web)
-
- **Last Updated**: 2017-09-23
- **Author**: David Dorsey, Splunk
- **ID**: 134da869-e264-4a8f-8d7e-fcd0ec88f301
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Delivery
+
+
+
+
+
+
+NIST
+ +
+
+* PR.IP
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 7
+
+
+
+
+
+
+
#### Search
```
@@ -44,11 +100,11 @@ This search looks for Web requests to faux domains similar to the one that you w
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [brand_abuse_web](https://github.com/splunk/security_content/blob/develop/macros/brand_abuse_web.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `monitor_web_traffic_for_brand_abuse_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **monitor_web_traffic_for_brand_abuse_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -66,9 +122,6 @@ None at this time
* [Brand Monitoring](/stories/brand_monitoring)
-#### Kill Chain Phase
-* Delivery
-
#### RBA
@@ -78,13 +131,11 @@ None at this time
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2017-10-13-unusually_long_content-type_length.md b/docs/_posts/2017-10-13-unusually_long_content-type_length.md
index ebe1019ad0..a13423589a 100644
--- a/docs/_posts/2017-10-13-unusually_long_content-type_length.md
+++ b/docs/_posts/2017-10-13-unusually_long_content-type_length.md
@@ -22,14 +22,79 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search looks for unusually long strings in the Content-Type http header that the client sends the server.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2017-10-13
- **Author**: Bhavin Patel, Splunk
- **ID**: 57a0a2bf-353f-40c1-84dc-29293f3c35b7
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Delivery
+
+
+
+
+
+
+NIST
+ +
+
+* ID.RA
+* RS.MI
+* PR.PT
+* PR.IP
+* DE.AE
+* PR.MA
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 4
+* CIS 18
+* CIS 12
+
+
+
+
+
+
+
#### Search
```
@@ -44,7 +109,7 @@ This search looks for unusually long strings in the Content-Type http header tha
The SPL above uses the following Macros:
* [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml)
-Note that `unusually_long_content-type_length_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **unusually_long_content-type_length_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -65,9 +130,6 @@ Very few legitimate Content-Type fields will have a length greater than 100 char
* [Apache Struts Vulnerability](/stories/apache_struts_vulnerability)
-#### Kill Chain Phase
-* Delivery
-
#### RBA
@@ -77,13 +139,11 @@ Very few legitimate Content-Type fields will have a length greater than 100 char
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2017-11-27-detect_usb_device_insertion.md b/docs/_posts/2017-11-27-detect_usb_device_insertion.md
index d611b6f1e0..d16ce4afab 100644
--- a/docs/_posts/2017-11-27-detect_usb_device_insertion.md
+++ b/docs/_posts/2017-11-27-detect_usb_device_insertion.md
@@ -21,14 +21,72 @@ tags:
The search is used to detect hosts that generate Windows Event ID 4663 for successful attempts to write to or read from a removable storage and Event ID 4656 for failures, which occurs when a USB drive is plugged in. In this scenario we are querying the Change_Analysis data model to look for Windows Event ID 4656 or 4663 where the priority of the affected host is marked as high in the ES Assets and Identity Framework.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Change_Analysis](https://docs.splunk.com/Documentation/CIM/latest/User/ChangeAnalysis)
-
- **Last Updated**: 2017-11-27
- **Author**: Bhavin Patel, Splunk
- **ID**: 104658f4-afdc-499f-9719-17a43f9826f5
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Installation
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* PR.DS
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 13
+
+
+
+
+
+
+
#### Search
```
@@ -42,10 +100,10 @@ The search is used to detect hosts that generate Windows Event ID 4663 for succe
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_usb_device_insertion_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_usb_device_insertion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -65,10 +123,6 @@ Legitimate USB activity will also be detected. Please verify and investigate as
* [Data Protection](/stories/data_protection)
-#### Kill Chain Phase
-* Installation
-* Actions on Objectives
-
#### RBA
@@ -78,13 +132,11 @@ Legitimate USB activity will also be detected. Please verify and investigate as
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md b/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md
index 1f5e7ffcb9..10efb31fcf 100644
--- a/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md
+++ b/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md
@@ -23,14 +23,70 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search looks for emails claiming to be sent from a domain similar to one that you want to have monitored for abuse.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Email](https://docs.splunk.com/Documentation/CIM/latest/User/Email)
-
- **Last Updated**: 2018-01-05
- **Author**: David Dorsey, Splunk
- **ID**: b2ea1f38-3a3e-4b8a-9cf1-82760d86a6b8
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Delivery
+
+
+
+
+
+
+NIST
+ +
+
+* PR.IP
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 7
+
+
+
+
+
+
+
#### Search
```
@@ -49,10 +105,10 @@ This search looks for emails claiming to be sent from a domain similar to one th
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `monitor_email_for_brand_abuse_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **monitor_email_for_brand_abuse_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Lookups
The SPL above uses the following Lookups:
@@ -77,9 +133,6 @@ None at this time
* [Suspicious Emails](/stories/suspicious_emails)
-#### Kill Chain Phase
-* Delivery
-
#### RBA
@@ -89,13 +142,11 @@ None at this time
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2018-02-23-ec2_instance_started_in_previously_unseen_region.md b/docs/_posts/2018-02-23-ec2_instance_started_in_previously_unseen_region.md
index 8bde8e0bec..e6310902ca 100644
--- a/docs/_posts/2018-02-23-ec2_instance_started_in_previously_unseen_region.md
+++ b/docs/_posts/2018-02-23-ec2_instance_started_in_previously_unseen_region.md
@@ -23,21 +23,76 @@ tags:
This search looks for AWS CloudTrail events where an instance is started in a particular region in the last one hour and then compares it to a lookup file of previously seen regions where an instance was started
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2018-02-23
- **Author**: Bhavin Patel, Splunk
- **ID**: ada0f478-84a8-4641-a3f3-d82362d6fd75
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1535](https://attack.mitre.org/techniques/T1535/) | Unused/Unsupported Cloud Regions | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.DP
+* DE.AE
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 12
+
+
+
+
+
+
+
#### Search
```
@@ -55,10 +110,10 @@ This search looks for AWS CloudTrail events where an instance is started in a pa
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `ec2_instance_started_in_previously_unseen_region_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **ec2_instance_started_in_previously_unseen_region_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -76,9 +131,6 @@ It's possible that a user has unknowingly started an instance in a new region. P
* [Suspicious AWS EC2 Activities](/stories/suspicious_aws_ec2_activities)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -88,13 +140,11 @@ It's possible that a user has unknowingly started an instance in a new region. P
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2018-03-12-ec2_instance_started_with_previously_unseen_ami.md b/docs/_posts/2018-03-12-ec2_instance_started_with_previously_unseen_ami.md
index 99e94d058d..9739a63334 100644
--- a/docs/_posts/2018-03-12-ec2_instance_started_with_previously_unseen_ami.md
+++ b/docs/_posts/2018-03-12-ec2_instance_started_with_previously_unseen_ami.md
@@ -20,14 +20,70 @@ tags:
This search looks for EC2 instances being created with previously unseen AMIs. This search is deprecated and have been translated to use the latest Change Datamodel.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2018-03-12
- **Author**: David Dorsey, Splunk
- **ID**: 347ec301-601b-48b9-81aa-9ddf9c829dd3
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* ID.AM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 1
+
+
+
+
+
+
+
#### Search
```
@@ -50,10 +106,10 @@ This search looks for EC2 instances being created with previously unseen AMIs.
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `ec2_instance_started_with_previously_unseen_ami_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **ec2_instance_started_with_previously_unseen_ami_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -72,9 +128,6 @@ After a new AMI is created, the first systems created with that AMI will cause t
* [AWS Cryptomining](/stories/aws_cryptomining)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -84,13 +137,11 @@ After a new AMI is created, the first systems created with that AMI will cause t
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_city.md b/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_city.md
index de88571d9c..da281b271a 100644
--- a/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_city.md
+++ b/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_city.md
@@ -23,21 +23,75 @@ tags:
This search looks for AWS provisioning activities from previously unseen cities. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2018-03-16
- **Author**: David Dorsey, Splunk
- **ID**: 344a1778-0b25-490c-adb1-de8beddf59cd
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1535](https://attack.mitre.org/techniques/T1535/) | Unused/Unsupported Cloud Regions | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* ID.AM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 1
+
+
+
+
+
+
+
#### Search
```
@@ -64,7 +118,7 @@ This search looks for AWS provisioning activities from previously unseen cities.
The SPL above uses the following Macros:
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
-Note that `aws_cloud_provisioning_from_previously_unseen_city_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **aws_cloud_provisioning_from_previously_unseen_city_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -83,9 +137,6 @@ This is a strictly behavioral search, so we define "false positive" slightly dif
* [AWS Suspicious Provisioning Activities](/stories/aws_suspicious_provisioning_activities)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -95,13 +146,11 @@ This is a strictly behavioral search, so we define "false positive" slightly dif
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_country.md b/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_country.md
index 6b8fc9f6b3..6079115060 100644
--- a/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_country.md
+++ b/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_country.md
@@ -23,21 +23,75 @@ tags:
This search looks for AWS provisioning activities from previously unseen countries. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2018-03-16
- **Author**: David Dorsey, Splunk
- **ID**: ceb8d3d8-06cb-49eb-beaf-829526e33ff0
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1535](https://attack.mitre.org/techniques/T1535/) | Unused/Unsupported Cloud Regions | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* ID.AM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 1
+
+
+
+
+
+
+
#### Search
```
@@ -64,7 +118,7 @@ This search looks for AWS provisioning activities from previously unseen countri
The SPL above uses the following Macros:
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
-Note that `aws_cloud_provisioning_from_previously_unseen_country_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **aws_cloud_provisioning_from_previously_unseen_country_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -83,9 +137,6 @@ This is a strictly behavioral search, so we define "false positive" slightly dif
* [AWS Suspicious Provisioning Activities](/stories/aws_suspicious_provisioning_activities)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -95,13 +146,11 @@ This is a strictly behavioral search, so we define "false positive" slightly dif
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_ip_address.md b/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_ip_address.md
index e1884fc26e..216a5218a3 100644
--- a/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_ip_address.md
+++ b/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_ip_address.md
@@ -20,14 +20,70 @@ tags:
This search looks for AWS provisioning activities from previously unseen IP addresses. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2018-03-16
- **Author**: David Dorsey, Splunk
- **ID**: 42e15012-ac14-4801-94f4-f1acbe64880b
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* ID.AM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 1
+
+
+
+
+
+
+
#### Search
```
@@ -52,7 +108,7 @@ This search looks for AWS provisioning activities from previously unseen IP addr
The SPL above uses the following Macros:
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
-Note that `aws_cloud_provisioning_from_previously_unseen_ip_address_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **aws_cloud_provisioning_from_previously_unseen_ip_address_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -71,9 +127,6 @@ This is a strictly behavioral search, so we define "false positive" slightly dif
* [AWS Suspicious Provisioning Activities](/stories/aws_suspicious_provisioning_activities)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -83,13 +136,11 @@ This is a strictly behavioral search, so we define "false positive" slightly dif
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_region.md b/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_region.md
index 8795d2f462..8b859f1f81 100644
--- a/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_region.md
+++ b/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_region.md
@@ -23,21 +23,75 @@ tags:
This search looks for AWS provisioning activities from previously unseen regions. Region in this context is similar to a state in the United States. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2018-03-16
- **Author**: David Dorsey, Splunk
- **ID**: 7971d3df-da82-4648-a6e5-b5637bea5253
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1535](https://attack.mitre.org/techniques/T1535/) | Unused/Unsupported Cloud Regions | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* ID.AM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 1
+
+
+
+
+
+
+
#### Search
```
@@ -64,7 +118,7 @@ This search looks for AWS provisioning activities from previously unseen regions
The SPL above uses the following Macros:
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
-Note that `aws_cloud_provisioning_from_previously_unseen_region_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **aws_cloud_provisioning_from_previously_unseen_region_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -83,9 +137,6 @@ This is a strictly behavioral search, so we define "false positive" slightly dif
* [AWS Suspicious Provisioning Activities](/stories/aws_suspicious_provisioning_activities)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -95,13 +146,11 @@ This is a strictly behavioral search, so we define "false positive" slightly dif
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2018-04-16-detect_new_api_calls_from_user_roles.md b/docs/_posts/2018-04-16-detect_new_api_calls_from_user_roles.md
index a5626638f1..316f2aeec1 100644
--- a/docs/_posts/2018-04-16-detect_new_api_calls_from_user_roles.md
+++ b/docs/_posts/2018-04-16-detect_new_api_calls_from_user_roles.md
@@ -26,21 +26,75 @@ tags:
This search detects new API calls that have either never been seen before or that have not been seen in the previous hour, where the identity type is `AssumedRole`.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2018-04-16
- **Author**: Bhavin Patel, Splunk
- **ID**: 22773e84-bac0-4595-b086-20d3f335b4f1
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1078.004](https://attack.mitre.org/techniques/T1078/004/) | Cloud Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* ID.AM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 1
+
+
+
+
+
+
+
#### Search
```
@@ -63,10 +117,10 @@ This search detects new API calls that have either never been seen before or tha
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_new_api_calls_from_user_roles_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_new_api_calls_from_user_roles_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Lookups
The SPL above uses the following Lookups:
@@ -92,9 +146,6 @@ It is possible that there are legitimate user roles making new or infrequently u
* [AWS User Monitoring](/stories/aws_user_monitoring)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -104,13 +155,11 @@ It is possible that there are legitimate user roles making new or infrequently u
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md b/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md
index 16a2bb253f..d095fbfb1e 100644
--- a/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md
+++ b/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md
@@ -26,21 +26,77 @@ tags:
This search will detect users creating spikes in API activity related to security groups in your AWS environment. It will also update the cache file that factors in the latest data. This search is deprecated and have been translated to use the latest Change Datamodel.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2018-04-18
- **Author**: Bhavin Patel, Splunk
- **ID**: ada0f478-84a8-4641-a3f1-e32372d4bd53
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1078.004](https://attack.mitre.org/techniques/T1078/004/) | Cloud Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.DP
+* DE.CM
+* PR.AC
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -71,7 +127,7 @@ The SPL above uses the following Macros:
* [security_group_api_calls](https://github.com/splunk/security_content/blob/develop/macros/security_group_api_calls.yml)
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
-Note that `detect_spike_in_security_group_activity_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_spike_in_security_group_activity_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Lookups
The SPL above uses the following Lookups:
@@ -94,9 +150,6 @@ Based on the values of`dataPointThreshold` and `deviationThreshold`, the false p
* [AWS User Monitoring](/stories/aws_user_monitoring)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -106,13 +159,11 @@ Based on the values of`dataPointThreshold` and `deviationThreshold`, the false p
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md b/docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md
index e0161c2865..8e50157999 100644
--- a/docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md
+++ b/docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md
@@ -22,14 +22,73 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search will detect spike in blocked outbound network connections originating from within your AWS environment. It will also update the cache file that factors in the latest data.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2018-05-07
- **Author**: Bhavin Patel, Splunk
- **ID**: d3fffa37-492f-487b-a35d-c60fcb2acf01
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+* Command & Control
+
+
+
+
+
+
+NIST
+ +
+
+* DE.AE
+* DE.CM
+* PR.AC
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 11
+
+
+
+
+
+
+
#### Search
```
@@ -56,7 +115,7 @@ This search will detect spike in blocked outbound network connections originatin
The SPL above uses the following Macros:
* [cloudwatchlogs_vpcflow](https://github.com/splunk/security_content/blob/develop/macros/cloudwatchlogs_vpcflow.yml)
-Note that `detect_spike_in_blocked_outbound_traffic_from_your_aws_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_spike_in_blocked_outbound_traffic_from_your_aws_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Lookups
The SPL above uses the following Lookups:
@@ -83,10 +142,6 @@ The false-positive rate may vary based on the values of`dataPointThreshold` and
* [Command and Control](/stories/command_and_control)
-#### Kill Chain Phase
-* Actions on Objectives
-* Command & Control
-
#### RBA
@@ -96,13 +151,11 @@ The false-positive rate may vary based on the values of`dataPointThreshold` and
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2018-05-17-detect_api_activity_from_users_without_mfa.md b/docs/_posts/2018-05-17-detect_api_activity_from_users_without_mfa.md
index f68cefe8d6..545f923c77 100644
--- a/docs/_posts/2018-05-17-detect_api_activity_from_users_without_mfa.md
+++ b/docs/_posts/2018-05-17-detect_api_activity_from_users_without_mfa.md
@@ -20,14 +20,71 @@ tags:
This search looks for AWS CloudTrail events where a user logged into the AWS account, is making API calls and has not enabled Multi Factor authentication. Multi factor authentication adds a layer of security by forcing the users to type a unique authentication code from an approved authentication device when they access AWS websites or services. AWS Best Practices recommend that you enable MFA for privileged IAM users.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2018-05-17
- **Author**: Bhavin Patel, Splunk
- **ID**: 4d46e8bd-4072-48e4-92db-0325889ef894
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.DP
+* PR.AC
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -44,10 +101,10 @@ This search looks for AWS CloudTrail events where a user logged into the AWS acc
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_api_activity_from_users_without_mfa_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_api_activity_from_users_without_mfa_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Lookups
The SPL above uses the following Lookups:
@@ -79,9 +136,6 @@ Many service accounts configured within an AWS infrastructure do not have multi
* [AWS User Monitoring](/stories/aws_user_monitoring)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -91,13 +145,11 @@ Many service accounts configured within an AWS infrastructure do not have multi
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2018-05-21-detect_spike_in_network_acl_activity.md b/docs/_posts/2018-05-21-detect_spike_in_network_acl_activity.md
index 21ea84053e..1fc97ee6db 100644
--- a/docs/_posts/2018-05-21-detect_spike_in_network_acl_activity.md
+++ b/docs/_posts/2018-05-21-detect_spike_in_network_acl_activity.md
@@ -23,21 +23,78 @@ tags:
This search will detect users creating spikes in API activity related to network access-control lists (ACLs)in your AWS environment. This search is deprecated and have been translated to use the latest Change Datamodel.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2018-05-21
- **Author**: Bhavin Patel, Splunk
- **ID**: ada0f478-84a8-4641-a1f1-e32372d4bd53
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1562.007](https://attack.mitre.org/techniques/T1562/007/) | Disable or Modify Cloud Firewall | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.DP
+* DE.CM
+* PR.AC
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 12
+* CIS 11
+
+
+
+
+
+
+
#### Search
```
@@ -68,7 +125,7 @@ The SPL above uses the following Macros:
* [network_acl_events](https://github.com/splunk/security_content/blob/develop/macros/network_acl_events.yml)
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
-Note that `detect_spike_in_network_acl_activity_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_spike_in_network_acl_activity_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Lookups
The SPL above uses the following Lookups:
@@ -91,9 +148,6 @@ The false-positive rate may vary based on the values of`dataPointThreshold` and
* [AWS Network ACL Activity](/stories/aws_network_acl_activity)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -103,13 +157,11 @@ The false-positive rate may vary based on the values of`dataPointThreshold` and
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md b/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md
index 4975a74a3d..4d59c747a4 100644
--- a/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md
+++ b/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md
@@ -26,21 +26,76 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search looks for outbound ICMP packets with a packet size larger than 1,000 bytes. Various threat actors have been known to use ICMP as a command and control channel for their attack infrastructure. Large ICMP packets from an endpoint to a remote host may be indicative of this activity.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic)
-
- **Last Updated**: 2018-06-01
- **Author**: Rico Valdez, Splunk
- **ID**: e9c102de-4d43-42a7-b1c8-8062ea297419
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1095](https://attack.mitre.org/techniques/T1095/) | Non-Application Layer Protocol | Command And Control |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Command & Control
+
+
+
+
+
+
+NIST
+ +
+
+* DE.AE
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 9
+* CIS 12
+
+
+
+
+
+
+
#### Search
```
@@ -55,10 +110,10 @@ This search looks for outbound ICMP packets with a packet size larger than 1,000
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_large_outbound_icmp_packets_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_large_outbound_icmp_packets_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -81,9 +136,6 @@ ICMP packets are used in a variety of ways to help troubleshoot networking issue
* [Command and Control](/stories/command_and_control)
-#### Kill Chain Phase
-* Command & Control
-
#### RBA
@@ -93,13 +145,11 @@ ICMP packets are used in a variety of ways to help troubleshoot networking issue
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2018-06-14-splunk_enterprise_information_disclosure.md b/docs/_posts/2018-06-14-splunk_enterprise_information_disclosure.md
index a478dd03f1..58353c61ff 100644
--- a/docs/_posts/2018-06-14-splunk_enterprise_information_disclosure.md
+++ b/docs/_posts/2018-06-14-splunk_enterprise_information_disclosure.md
@@ -21,14 +21,81 @@ tags:
This search allows you to look for evidence of exploitation for CVE-2018-11409, a Splunk Enterprise Information Disclosure Bug.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2018-06-14
- **Author**: David Dorsey, Splunk
- **ID**: f6a26b7b-7e80-4963-a9a8-d836e7534ebd
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Delivery
+
+
+
+
+
+
+NIST
+ +
+
+* ID.RA
+* RS.MI
+* PR.PT
+* PR.AC
+* PR.IP
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 4
+* CIS 18
+
+
+
+
+
+
+
#### Search
```
@@ -45,7 +112,7 @@ index=_internal sourcetype=splunkd_ui_access server-info
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `splunk_enterprise_information_disclosure_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **splunk_enterprise_information_disclosure_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -61,9 +128,6 @@ Retrieving server information may be a legitimate API request. Verify that the a
* [Splunk Vulnerabilities](/stories/splunk_vulnerabilities)
-#### Kill Chain Phase
-* Delivery
-
#### RBA
@@ -73,19 +137,11 @@ Retrieving server information may be a legitimate API request. Verify that the a
| 25.0 | 50 | 50 | tbd |
-#### CVE
-
-| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
-| ----------- | ----------- | -------------- |
-| [CVE-2018-11409](https://nvd.nist.gov/vuln/detail/CVE-2018-11409) | Splunk through 7.0.1 allows information disclosure by appending __raw/services/server/info/server-info?output_mode=json to a query, as demonstrated by discovering a license key. | 5.0 |
-
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md b/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md
index 350c815ce2..7d801f8b3a 100644
--- a/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md
+++ b/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md
@@ -25,21 +25,78 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search looks at S3 bucket-access logs and detects new or previously unseen remote IP addresses that have successfully accessed an S3 bucket.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2018-06-28
- **Author**: Bhavin Patel, Splunk
- **ID**: e6f1bb1b-f441-492b-9126-902acda217da
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
+| ----------- | ----------- | -------------- |
+| [CVE-2018-11409](https://nvd.nist.gov/vuln/detail/CVE-2018-11409) | Splunk through 7.0.1 allows information disclosure by appending __raw/services/server/info/server-info?output_mode=json to a query, as demonstrated by discovering a license key. | 5.0 |
+
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1530](https://attack.mitre.org/techniques/T1530/) | Data from Cloud Storage Object | Collection |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.DS
+* PR.AC
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 13
+* CIS 14
+
+
+
+
+
+
+
#### Search
```
@@ -61,10 +118,10 @@ This search looks at S3 bucket-access logs and detects new or previously unseen
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [aws_s3_accesslogs](https://github.com/splunk/security_content/blob/develop/macros/aws_s3_accesslogs.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_s3_access_from_a_new_ip_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_s3_access_from_a_new_ip_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -83,9 +140,6 @@ S3 buckets can be accessed from any IP, as long as it can make a successful conn
* [Suspicious AWS S3 Activities](/stories/suspicious_aws_s3_activities)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -95,13 +149,11 @@ S3 buckets can be accessed from any IP, as long as it can make a successful conn
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2018-10-08-web_fraud_-_account_harvesting.md b/docs/_posts/2018-10-08-web_fraud_-_account_harvesting.md
index 5912689e09..b389b435ad 100644
--- a/docs/_posts/2018-10-08-web_fraud_-_account_harvesting.md
+++ b/docs/_posts/2018-10-08-web_fraud_-_account_harvesting.md
@@ -23,21 +23,76 @@ tags:
This search is used to identify the creation of multiple user accounts using the same email domain name.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2018-10-08
- **Author**: Jim Apger, Splunk
- **ID**: bf1d7b5c-df2f-4249-a401-c09fdc221ddf
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1136](https://attack.mitre.org/techniques/T1136/) | Create Account | Persistence |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+* DE.DP
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -56,7 +111,7 @@ This search is used to identify the creation of multiple user accounts using the
The SPL above uses the following Macros:
* [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml)
-Note that `web_fraud_-_account_harvesting_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **web_fraud_-_account_harvesting_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -75,9 +130,6 @@ As is common with many fraud-related searches, we are usually looking to attribu
* [Web Fraud Detection](/stories/web_fraud_detection)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -87,8 +139,6 @@ As is common with many fraud-related searches, we are usually looking to attribu
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
* [https://splunkbase.splunk.com/app/2734/](https://splunkbase.splunk.com/app/2734/)
@@ -97,7 +147,7 @@ As is common with many fraud-related searches, we are usually looking to attribu
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2018-10-08-web_fraud_-_anomalous_user_clickspeed.md b/docs/_posts/2018-10-08-web_fraud_-_anomalous_user_clickspeed.md
index a435e93cf7..2f2bca0560 100644
--- a/docs/_posts/2018-10-08-web_fraud_-_anomalous_user_clickspeed.md
+++ b/docs/_posts/2018-10-08-web_fraud_-_anomalous_user_clickspeed.md
@@ -26,21 +26,76 @@ tags:
This search is used to examine web sessions to identify those where the clicks are occurring too quickly for a human or are occurring with a near-perfect cadence (high periodicity or low standard deviation), resembling a script driven session.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2018-10-08
- **Author**: Jim Apger, Splunk
- **ID**: 31337bbb-bc22-4752-b599-ef192df2dc7a
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.AE
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 6
+
+
+
+
+
+
+
#### Search
```
@@ -57,7 +112,7 @@ This search is used to examine web sessions to identify those where the clicks a
The SPL above uses the following Macros:
* [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml)
-Note that `web_fraud_-_anomalous_user_clickspeed_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **web_fraud_-_anomalous_user_clickspeed_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -75,9 +130,6 @@ As is common with many fraud-related searches, we are usually looking to attribu
* [Web Fraud Detection](/stories/web_fraud_detection)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -87,8 +139,6 @@ As is common with many fraud-related searches, we are usually looking to attribu
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
* [https://en.wikipedia.org/wiki/Session_ID](https://en.wikipedia.org/wiki/Session_ID)
@@ -99,7 +149,7 @@ As is common with many fraud-related searches, we are usually looking to attribu
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2018-10-08-web_fraud_-_password_sharing_across_accounts.md b/docs/_posts/2018-10-08-web_fraud_-_password_sharing_across_accounts.md
index 4489483556..796dc22bfa 100644
--- a/docs/_posts/2018-10-08-web_fraud_-_password_sharing_across_accounts.md
+++ b/docs/_posts/2018-10-08-web_fraud_-_password_sharing_across_accounts.md
@@ -20,14 +20,70 @@ tags:
This search is used to identify user accounts that share a common password.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2018-10-08
- **Author**: Jim Apger, Splunk
- **ID**: 31337a1a-53b9-4e05-96e9-55c934cb71d3
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.DP
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -45,7 +101,7 @@ This search is used to identify user accounts that share a common password.
The SPL above uses the following Macros:
* [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml)
-Note that `web_fraud_-_password_sharing_across_accounts_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **web_fraud_-_password_sharing_across_accounts_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -63,9 +119,6 @@ As is common with many fraud-related searches, we are usually looking to attribu
* [Web Fraud Detection](/stories/web_fraud_detection)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -75,8 +128,6 @@ As is common with many fraud-related searches, we are usually looking to attribu
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
* [https://en.wikipedia.org/wiki/Session_ID](https://en.wikipedia.org/wiki/Session_ID)
@@ -87,7 +138,7 @@ As is common with many fraud-related searches, we are usually looking to attribu
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2018-10-12-cloud_compute_instance_created_with_previously_unseen_image.md b/docs/_posts/2018-10-12-cloud_compute_instance_created_with_previously_unseen_image.md
index 6f221760b2..9eeb18973e 100644
--- a/docs/_posts/2018-10-12-cloud_compute_instance_created_with_previously_unseen_image.md
+++ b/docs/_posts/2018-10-12-cloud_compute_instance_created_with_previously_unseen_image.md
@@ -21,14 +21,70 @@ tags:
This search looks for cloud compute instances being created with previously unseen image IDs.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change)
-- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719)
+- **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change)- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719)
- **Last Updated**: 2018-10-12
- **Author**: David Dorsey, Splunk
- **ID**: bc24922d-987c-4645-b288-f8c73ec194c4
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* ID.AM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 1
+
+
+
+
+
+
+
#### Search
```
@@ -51,7 +107,7 @@ This search looks for cloud compute instances being created with previously unse
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `cloud_compute_instance_created_with_previously_unseen_image_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **cloud_compute_instance_created_with_previously_unseen_image_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Lookups
The SPL above uses the following Lookups:
@@ -76,9 +132,6 @@ After a new image is created, the first systems created with that image will cau
* [Cloud Cryptomining](/stories/cloud_cryptomining)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -88,13 +141,11 @@ After a new image is created, the first systems created with that image will cau
| 36.0 | 60 | 60 | User $user$ is creating an instance $dest$ with an image that has not been previously seen. |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md b/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md
index 3c0051c9cf..36a268849e 100644
--- a/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md
+++ b/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md
@@ -25,21 +25,79 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search looks for the creation of WMI permanent event subscriptions.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2018-10-23
- **Author**: Rico Valdez, Splunk
- **ID**: 71bfdb13-f200-4c6c-b2c9-a2e07adf437d
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1047](https://attack.mitre.org/techniques/T1047/) | Windows Management Instrumentation | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* PR.AT
+* PR.AC
+* PR.IP
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+
+
+
+
+
+
+
#### Search
```
@@ -56,10 +114,10 @@ This search looks for the creation of WMI permanent event subscriptions.
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [wmi](https://github.com/splunk/security_content/blob/develop/macros/wmi.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `wmi_permanent_event_subscription_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **wmi_permanent_event_subscription_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -79,9 +137,6 @@ Although unlikely, administrators may use event subscriptions for legitimate pur
* [Suspicious WMI Use](/stories/suspicious_wmi_use)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -91,13 +146,11 @@ Although unlikely, administrators may use event subscriptions for legitimate pur
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md b/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md
index abb5fdffb5..403fb22f13 100644
--- a/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md
+++ b/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md
@@ -25,21 +25,79 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search looks for the creation of WMI temporary event subscriptions.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2018-10-23
- **Author**: Rico Valdez, Splunk
- **ID**: 38cbd42c-1098-41bb-99cf-9d6d2b296d83
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1047](https://attack.mitre.org/techniques/T1047/) | Windows Management Instrumentation | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* PR.AT
+* PR.AC
+* PR.IP
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+
+
+
+
+
+
+
#### Search
```
@@ -55,10 +113,10 @@ This search looks for the creation of WMI temporary event subscriptions.
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [wmi](https://github.com/splunk/security_content/blob/develop/macros/wmi.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `wmi_temporary_event_subscription_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **wmi_temporary_event_subscription_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -77,9 +135,6 @@ Some software may create WMI temporary event subscriptions for various purposes.
* [Suspicious WMI Use](/stories/suspicious_wmi_use)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -89,13 +144,11 @@ Some software may create WMI temporary event subscriptions for various purposes.
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2018-11-02-windows_hosts_file_modification.md b/docs/_posts/2018-11-02-windows_hosts_file_modification.md
index 692a542af3..4bde8d2248 100644
--- a/docs/_posts/2018-11-02-windows_hosts_file_modification.md
+++ b/docs/_posts/2018-11-02-windows_hosts_file_modification.md
@@ -20,14 +20,76 @@ tags:
The search looks for modifications to the hosts file on all Windows endpoints across your environment.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2018-11-02
- **Author**: Rico Valdez, Splunk
- **ID**: 06a6fc63-a72d-41dc-8736-7e3dd9612116
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Command & Control
+
+
+
+
+
+
+NIST
+ +
+
+* PR.IP
+* PR.PT
+* PR.AC
+* DE.AE
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 8
+* CIS 12
+
+
+
+
+
+
+
#### Search
```
@@ -42,10 +104,10 @@ The search looks for modifications to the hosts file on all Windows endpoints ac
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `windows_hosts_file_modification_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **windows_hosts_file_modification_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -61,9 +123,6 @@ There may be legitimate reasons for system administrators to add entries to this
* [Host Redirection](/stories/host_redirection)
-#### Kill Chain Phase
-* Command & Control
-
#### RBA
@@ -73,13 +132,11 @@ There may be legitimate reasons for system administrators to add entries to this
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md b/docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md
index 40acea4acf..de15d459ff 100644
--- a/docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md
+++ b/docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md
@@ -25,21 +25,77 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search detects users creating spikes in API activity related to deletion of S3 buckets in your AWS environment. It will also update the cache file that factors in the latest data.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2018-11-27
- **Author**: Bhavin Patel, Splunk
- **ID**: e733a326-59d2-446d-b8db-14a17151aa68
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1530](https://attack.mitre.org/techniques/T1530/) | Data from Cloud Storage Object | Collection |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.DP
+* DE.CM
+* PR.AC
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 13
+
+
+
+
+
+
+
#### Search
```
@@ -70,7 +126,7 @@ This search detects users creating spikes in API activity related to deletion of
The SPL above uses the following Macros:
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
-Note that `detect_spike_in_s3_bucket_deletion_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_spike_in_s3_bucket_deletion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Lookups
The SPL above uses the following Lookups:
@@ -94,9 +150,6 @@ Based on the values of`dataPointThreshold` and `deviationThreshold`, the false p
* [Suspicious AWS S3 Activities](/stories/suspicious_aws_s3_activities)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -106,13 +159,11 @@ Based on the values of`dataPointThreshold` and `deviationThreshold`, the false p
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2018-12-03-remote_wmi_command_attempt.md b/docs/_posts/2018-12-03-remote_wmi_command_attempt.md
index e07ca41a84..ecd91f468b 100644
--- a/docs/_posts/2018-12-03-remote_wmi_command_attempt.md
+++ b/docs/_posts/2018-12-03-remote_wmi_command_attempt.md
@@ -24,21 +24,79 @@ tags:
The following analytic identifies usage of `wmic.exe` spawning a local or remote process, identified by the `node` switch. During triage, review parallel processes for additional commands executed. Look for any file modifications before and after `wmic.exe` execution. In addition, identify the remote endpoint and confirm execution or file modifications. Contain and isolate the endpoint as needed.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2018-12-03
- **Author**: Rico Valdez, Michael Haag, Splunk
- **ID**: 272df6de-61f1-4784-877c-1fbc3e2d0838
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1047](https://attack.mitre.org/techniques/T1047/) | Windows Management Instrumentation | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* PR.AT
+* PR.AC
+* PR.IP
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+
+
+
+
+
+
+
#### Search
```
@@ -52,11 +110,11 @@ The following analytic identifies usage of `wmic.exe` spawning a local or remote
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `remote_wmi_command_attempt_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **remote_wmi_command_attempt_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -80,9 +138,6 @@ Administrators may use this legitimately to gather info from remote systems. Fil
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -92,8 +147,6 @@ Administrators may use this legitimately to gather info from remote systems. Fil
| 36.0 | 60 | 60 | A wmic.exe process $process$ contain node commandline $process$ in host $dest$ |
-
-
#### Reference
* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1047/T1047.yaml](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1047/T1047.yaml)
@@ -101,7 +154,7 @@ Administrators may use this legitimately to gather info from remote systems. Fil
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2018-12-03-usn_journal_deletion.md b/docs/_posts/2018-12-03-usn_journal_deletion.md
index 3677c317ec..4edf3cf3c7 100644
--- a/docs/_posts/2018-12-03-usn_journal_deletion.md
+++ b/docs/_posts/2018-12-03-usn_journal_deletion.md
@@ -24,21 +24,81 @@ tags:
The fsutil.exe application is a legitimate Windows utility used to perform tasks related to the file allocation table (FAT) and NTFS file systems. The update sequence number (USN) change journal provides a log of all changes made to the files on the disk. This search looks for fsutil.exe deleting the USN journal.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2018-12-03
- **Author**: David Dorsey, Splunk
- **ID**: b6e0ff70-b122-4227-9368-4cf322ab43c3
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1070](https://attack.mitre.org/techniques/T1070/) | Indicator Removal on Host | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+* PR.PT
+* DE.AE
+* DE.DP
+* PR.IP
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 6
+* CIS 8
+* CIS 10
+
+
+
+
+
+
+
#### Search
```
@@ -53,10 +113,10 @@ The fsutil.exe application is a legitimate Windows utility used to perform tasks
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `usn_journal_deletion_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **usn_journal_deletion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -79,9 +139,6 @@ None identified
* [Ransomware](/stories/ransomware)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -91,13 +148,11 @@ None identified
| 45.0 | 50 | 90 | Possible USN journal deletion on $dest$ |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2018-12-06-suspicious_java_classes.md b/docs/_posts/2018-12-06-suspicious_java_classes.md
index b6a974b408..d60dff7d38 100644
--- a/docs/_posts/2018-12-06-suspicious_java_classes.md
+++ b/docs/_posts/2018-12-06-suspicious_java_classes.md
@@ -22,14 +22,71 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search looks for suspicious Java classes that are often used to exploit remote command execution in common Java frameworks, such as Apache Struts.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2018-12-06
- **Author**: Jose Hernandez, Splunk
- **ID**: 6ed33786-5e87-4f55-b62c-cb5f1168b831
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.AE
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 7
+* CIS 12
+
+
+
+
+
+
+
#### Search
```
@@ -48,7 +105,7 @@ The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml)
-Note that `suspicious_java_classes_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **suspicious_java_classes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -72,9 +129,6 @@ There are no known false positives.
* [Apache Struts Vulnerability](/stories/apache_struts_vulnerability)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -84,13 +138,11 @@ There are no known false positives.
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2018-12-14-file_with_samsam_extension.md b/docs/_posts/2018-12-14-file_with_samsam_extension.md
index 0014b6c7bc..56efa8a693 100644
--- a/docs/_posts/2018-12-14-file_with_samsam_extension.md
+++ b/docs/_posts/2018-12-14-file_with_samsam_extension.md
@@ -21,14 +21,71 @@ tags:
The search looks for file writes with extensions consistent with a SamSam ransomware attack.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2018-12-14
- **Author**: Rico Valdez, Splunk
- **ID**: 02c6cfc2-ae66-4735-bfc7-6291da834cbf
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Installation
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -44,10 +101,10 @@ The search looks for file writes with extensions consistent with a SamSam ransom
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `file_with_samsam_extension_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **file_with_samsam_extension_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -67,9 +124,6 @@ Because these extensions are not typically used in normal operations, you should
* [SamSam Ransomware](/stories/samsam_ransomware)
-#### Kill Chain Phase
-* Installation
-
#### RBA
@@ -79,13 +133,11 @@ Because these extensions are not typically used in normal operations, you should
| 90.0 | 100 | 90 | File writes $file_name$ with extensions consistent with a SamSam ransomware attack seen on $dest$ |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2018-12-14-samsam_test_file_write.md b/docs/_posts/2018-12-14-samsam_test_file_write.md
index aefe5b1492..2a52f177ee 100644
--- a/docs/_posts/2018-12-14-samsam_test_file_write.md
+++ b/docs/_posts/2018-12-14-samsam_test_file_write.md
@@ -24,21 +24,76 @@ tags:
The search looks for a file named "test.txt" written to the windows system directory tree, which is consistent with Samsam propagation.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2018-12-14
- **Author**: Rico Valdez, Splunk
- **ID**: 493a879d-519d-428f-8f57-a06a0fdc107e
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1486](https://attack.mitre.org/techniques/T1486/) | Data Encrypted for Impact | Impact |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Delivery
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +107,10 @@ The search looks for a file named "test.txt" written to the windows system direc
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `samsam_test_file_write_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **samsam_test_file_write_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -75,9 +130,6 @@ No false positives have been identified.
* [SamSam Ransomware](/stories/samsam_ransomware)
-#### Kill Chain Phase
-* Delivery
-
#### RBA
@@ -87,13 +139,11 @@ No false positives have been identified.
| 12.0 | 60 | 20 | A samsam ransomware test file creation in $file_path$ in host $dest$ |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2019-01-25-processes_tapping_keyboard_events.md b/docs/_posts/2019-01-25-processes_tapping_keyboard_events.md
index d70ff53eed..bf708c145b 100644
--- a/docs/_posts/2019-01-25-processes_tapping_keyboard_events.md
+++ b/docs/_posts/2019-01-25-processes_tapping_keyboard_events.md
@@ -22,14 +22,71 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search looks for processes in an MacOS system that is tapping keyboard events in MacOS, and essentially monitoring all keystrokes made by a user. This is a common technique used by RATs to log keystrokes from a victim, although it can also be used by legitimate processes like Siri to react on human input
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2019-01-25
- **Author**: Jose Hernandez, Splunk
- **ID**: 2a371608-331d-4034-ae2c-21dda8f1d0ec
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Command & Control
+
+
+
+
+
+
+NIST
+ +
+
+* DE.DP
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 4
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -45,7 +102,7 @@ This search looks for processes in an MacOS system that is tapping keyboard even
#### Macros
The SPL above uses the following Macros:
-Note that `processes_tapping_keyboard_events_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **processes_tapping_keyboard_events_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -67,9 +124,6 @@ There might be some false positives as keyboard event taps are used by processes
* [ColdRoot MacOS RAT](/stories/coldroot_macos_rat)
-#### Kill Chain Phase
-* Command & Control
-
#### RBA
@@ -79,13 +133,11 @@ There might be some false positives as keyboard event taps are used by processes
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2019-01-29-osquery_pack_-_coldroot_detection.md b/docs/_posts/2019-01-29-osquery_pack_-_coldroot_detection.md
index b21e41017c..4ffdd99b1a 100644
--- a/docs/_posts/2019-01-29-osquery_pack_-_coldroot_detection.md
+++ b/docs/_posts/2019-01-29-osquery_pack_-_coldroot_detection.md
@@ -20,14 +20,74 @@ tags:
This search looks for ColdRoot events from the osx-attacks osquery pack.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2019-01-29
- **Author**: Rico Valdez, Splunk
- **ID**: a6fffe5e-05c3-4c04-badc-887607fbb8dc
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Installation
+* Command & Control
+
+
+
+
+
+
+NIST
+ +
+
+* DE.DP
+* DE.CM
+* PR.PT
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 4
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -43,7 +103,7 @@ This search looks for ColdRoot events from the osx-attacks osquery pack.
#### Macros
The SPL above uses the following Macros:
-Note that `osquery_pack_-_coldroot_detection_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **osquery_pack_-_coldroot_detection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -59,10 +119,6 @@ There are no known false positives.
* [ColdRoot MacOS RAT](/stories/coldroot_macos_rat)
-#### Kill Chain Phase
-* Installation
-* Command & Control
-
#### RBA
@@ -72,13 +128,11 @@ There are no known false positives.
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2019-02-27-detect_mimikatz_via_powershell_and_eventcode_4703.md b/docs/_posts/2019-02-27-detect_mimikatz_via_powershell_and_eventcode_4703.md
index d0b52a2db9..98c8b113a5 100644
--- a/docs/_posts/2019-02-27-detect_mimikatz_via_powershell_and_eventcode_4703.md
+++ b/docs/_posts/2019-02-27-detect_mimikatz_via_powershell_and_eventcode_4703.md
@@ -23,21 +23,79 @@ tags:
This search looks for PowerShell requesting privileges consistent with credential dumping. Deprecated, looks like things changed from a logging perspective.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2019-02-27
- **Author**: Rico Valdez, Splunk
- **ID**: 98917be2-bfc8-475a-8618-a9bb06575188
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1003.001](https://attack.mitre.org/techniques/T1003/001/) | LSASS Memory | Credential Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.IP
+* PR.AC
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -54,10 +112,10 @@ This search looks for PowerShell requesting privileges consistent with credentia
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_mimikatz_via_powershell_and_eventcode_4703_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_mimikatz_via_powershell_and_eventcode_4703_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -78,9 +136,6 @@ The activity may be legitimate. PowerShell is often used by administrators to pe
* [Cloud Federated Credential Abuse](/stories/cloud_federated_credential_abuse)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -90,13 +145,11 @@ The activity may be legitimate. PowerShell is often used by administrators to pe
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2019-02-27-reg_exe_used_to_hide_files_directories_via_registry_keys.md b/docs/_posts/2019-02-27-reg_exe_used_to_hide_files_directories_via_registry_keys.md
index ab92fd440f..327f63ad93 100644
--- a/docs/_posts/2019-02-27-reg_exe_used_to_hide_files_directories_via_registry_keys.md
+++ b/docs/_posts/2019-02-27-reg_exe_used_to_hide_files_directories_via_registry_keys.md
@@ -24,21 +24,75 @@ tags:
The search looks for command-line arguments used to hide a file or directory using the reg add command.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2019-02-27
- **Author**: Bhavin Patel, Splunk
- **ID**: 61a7d1e6-f5d4-41d9-a9be-39a1ffe69459
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1564.001](https://attack.mitre.org/techniques/T1564/001/) | Hidden Files and Directories | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -53,10 +107,10 @@ The search looks for command-line arguments used to hide a file or directory usi
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `reg_exe_used_to_hide_files_directories_via_registry_keys_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **reg_exe_used_to_hide_files_directories_via_registry_keys_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -74,9 +128,6 @@ None at the moment
* [Windows Persistence Techniques](/stories/windows_persistence_techniques)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -86,13 +137,11 @@ None at the moment
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md b/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md
index f356bb42e9..26bd210d99 100644
--- a/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md
+++ b/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md
@@ -26,21 +26,75 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search looks for suspicious processes on all systems labeled as web servers.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2019-04-01
- **Author**: David Dorsey, Splunk
- **ID**: ec3b7601-689a-4463-94e0-c9f45638efb9
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1082](https://attack.mitre.org/techniques/T1082/) | System Information Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.IP
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+
+
+
+
+
+
+
#### Search
```
@@ -54,10 +108,10 @@ This search looks for suspicious processes on all systems labeled as web servers
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `web_servers_executing_suspicious_processes_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **web_servers_executing_suspicious_processes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -78,9 +132,6 @@ Some of these processes may be used legitimately on web servers during maintenan
* [Apache Struts Vulnerability](/stories/apache_struts_vulnerability)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -90,13 +141,11 @@ Some of these processes may be used legitimately on web servers during maintenan
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2019-04-25-suspicious_file_write.md b/docs/_posts/2019-04-25-suspicious_file_write.md
index 6cf52caa36..77da09a603 100644
--- a/docs/_posts/2019-04-25-suspicious_file_write.md
+++ b/docs/_posts/2019-04-25-suspicious_file_write.md
@@ -20,14 +20,71 @@ tags:
The search looks for files created with names that have been linked to malicious activity.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2019-04-25
- **Author**: Rico Valdez, Splunk
- **ID**: 57f76b8a-32f0-42ed-b358-d9fa3ca7bac8
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -42,11 +99,11 @@ The search looks for files created with names that have been linked to malicious
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [suspicious_writes](https://github.com/splunk/security_content/blob/develop/macros/suspicious_writes.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `suspicious_file_write_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **suspicious_file_write_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -62,9 +119,6 @@ It's possible for a legitimate file to be created with the same name as one note
* [Hidden Cobra Malware](/stories/hidden_cobra_malware)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -74,13 +128,11 @@ It's possible for a legitimate file to be created with the same name as one note
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md b/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md
index 1ee6c7a7e1..a0131a1d50 100644
--- a/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md
+++ b/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md
@@ -22,14 +22,71 @@ We have not been able to test, simulate, or build datasets for this object. Use
Command lines that are extremely long may be indicative of malicious activity on your hosts. This search leverages the Machine Learning Toolkit (MLTK) to help identify command lines with lengths that are unusual for a given user.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2019-05-08
- **Author**: Rico Valdez, Splunk
- **ID**: 57edaefa-a73b-45e5-bbae-f39c1473f941
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -49,10 +106,10 @@ Command lines that are extremely long may be indicative of malicious activity on
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `unusually_long_command_line_-_mltk_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **unusually_long_command_line_-_mltk_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -75,9 +132,6 @@ Some legitimate applications use long command lines for installs or updates. You
* [Ransomware](/stories/ransomware)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -87,13 +141,11 @@ Some legitimate applications use long command lines for installs or updates. You
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2019-10-11-prohibited_software_on_endpoint.md b/docs/_posts/2019-10-11-prohibited_software_on_endpoint.md
index 140e98d679..4b15df2f96 100644
--- a/docs/_posts/2019-10-11-prohibited_software_on_endpoint.md
+++ b/docs/_posts/2019-10-11-prohibited_software_on_endpoint.md
@@ -21,14 +21,73 @@ tags:
This search looks for applications on the endpoint that you have marked as prohibited.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2019-10-11
- **Author**: David Dorsey, Splunk
- **ID**: a51bfe1a-94f0-48cc-b4e4-b6ae50145893
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Installation
+* Command & Control
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* ID.AM
+* PR.DS
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 2
+
+
+
+
+
+
+
#### Search
```
@@ -43,11 +102,11 @@ This search looks for applications on the endpoint that you have marked as prohi
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [prohibited_softwares](https://github.com/splunk/security_content/blob/develop/macros/prohibited_softwares.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `prohibited_software_on_endpoint_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **prohibited_software_on_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _times
@@ -65,11 +124,6 @@ None identified
* [SamSam Ransomware](/stories/samsam_ransomware)
-#### Kill Chain Phase
-* Installation
-* Command & Control
-* Actions on Objectives
-
#### RBA
@@ -79,13 +133,11 @@ None identified
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md b/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md
index e44de96439..c54433e48d 100644
--- a/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md
+++ b/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md
@@ -26,16 +26,21 @@ tags:
This search looks for reading lsass memory consistent with credential dumping.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2019-12-03
- **Author**: Patrick Bareiss, Splunk
- **ID**: 2c365e57-4414-4540-8dc0-73ab10729996
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,59 @@ This search looks for reading lsass memory consistent with credential dumping.
| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.IP
+* PR.AC
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -56,10 +114,10 @@ This search looks for reading lsass memory consistent with credential dumping.
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_credential_dumping_through_lsass_access_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_credential_dumping_through_lsass_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +142,6 @@ The activity may be legitimate. Other tools can access lsass for legitimate reas
* [Detect Zerologon Attack](/stories/detect_zerologon_attack)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -96,13 +151,11 @@ The activity may be legitimate. Other tools can access lsass for legitimate reas
| 80.0 | 80 | 100 | The $source_image$ has attempted access to read $TargetImage$ was identified on endpoint $Computer$, this is indicative of credential dumping and should be investigated. |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md b/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md
index 33a0d490ea..b0ba58deb9 100644
--- a/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md
+++ b/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md
@@ -26,16 +26,21 @@ tags:
This search looks for reading loaded Images unique to credential dumping with Mimikatz. Deprecated because mimikatz libraries changed and very noisy sysmon Event Code.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2019-12-03
- **Author**: Patrick Bareiss, Splunk
- **ID**: 29e307ba-40af-4ab2-91b2-3c6b392bbba0
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,57 @@ This search looks for reading loaded Images unique to credential dumping with Mi
| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.AE
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 6
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +113,10 @@ This search looks for reading loaded Images unique to credential dumping with Mi
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_mimikatz_using_loaded_images_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_mimikatz_using_loaded_images_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +140,6 @@ Other tools can import the same DLLs. These tools should be part of a whitelist.
* [DarkSide Ransomware](/stories/darkside_ransomware)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -96,8 +149,6 @@ Other tools can import the same DLLs. These tools should be part of a whitelist.
| 64.0 | 80 | 80 | A process, $Image$, has loaded $ImageLoaded$ that are typically related to credential dumping on $Computer$. Review for further details. |
-
-
#### Reference
* [https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html](https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html)
@@ -105,7 +156,7 @@ Other tools can import the same DLLs. These tools should be part of a whitelist.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md b/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md
index d0dd8213a1..19c8bc230a 100644
--- a/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md
+++ b/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md
@@ -26,16 +26,21 @@ tags:
Detect memory dumping of the LSASS process.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2019-12-06
- **Author**: Patrick Bareiss, Splunk
- **ID**: fb4c31b0-13e8-4155-8aa5-24de4b8d6717
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,56 @@ Detect memory dumping of the LSASS process.
| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 6
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -56,10 +111,10 @@ Detect memory dumping of the LSASS process.
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `access_lsass_memory_for_dump_creation_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **access_lsass_memory_for_dump_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -82,9 +137,6 @@ Administrators can create memory dumps for debugging purposes, but memory dumps
* [Credential Dumping](/stories/credential_dumping)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -94,8 +146,6 @@ Administrators can create memory dumps for debugging purposes, but memory dumps
| 63.0 | 70 | 90 | process $SourceImage$ injected into $TargetImage$ and was attempted dump LSASS on $dest$. Adversaries tend to do this when trying to accesss credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). |
-
-
#### Reference
* [https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf](https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf)
@@ -103,7 +153,7 @@ Administrators can create memory dumps for debugging purposes, but memory dumps
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md b/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md
index e9bec5ab10..5946b6f4b2 100644
--- a/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md
+++ b/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md
@@ -26,16 +26,21 @@ tags:
Detect remote thread creation into LSASS consistent with credential dumping.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2019-12-06
- **Author**: Patrick Bareiss, Splunk
- **ID**: 67d4dbef-9564-4699-8da8-03a151529edc
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,56 @@ Detect remote thread creation into LSASS consistent with credential dumping.
| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -56,10 +111,10 @@ Detect remote thread creation into LSASS consistent with credential dumping.
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `create_remote_thread_into_lsass_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **create_remote_thread_into_lsass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -82,9 +137,6 @@ Other tools can access LSASS for legitimate reasons and generate an event. In th
* [Credential Dumping](/stories/credential_dumping)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -94,8 +146,6 @@ Other tools can access LSASS for legitimate reasons and generate an event. In th
| 81.0 | 90 | 90 | A process has created a remote thread into $TargetImage$ on $dest$. This behavior is indicative of credential dumping and should be investigated. |
-
-
#### Reference
* [https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf](https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf)
@@ -103,7 +153,7 @@ Other tools can access LSASS for legitimate reasons and generate an event. In th
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2019-12-06-unsigned_image_loaded_by_lsass.md b/docs/_posts/2019-12-06-unsigned_image_loaded_by_lsass.md
index 7aaa26ddda..38606d00cd 100644
--- a/docs/_posts/2019-12-06-unsigned_image_loaded_by_lsass.md
+++ b/docs/_posts/2019-12-06-unsigned_image_loaded_by_lsass.md
@@ -23,21 +23,76 @@ tags:
This search detects loading of unsigned images by LSASS. Deprecated because too noisy.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2019-12-06
- **Author**: Patrick Bareiss, Splunk
- **ID**: 56ef054c-76ef-45f9-af4a-a634695dcd65
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1003.001](https://attack.mitre.org/techniques/T1003/001/) | LSASS Memory | Credential Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -51,10 +106,10 @@ This search detects loading of unsigned images by LSASS. Deprecated because too
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `unsigned_image_loaded_by_lsass_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **unsigned_image_loaded_by_lsass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -70,9 +125,6 @@ Other tools could load images into LSASS for legitimate reason. But enterprise t
* [Credential Dumping](/stories/credential_dumping)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -82,8 +134,6 @@ Other tools could load images into LSASS for legitimate reason. But enterprise t
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
* [https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf](https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf)
@@ -91,7 +141,7 @@ Other tools could load images into LSASS for legitimate reason. But enterprise t
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2019-12-10-creation_of_shadow_copy.md b/docs/_posts/2019-12-10-creation_of_shadow_copy.md
index ff88351c6f..5470d7ae6e 100644
--- a/docs/_posts/2019-12-10-creation_of_shadow_copy.md
+++ b/docs/_posts/2019-12-10-creation_of_shadow_copy.md
@@ -27,16 +27,21 @@ tags:
Monitor for signs that Vssadmin or Wmic has been used to create a shadow copy.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2019-12-10
- **Author**: Patrick Bareiss, Splunk
- **ID**: eb120f5f-b879-4a63-97c1-93352b5df844
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,56 @@ Monitor for signs that Vssadmin or Wmic has been used to create a shadow copy.
| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +112,10 @@ Monitor for signs that Vssadmin or Wmic has been used to create a shadow copy.
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `creation_of_shadow_copy_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **creation_of_shadow_copy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -87,9 +142,6 @@ Legitimate administrator usage of Vssadmin or Wmic will create false positives.
* [Credential Dumping](/stories/credential_dumping)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -99,8 +151,6 @@ Legitimate administrator usage of Vssadmin or Wmic will create false positives.
| 81.0 | 90 | 90 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to create a shadow copy to perform offline password cracking. |
-
-
#### Reference
* [https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf](https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf)
@@ -108,7 +158,7 @@ Legitimate administrator usage of Vssadmin or Wmic will create false positives.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md b/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md
index 44445649f8..a04f40c20d 100644
--- a/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md
+++ b/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md
@@ -29,16 +29,21 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search allows you to identify DNS requests that are unusually large for the record type being requested in your environment.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Network_Resolution](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkResolution)
-
- **Last Updated**: 2020-01-22
- **Author**: Rico Valdez, Splunk
- **ID**: 85fbcfe8-9718-4911-adf6-7000d077a3a9
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,58 @@ This search allows you to identify DNS requests that are unusually large for the
| [T1071](https://attack.mitre.org/techniques/T1071/) | Application Layer Protocol | Command And Control |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Command & Control
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.AE
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+* CIS 12
+
+
+
+
+
+
+
#### Search
```
@@ -66,10 +123,10 @@ This search allows you to identify DNS requests that are unusually large for the
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `dns_query_length_outliers_-_mltk_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **dns_query_length_outliers_-_mltk_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -97,9 +154,6 @@ If you are seeing more results than desired, you may consider reducing the value
* [Command and Control](/stories/command_and_control)
-#### Kill Chain Phase
-* Command & Control
-
#### RBA
@@ -109,13 +163,11 @@ If you are seeing more results than desired, you may consider reducing the value
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-01-28-auto_admin_logon_registry_entry.md b/docs/_posts/2020-01-28-auto_admin_logon_registry_entry.md
index e60d4c19b6..d5ba084fcd 100644
--- a/docs/_posts/2020-01-28-auto_admin_logon_registry_entry.md
+++ b/docs/_posts/2020-01-28-auto_admin_logon_registry_entry.md
@@ -27,16 +27,21 @@ tags:
this search is to detect a suspicious registry modification to implement auto admin logon to a host. This technique was seen in BlackMatter ransomware to automatically logon to the compromise host after triggering a safemode boot to continue encrypting the whole network. This behavior is not a common practice and really a suspicious TTP or alert need to be consider if found within then network premise.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2020-01-28
- **Author**: Teoderick Contreras, Splunk
- **ID**: 1379d2b8-0f18-11ec-8ca3-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ this search is to detect a suspicious registry modification to implement auto ad
| [T1552](https://attack.mitre.org/techniques/T1552/) | Unsecured Credentials | Credential Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -64,7 +114,7 @@ this search is to detect a suspicious registry modification to implement auto ad
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `auto_admin_logon_registry_entry_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **auto_admin_logon_registry_entry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -85,9 +135,6 @@ unknown
* [Windows Registry Abuse](/stories/windows_registry_abuse)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -97,8 +144,6 @@ unknown
| 63.0 | 70 | 90 | modified registry key $registry_key_name$ with registry value $registry_value_name$ to prepare autoadminlogon |
-
-
#### Reference
* [https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/](https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/)
@@ -106,7 +151,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-01-28-monitor_registry_keys_for_print_monitors.md b/docs/_posts/2020-01-28-monitor_registry_keys_for_print_monitors.md
index ea6b832ec0..c6a2bd1218 100644
--- a/docs/_posts/2020-01-28-monitor_registry_keys_for_print_monitors.md
+++ b/docs/_posts/2020-01-28-monitor_registry_keys_for_print_monitors.md
@@ -28,16 +28,21 @@ tags:
This search looks for registry activity associated with modifications to the registry key `HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors`. In this scenario, an attacker can load an arbitrary .dll into the print-monitor registry by giving the full path name to the after.dll. The system will execute the .dll with elevated (SYSTEM) permissions and will persist after reboot.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-01-28
- **Author**: Bhavin Patel, Teoderick Contreras, Splunk
- **ID**: f5f6af30-7ba7-4295-bfe9-07de87c01bbc
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -45,6 +50,58 @@ This search looks for registry activity associated with modifications to the reg
| [T1547](https://attack.mitre.org/techniques/T1547/) | Boot or Logon Autostart Execution | Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+* PR.AC
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+* CIS 5
+
+
+
+
+
+
+
#### Search
```
@@ -65,7 +122,7 @@ This search looks for registry activity associated with modifications to the reg
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `monitor_registry_keys_for_print_monitors_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **monitor_registry_keys_for_print_monitors_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -89,9 +146,6 @@ You will encounter noise from legitimate print-monitor registry entries.
* [Windows Registry Abuse](/stories/windows_registry_abuse)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -101,13 +155,11 @@ You will encounter noise from legitimate print-monitor registry entries.
| 64.0 | 80 | 80 | New print monitor added on $dest$ |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-01-28-registry_keys_for_creating_shim_databases.md b/docs/_posts/2020-01-28-registry_keys_for_creating_shim_databases.md
index 7ae3c48e36..f6c0d803c5 100644
--- a/docs/_posts/2020-01-28-registry_keys_for_creating_shim_databases.md
+++ b/docs/_posts/2020-01-28-registry_keys_for_creating_shim_databases.md
@@ -28,16 +28,21 @@ tags:
This search looks for registry activity associated with application compatibility shims, which can be leveraged by attackers for various nefarious purposes.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-01-28
- **Author**: Bhavin Patel, Patrick Bareiss, Teoderick Contreras, Splunk
- **ID**: f5f6af30-7aa7-4295-bfe9-07fe87c01bbb
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -45,6 +50,56 @@ This search looks for registry activity associated with application compatibilit
| [T1546](https://attack.mitre.org/techniques/T1546/) | Event Triggered Execution | Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -65,7 +120,7 @@ This search looks for registry activity associated with application compatibilit
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `registry_keys_for_creating_shim_databases_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **registry_keys_for_creating_shim_databases_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -87,9 +142,6 @@ There are many legitimate applications that leverage shim databases for compatib
* [Windows Registry Abuse](/stories/windows_registry_abuse)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -99,13 +151,11 @@ There are many legitimate applications that leverage shim databases for compatib
| 56.0 | 70 | 80 | A registry activity in $registry_path$ related to shim modication in host $dest$ |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-01-28-sdclt_uac_bypass.md b/docs/_posts/2020-01-28-sdclt_uac_bypass.md
index 2f18991a84..e2e5b13d9d 100644
--- a/docs/_posts/2020-01-28-sdclt_uac_bypass.md
+++ b/docs/_posts/2020-01-28-sdclt_uac_bypass.md
@@ -29,16 +29,21 @@ tags:
This search is to detect a suspicious sdclt.exe registry modification. This technique is commonly seen when attacker try to bypassed UAC by using sdclt.exe application by modifying some registry that sdclt.exe tries to open or query with payload file path on it to be executed.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2020-01-28
- **Author**: Teoderick Contreras, Splunk
- **ID**: d71efbf6-da63-11eb-8c6e-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,51 @@ This search is to detect a suspicious sdclt.exe registry modification. This tech
| [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -66,7 +116,7 @@ This search is to detect a suspicious sdclt.exe registry modification. This tech
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `sdclt_uac_bypass_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **sdclt_uac_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -87,9 +137,6 @@ Limited to no false positives are expected.
* [Windows Registry Abuse](/stories/windows_registry_abuse)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -99,8 +146,6 @@ Limited to no false positives are expected.
| 63.0 | 70 | 90 | Suspicious modification of registry $registry_path$ with possible payload path $registry_value_name$ in $dest$ |
-
-
#### Reference
* [https://enigma0x3.net/2017/03/17/fileless-uac-bypass-using-sdclt-exe/](https://enigma0x3.net/2017/03/17/fileless-uac-bypass-using-sdclt-exe/)
@@ -110,7 +155,7 @@ Limited to no false positives are expected.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-01-28-silentcleanup_uac_bypass.md b/docs/_posts/2020-01-28-silentcleanup_uac_bypass.md
index 54c9c30a20..a1314eee79 100644
--- a/docs/_posts/2020-01-28-silentcleanup_uac_bypass.md
+++ b/docs/_posts/2020-01-28-silentcleanup_uac_bypass.md
@@ -29,16 +29,21 @@ tags:
This search is to detect a suspicious modification of registry that may related to UAC bypassed. This registry will be trigger once the attacker abuse the silentcleanup task schedule to gain high privilege execution that will bypass User control account.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2020-01-28
- **Author**: Teoderick Contreras, Splunk
- **ID**: 56d7cfcc-da63-11eb-92d4-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,51 @@ This search is to detect a suspicious modification of registry that may related
| [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -66,7 +116,7 @@ This search is to detect a suspicious modification of registry that may related
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `silentcleanup_uac_bypass_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **silentcleanup_uac_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -87,9 +137,6 @@ unknown
* [Windows Registry Abuse](/stories/windows_registry_abuse)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -99,8 +146,6 @@ unknown
| 63.0 | 70 | 90 | Suspicious modification of registry $registry_path$ with possible payload path $registry_value_name$ in $dest$ |
-
-
#### Reference
* [https://github.com/hfiref0x/UACME](https://github.com/hfiref0x/UACME)
@@ -109,7 +154,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-01-28-wsreset_uac_bypass.md b/docs/_posts/2020-01-28-wsreset_uac_bypass.md
index ce411505fd..f5426d63ad 100644
--- a/docs/_posts/2020-01-28-wsreset_uac_bypass.md
+++ b/docs/_posts/2020-01-28-wsreset_uac_bypass.md
@@ -29,16 +29,21 @@ tags:
This search is to detect a suspicious modification of registry related to UAC bypass. This technique is to modify the registry in this detection, create a registry value with the path of the payload and run WSreset.exe to bypass User account Control.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2020-01-28
- **Author**: Teoderick Contreras, Splunk
- **ID**: 8b5901bc-da63-11eb-be43-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,51 @@ This search is to detect a suspicious modification of registry related to UAC by
| [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -66,7 +116,7 @@ This search is to detect a suspicious modification of registry related to UAC by
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `wsreset_uac_bypass_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **wsreset_uac_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -88,9 +138,6 @@ unknown
* [Windows Registry Abuse](/stories/windows_registry_abuse)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -100,8 +147,6 @@ unknown
| 63.0 | 70 | 90 | Suspicious modification of registry $registry_path$ with possible payload path $registry_value_name$ in $dest$ |
-
-
#### Reference
* [https://github.com/hfiref0x/UACME](https://github.com/hfiref0x/UACME)
@@ -110,7 +155,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md b/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md
index b6edc36201..a964f7ba27 100644
--- a/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md
+++ b/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md
@@ -26,16 +26,21 @@ tags:
Detect the hands on keyboard behavior of Windows Task Manager creating a process dump of lsass.exe. Upon this behavior occurring, a file write/modification will occur in the users profile under \AppData\Local\Temp. The dump file, lsass.dmp, cannot be renamed, however if the dump occurs more than once, it will be named lsass (2).dmp.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-02-03
- **Author**: Michael Haag, Splunk
- **ID**: b2fbe95a-9c62-4c12-8a29-24b97e84c0cd
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,56 @@ Detect the hands on keyboard behavior of Windows Task Manager creating a process
| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 6
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -56,10 +111,10 @@ Detect the hands on keyboard behavior of Windows Task Manager creating a process
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `creation_of_lsass_dump_with_taskmgr_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **creation_of_lsass_dump_with_taskmgr_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -80,9 +135,6 @@ Administrators can create memory dumps for debugging purposes, but memory dumps
* [Credential Dumping](/stories/credential_dumping)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -92,8 +144,6 @@ Administrators can create memory dumps for debugging purposes, but memory dumps
| 80.0 | 80 | 100 | $process_name$ was identified on endpoint $Computer$ writing $TargetFilename$ to disk. This behavior is related to dumping credentials via Task Manager. |
-
-
#### Reference
* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-5---dump-lsassexe-memory-using-windows-task-manager](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-5---dump-lsassexe-memory-using-windows-task-manager)
@@ -103,7 +153,7 @@ Administrators can create memory dumps for debugging purposes, but memory dumps
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-02-07-ec2_instance_started_with_previously_unseen_instance_type.md b/docs/_posts/2020-02-07-ec2_instance_started_with_previously_unseen_instance_type.md
index f7c68bfc41..3d6d3bd303 100644
--- a/docs/_posts/2020-02-07-ec2_instance_started_with_previously_unseen_instance_type.md
+++ b/docs/_posts/2020-02-07-ec2_instance_started_with_previously_unseen_instance_type.md
@@ -20,14 +20,70 @@ tags:
This search looks for EC2 instances being created with previously unseen instance types. This search is deprecated and have been translated to use the latest Change Datamodel.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-02-07
- **Author**: David Dorsey, Splunk
- **ID**: 65541c80-03c7-4e05-83c8-1dcd57a2e1ad
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* ID.AM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 1
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +108,10 @@ This search looks for EC2 instances being created with previously unseen instanc
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `ec2_instance_started_with_previously_unseen_instance_type_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **ec2_instance_started_with_previously_unseen_instance_type_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -74,9 +130,6 @@ It is possible that an admin will create a new system using a new instance type
* [AWS Cryptomining](/stories/aws_cryptomining)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -86,13 +139,11 @@ It is possible that an admin will create a new system using a new instance type
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-02-07-macos_-_re-opened_applications.md b/docs/_posts/2020-02-07-macos_-_re-opened_applications.md
index eecd5c170d..1a734ea018 100644
--- a/docs/_posts/2020-02-07-macos_-_re-opened_applications.md
+++ b/docs/_posts/2020-02-07-macos_-_re-opened_applications.md
@@ -23,14 +23,72 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search looks for processes referencing the plist files that determine which applications are re-opened when a user reboots their machine.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2020-02-07
- **Author**: Jamie Windley, Splunk
- **ID**: 40bb64f9-f619-4e3d-8732-328d40377c4b
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Installation
+* Command & Control
+
+
+
+
+
+
+NIST
+ +
+
+* DE.DP
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -44,10 +102,10 @@ This search looks for processes referencing the plist files that determine which
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `macos_-_re-opened_applications_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **macos_-_re-opened_applications_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -69,10 +127,6 @@ At this stage, there are no known false positives. During testing, no process ev
* [ColdRoot MacOS RAT](/stories/coldroot_macos_rat)
-#### Kill Chain Phase
-* Installation
-* Command & Control
-
#### RBA
@@ -82,13 +136,11 @@ At this stage, there are no known false positives. During testing, no process ev
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-02-20-gcp_gcr_container_uploaded.md b/docs/_posts/2020-02-20-gcp_gcr_container_uploaded.md
index 51aa7a1eef..d251cde26f 100644
--- a/docs/_posts/2020-02-20-gcp_gcr_container_uploaded.md
+++ b/docs/_posts/2020-02-20-gcp_gcr_container_uploaded.md
@@ -23,21 +23,71 @@ tags:
This search show information on uploaded containers including source user, account, action, bucket name event name, http user agent, message and destination path.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-02-20
- **Author**: Rod Soto, Rico Valdez, Splunk
- **ID**: 4f00ca88-e766-4605-ac65-ae51c9fd185b
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1525](https://attack.mitre.org/techniques/T1525/) | Implant Internal Image | Persistence |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -50,7 +100,7 @@ This search show information on uploaded containers including source user, accou
#### Macros
The SPL above uses the following Macros:
-Note that `gcp_gcr_container_uploaded_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **gcp_gcr_container_uploaded_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -66,9 +116,6 @@ Uploading container is a normal behavior from developers or users with access to
* [Container Implantation Monitoring and Investigation](/stories/container_implantation_monitoring_and_investigation)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -78,13 +125,11 @@ Uploading container is a normal behavior from developers or users with access to
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md b/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md
index 818ac61fdb..95bc2d5e79 100644
--- a/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md
+++ b/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md
@@ -25,21 +25,71 @@ We have not been able to test, simulate, or build datasets for this object. Use
This searches show information on uploaded containers including source user, image id, source IP user type, http user agent, region, first time, last time of operation (PutImage). These searches are based on Cloud Infrastructure Data Model.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-02-20
- **Author**: Rod Soto, Rico Valdez, Splunk
- **ID**: f0f70b40-f7ad-489d-9905-23d149da8099
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1525](https://attack.mitre.org/techniques/T1525/) | Implant Internal Image | Persistence |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,7 +102,7 @@ This searches show information on uploaded containers including source user, ima
#### Macros
The SPL above uses the following Macros:
-Note that `new_container_uploaded_to_aws_ecr_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **new_container_uploaded_to_aws_ecr_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -68,9 +118,6 @@ Uploading container is a normal behavior from developers or users with access to
* [Container Implantation Monitoring and Investigation](/stories/container_implantation_monitoring_and_investigation)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -80,13 +127,11 @@ Uploading container is a normal behavior from developers or users with access to
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md b/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md
index 3b80d8af6f..08c7ff195d 100644
--- a/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md
+++ b/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md
@@ -27,16 +27,21 @@ tags:
Detect the usage of comsvcs.dll for dumping the lsass process.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2020-02-21
- **Author**: Patrick Bareiss, Splunk
- **ID**: 8943b567-f14d-4ee8-a0bb-2121d4ce3184
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,57 @@ Detect the usage of comsvcs.dll for dumping the lsass process.
| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -57,11 +113,11 @@ Detect the usage of comsvcs.dll for dumping the lsass process.
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `dump_lsass_via_comsvcs_dll_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **dump_lsass_via_comsvcs_dll_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -91,9 +147,6 @@ None identified.
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -103,8 +156,6 @@ None identified.
| 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified accessing credentials using comsvcs.dll on endpoint $dest$ by user $user$. |
-
-
#### Reference
* [https://modexp.wordpress.com/2019/08/30/minidumpwritedump-via-com-services-dll/](https://modexp.wordpress.com/2019/08/30/minidumpwritedump-via-com-services-dll/)
@@ -113,7 +164,7 @@ None identified.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-03-02-remote_registry_key_modifications.md b/docs/_posts/2020-03-02-remote_registry_key_modifications.md
index 60407739d1..015266cda9 100644
--- a/docs/_posts/2020-03-02-remote_registry_key_modifications.md
+++ b/docs/_posts/2020-03-02-remote_registry_key_modifications.md
@@ -20,14 +20,71 @@ tags:
This search monitors for remote modifications to registry keys.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-03-02
- **Author**: Bhavin Patel, Splunk
- **ID**: c9f4b923-f8af-4155-b697-1354f5dcbc5e
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -41,10 +98,10 @@ This search monitors for remote modifications to registry keys.
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `remote_registry_key_modifications_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **remote_registry_key_modifications_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -62,9 +119,6 @@ This technique may be legitimately used by administrators to modify remote regis
* [Windows Persistence Techniques](/stories/windows_persistence_techniques)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -74,13 +128,11 @@ This technique may be legitimately used by administrators to modify remote regis
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md b/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md
index 84010add1e..4261c35303 100644
--- a/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md
+++ b/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md
@@ -27,21 +27,82 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search looks for child processes of spoolsv.exe. This activity is associated with a POC privilege-escalation exploit associated with CVE-2018-8440. Spoolsv.exe is the process associated with the Print Spooler service in Windows and typically runs as SYSTEM.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2020-03-16
- **Author**: Rico Valdez, Splunk
- **ID**: aa0c4aeb-5b18-41c4-8c07-f1442d7599df
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1068](https://attack.mitre.org/techniques/T1068/) | Exploitation for Privilege Escalation | Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* PR.AC
+* PR.PT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 5
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -55,10 +116,10 @@ This search looks for child processes of spoolsv.exe. This activity is associate
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `child_processes_of_spoolsv_exe_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **child_processes_of_spoolsv_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -81,9 +142,6 @@ Some legitimate printer-related processes may show up as children of spoolsv.exe
* [Windows Privilege Escalation](/stories/windows_privilege_escalation)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -93,19 +151,11 @@ Some legitimate printer-related processes may show up as children of spoolsv.exe
| 25.0 | 50 | 50 | tbd |
-#### CVE
-
-| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
-| ----------- | ----------- | -------------- |
-| [CVE-2018-8440](https://nvd.nist.gov/vuln/detail/CVE-2018-8440) | An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC), aka "Windows ALPC Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. | 7.2 |
-
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-03-16-detect_rare_executables.md b/docs/_posts/2020-03-16-detect_rare_executables.md
index 9bc5c9aab5..f03e33d5d8 100644
--- a/docs/_posts/2020-03-16-detect_rare_executables.md
+++ b/docs/_posts/2020-03-16-detect_rare_executables.md
@@ -23,14 +23,76 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search will return a table of rare processes, the names of the systems running them, and the users who initiated each process.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2020-03-16
- **Author**: Bhavin Patel, Splunk
- **ID**: 44fddcb2-8d3b-454c-874e-7c6de5a4f7ac
+
+#### Annotations
+
+CVE
+ +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
+| ----------- | ----------- | -------------- |
+| [CVE-2018-8440](https://nvd.nist.gov/vuln/detail/CVE-2018-8440) | An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC), aka "Windows ALPC Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. | 7.2 |
+
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Installation
+* Command & Control
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* ID.AM
+* PR.PT
+* PR.DS
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 2
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -51,11 +113,11 @@ This search will return a table of rare processes, the names of the systems runn
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [filter_rare_process_allow_list](https://github.com/splunk/security_content/blob/develop/macros/filter_rare_process_allow_list.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_rare_executables_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_rare_executables_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -76,11 +138,6 @@ Some legitimate processes may be only rarely executed in your environment. As th
* [Cloud Federated Credential Abuse](/stories/cloud_federated_credential_abuse)
-#### Kill Chain Phase
-* Installation
-* Command & Control
-* Actions on Objectives
-
#### RBA
@@ -90,13 +147,11 @@ Some legitimate processes may be only rarely executed in your environment. As th
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-03-16-process_execution_via_wmi.md b/docs/_posts/2020-03-16-process_execution_via_wmi.md
index 21e2aca51c..61227044bb 100644
--- a/docs/_posts/2020-03-16-process_execution_via_wmi.md
+++ b/docs/_posts/2020-03-16-process_execution_via_wmi.md
@@ -24,21 +24,79 @@ tags:
The following analytic identifies `WmiPrvSE.exe` spawning a process. This typically occurs when a process is instantiated from a local or remote process using `wmic.exe`. During triage, review parallel processes for suspicious behavior or commands executed. Review the process and command-line spawning from `wmiprvse.exe`. Contain and remediate the endpoint as necessary.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2020-03-16
- **Author**: Rico Valdez, Michael Haag, Splunk
- **ID**: 24869767-8579-485d-9a4f-d9ddfd8f0cac
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1047](https://attack.mitre.org/techniques/T1047/) | Windows Management Instrumentation | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* PR.AT
+* PR.AC
+* PR.IP
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +110,10 @@ The following analytic identifies `WmiPrvSE.exe` spawning a process. This typica
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `process_execution_via_wmi_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **process_execution_via_wmi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -76,9 +134,6 @@ Although unlikely, administrators may use wmi to execute commands for legitimate
* [Suspicious WMI Use](/stories/suspicious_wmi_use)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -88,13 +143,11 @@ Although unlikely, administrators may use wmi to execute commands for legitimate
| 49.0 | 70 | 70 | A remote instance execution of wmic.exe that will spawn $parent_process_name$ in host $dest$ |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-03-16-script_execution_via_wmi.md b/docs/_posts/2020-03-16-script_execution_via_wmi.md
index 261fc2113c..4e454d0e2d 100644
--- a/docs/_posts/2020-03-16-script_execution_via_wmi.md
+++ b/docs/_posts/2020-03-16-script_execution_via_wmi.md
@@ -24,21 +24,79 @@ tags:
This search looks for scripts launched via WMI.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2020-03-16
- **Author**: Rico Valdez, Michael Haag, Splunk
- **ID**: aa73f80d-d728-4077-b226-81ea0c8be589
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1047](https://attack.mitre.org/techniques/T1047/) | Windows Management Instrumentation | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* PR.AT
+* PR.AC
+* PR.IP
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +110,10 @@ This search looks for scripts launched via WMI.
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `script_execution_via_wmi_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **script_execution_via_wmi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -74,9 +132,6 @@ Although unlikely, administrators may use wmi to launch scripts for legitimate p
* [Suspicious WMI Use](/stories/suspicious_wmi_use)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -86,8 +141,6 @@ Although unlikely, administrators may use wmi to launch scripts for legitimate p
| 36.0 | 60 | 60 | A wmic.exe process $process_name$ taht execute script in host $dest$ |
-
-
#### Reference
* [https://redcanary.com/blog/child-processes/](https://redcanary.com/blog/child-processes/)
@@ -95,7 +148,7 @@ Although unlikely, administrators may use wmi to launch scripts for legitimate p
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-03-16-spike_in_file_writes.md b/docs/_posts/2020-03-16-spike_in_file_writes.md
index 79aff1eceb..7ccb65d60b 100644
--- a/docs/_posts/2020-03-16-spike_in_file_writes.md
+++ b/docs/_posts/2020-03-16-spike_in_file_writes.md
@@ -22,14 +22,70 @@ We have not been able to test, simulate, or build datasets for this object. Use
The search looks for a sharp increase in the number of files written to a particular host
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-03-16
- **Author**: David Dorsey, Splunk
- **ID**: fdb0f805-74e4-4539-8c00-618927333aae
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -47,7 +103,7 @@ The search looks for a sharp increase in the number of files written to a partic
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `spike_in_file_writes_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **spike_in_file_writes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -67,9 +123,6 @@ It is important to understand that if you happen to install any new applications
* [Ransomware](/stories/ransomware)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -79,13 +132,11 @@ It is important to understand that if you happen to install any new applications
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md b/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md
index 759b36fe32..661bd66a7c 100644
--- a/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md
+++ b/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md
@@ -25,21 +25,71 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search provides information of unauthenticated requests via user agent, and authentication data against Kubernetes cluster in AWS
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-04-15
- **Author**: Rod Soto, Splunk
- **ID**: 294c4686-63dd-4fe6-93a2-ca807626704a
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1526](https://attack.mitre.org/techniques/T1526/) | Cloud Service Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -56,7 +106,7 @@ The SPL above uses the following Macros:
* [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `amazon_eks_kubernetes_cluster_scan_detection_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **amazon_eks_kubernetes_cluster_scan_detection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -82,9 +132,6 @@ Not all unauthenticated requests are malicious, but frequency, UA and source IPs
* [Kubernetes Scanning Activity](/stories/kubernetes_scanning_activity)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -94,13 +141,11 @@ Not all unauthenticated requests are malicious, but frequency, UA and source IPs
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md b/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md
index c1ee12f9f6..a6346aea8f 100644
--- a/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md
+++ b/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md
@@ -25,21 +25,71 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search provides detection information on unauthenticated requests against Kubernetes' Pods API
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-04-15
- **Author**: Rod Soto, Splunk
- **ID**: dbfca1dd-b8e5-4ba4-be0e-e565e5d62002
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1526](https://attack.mitre.org/techniques/T1526/) | Cloud Service Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -56,7 +106,7 @@ The SPL above uses the following Macros:
* [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `amazon_eks_kubernetes_pod_scan_detection_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **amazon_eks_kubernetes_pod_scan_detection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -83,9 +133,6 @@ Not all unauthenticated requests are malicious, but frequency, UA and source IPs
* [Kubernetes Scanning Activity](/stories/kubernetes_scanning_activity)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -95,13 +142,11 @@ Not all unauthenticated requests are malicious, but frequency, UA and source IPs
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-04-15-gcp_kubernetes_cluster_scan_detection.md b/docs/_posts/2020-04-15-gcp_kubernetes_cluster_scan_detection.md
index 6c6e8a19a5..62c22beed4 100644
--- a/docs/_posts/2020-04-15-gcp_kubernetes_cluster_scan_detection.md
+++ b/docs/_posts/2020-04-15-gcp_kubernetes_cluster_scan_detection.md
@@ -23,21 +23,71 @@ tags:
This search provides information of unauthenticated requests via user agent, and authentication data against Kubernetes cluster
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-04-15
- **Author**: Rod Soto, Splunk
- **ID**: db5957ec-0144-4c56-b512-9dccbe7a2d26
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1526](https://attack.mitre.org/techniques/T1526/) | Cloud Service Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +102,10 @@ This search provides information of unauthenticated requests via user agent, and
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [google_gcp_pubsub_message](https://github.com/splunk/security_content/blob/develop/macros/google_gcp_pubsub_message.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `gcp_kubernetes_cluster_scan_detection_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **gcp_kubernetes_cluster_scan_detection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -71,9 +121,6 @@ Not all unauthenticated requests are malicious, but frequency, User Agent and so
* [Kubernetes Scanning Activity](/stories/kubernetes_scanning_activity)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -83,13 +130,11 @@ Not all unauthenticated requests are malicious, but frequency, User Agent and so
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-05-19-kubernetes_azure_scan_fingerprint.md b/docs/_posts/2020-05-19-kubernetes_azure_scan_fingerprint.md
index 768a92d242..0b963258b0 100644
--- a/docs/_posts/2020-05-19-kubernetes_azure_scan_fingerprint.md
+++ b/docs/_posts/2020-05-19-kubernetes_azure_scan_fingerprint.md
@@ -23,21 +23,71 @@ tags:
This search provides information of unauthenticated requests via source IP user agent, request URI and response status data against Kubernetes cluster in Azure
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-05-19
- **Author**: Rod Soto, Splunk
- **ID**: c5e5bd5c-1013-4841-8b23-e7b3253c840a
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1526](https://attack.mitre.org/techniques/T1526/) | Cloud Service Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,7 +102,7 @@ This search provides information of unauthenticated requests via source IP user
The SPL above uses the following Macros:
* [kubernetes_azure](https://github.com/splunk/security_content/blob/develop/macros/kubernetes_azure.yml)
-Note that `kubernetes_azure_scan_fingerprint_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **kubernetes_azure_scan_fingerprint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -68,9 +118,6 @@ Not all unauthenticated requests are malicious, but source IPs, userAgent, verb,
* [Kubernetes Scanning Activity](/stories/kubernetes_scanning_activity)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -80,13 +127,11 @@ Not all unauthenticated requests are malicious, but source IPs, userAgent, verb,
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md b/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md
index d0bfcd79a7..df4169f032 100644
--- a/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md
+++ b/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md
@@ -26,21 +26,78 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search looks for child processes spawned by zoom.exe or zoom.us that has not previously been seen.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2020-05-20
- **Author**: David Dorsey, Splunk
- **ID**: e91bd102-d630-4e76-ab73-7e3ba22c5961
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1068](https://attack.mitre.org/techniques/T1068/) | Exploitation for Privilege Escalation | Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+* PR.IP
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -56,11 +113,11 @@ This search looks for child processes spawned by zoom.exe or zoom.us that has no
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [previously_seen_zoom_child_processes_window](https://github.com/splunk/security_content/blob/develop/macros/previously_seen_zoom_child_processes_window.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `first_time_seen_child_process_of_zoom_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **first_time_seen_child_process_of_zoom_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Lookups
The SPL above uses the following Lookups:
@@ -88,9 +145,6 @@ A new child process of zoom isn't malicious by that fact alone. Further investig
* [Suspicious Zoom Child Processes](/stories/suspicious_zoom_child_processes)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -100,13 +154,11 @@ A new child process of zoom isn't malicious by that fact alone. Further investig
| 64.0 | 80 | 80 | Child process $process_name$ with $process_id$ spawned by zoom.exe or zoom.us which has not been previously on host $dest$ |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-05-20-kubernetes_azure_detect_sensitive_object_access.md b/docs/_posts/2020-05-20-kubernetes_azure_detect_sensitive_object_access.md
index ae95fc1e8a..38bdffcdc7 100644
--- a/docs/_posts/2020-05-20-kubernetes_azure_detect_sensitive_object_access.md
+++ b/docs/_posts/2020-05-20-kubernetes_azure_detect_sensitive_object_access.md
@@ -20,14 +20,66 @@ tags:
This search provides information on Kubernetes accounts accessing sensitve objects such as configmpas or secrets
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-05-20
- **Author**: Rod Soto, Splunk
- **ID**: 1bba382b-07fd-4ffa-b390-8002739b76e8
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -43,7 +95,7 @@ This search provides information on Kubernetes accounts accessing sensitve objec
The SPL above uses the following Macros:
* [kubernetes_azure](https://github.com/splunk/security_content/blob/develop/macros/kubernetes_azure.yml)
-Note that `kubernetes_azure_detect_sensitive_object_access_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **kubernetes_azure_detect_sensitive_object_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -59,9 +111,6 @@ Sensitive object access is not necessarily malicious but user and object context
* [Kubernetes Sensitive Object Access Activity](/stories/kubernetes_sensitive_object_access_activity)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -71,13 +120,11 @@ Sensitive object access is not necessarily malicious but user and object context
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-05-20-kubernetes_azure_detect_sensitive_role_access.md b/docs/_posts/2020-05-20-kubernetes_azure_detect_sensitive_role_access.md
index 18a3ed6a92..acbec18ca6 100644
--- a/docs/_posts/2020-05-20-kubernetes_azure_detect_sensitive_role_access.md
+++ b/docs/_posts/2020-05-20-kubernetes_azure_detect_sensitive_role_access.md
@@ -20,14 +20,66 @@ tags:
This search provides information on Kubernetes accounts accessing sensitve objects such as configmpas or secrets
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-05-20
- **Author**: Rod Soto, Splunk
- **ID**: f27349e5-1641-4f6a-9e68-30402be0ad4c
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -43,7 +95,7 @@ This search provides information on Kubernetes accounts accessing sensitve objec
The SPL above uses the following Macros:
* [kubernetes_azure](https://github.com/splunk/security_content/blob/develop/macros/kubernetes_azure.yml)
-Note that `kubernetes_azure_detect_sensitive_role_access_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **kubernetes_azure_detect_sensitive_role_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -59,9 +111,6 @@ Sensitive role resource access is necessary for cluster operation, however sourc
* [Kubernetes Sensitive Role Activity](/stories/kubernetes_sensitive_role_activity)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -71,13 +120,11 @@ Sensitive role resource access is necessary for cluster operation, however sourc
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-05-20-kubernetes_azure_detect_service_accounts_forbidden_failure_access.md b/docs/_posts/2020-05-20-kubernetes_azure_detect_service_accounts_forbidden_failure_access.md
index a1e334a73d..7216acca1c 100644
--- a/docs/_posts/2020-05-20-kubernetes_azure_detect_service_accounts_forbidden_failure_access.md
+++ b/docs/_posts/2020-05-20-kubernetes_azure_detect_service_accounts_forbidden_failure_access.md
@@ -20,14 +20,66 @@ tags:
This search provides information on Kubernetes service accounts with failure or forbidden access status
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-05-20
- **Author**: Rod Soto, Splunk
- **ID**: 019690d7-420f-4da0-b320-f27b09961514
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -42,7 +94,7 @@ This search provides information on Kubernetes service accounts with failure or
The SPL above uses the following Macros:
* [kubernetes_azure](https://github.com/splunk/security_content/blob/develop/macros/kubernetes_azure.yml)
-Note that `kubernetes_azure_detect_service_accounts_forbidden_failure_access_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **kubernetes_azure_detect_service_accounts_forbidden_failure_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -58,9 +110,6 @@ This search can give false positives as there might be inherent issues with auth
* [Kubernetes Sensitive Object Access Activity](/stories/kubernetes_sensitive_object_access_activity)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -70,13 +119,11 @@ This search can give false positives as there might be inherent issues with auth
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-05-20-kubernetes_azure_pod_scan_fingerprint.md b/docs/_posts/2020-05-20-kubernetes_azure_pod_scan_fingerprint.md
index 395ee979aa..d5ba1131e2 100644
--- a/docs/_posts/2020-05-20-kubernetes_azure_pod_scan_fingerprint.md
+++ b/docs/_posts/2020-05-20-kubernetes_azure_pod_scan_fingerprint.md
@@ -20,14 +20,66 @@ tags:
This search provides information of unauthenticated requests via source IP user agent, request URI and response status data against Kubernetes cluster pod in Azure
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-05-20
- **Author**: Rod Soto, Splunk
- **ID**: 86aad3e0-732f-4f66-bbbc-70df448e461d
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -42,7 +94,7 @@ This search provides information of unauthenticated requests via source IP user
The SPL above uses the following Macros:
* [kubernetes_azure](https://github.com/splunk/security_content/blob/develop/macros/kubernetes_azure.yml)
-Note that `kubernetes_azure_pod_scan_fingerprint_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **kubernetes_azure_pod_scan_fingerprint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -58,9 +110,6 @@ Not all unauthenticated requests are malicious, but source IPs, userAgent, verb,
* [Kubernetes Scanning Activity](/stories/kubernetes_scanning_activity)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -70,13 +119,11 @@ Not all unauthenticated requests are malicious, but source IPs, userAgent, verb,
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-05-26-kubernetes_azure_active_service_accounts_by_pod_namespace.md b/docs/_posts/2020-05-26-kubernetes_azure_active_service_accounts_by_pod_namespace.md
index f9cd988580..dd121a91cf 100644
--- a/docs/_posts/2020-05-26-kubernetes_azure_active_service_accounts_by_pod_namespace.md
+++ b/docs/_posts/2020-05-26-kubernetes_azure_active_service_accounts_by_pod_namespace.md
@@ -20,14 +20,66 @@ tags:
This search provides information on Kubernetes service accounts,accessing pods and namespaces by IP address and verb
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-05-26
- **Author**: Rod Soto, Splunk
- **ID**: 55a2264a-b7f0-45e5-addd-1e5ab3415c72
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -43,7 +95,7 @@ This search provides information on Kubernetes service accounts,accessing pods a
The SPL above uses the following Macros:
* [kubernetes_azure](https://github.com/splunk/security_content/blob/develop/macros/kubernetes_azure.yml)
-Note that `kubernetes_azure_active_service_accounts_by_pod_namespace_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **kubernetes_azure_active_service_accounts_by_pod_namespace_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -59,9 +111,6 @@ Not all service accounts interactions are malicious. Analyst must consider IP an
* [Kubernetes Sensitive Role Activity](/stories/kubernetes_sensitive_role_activity)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -71,13 +120,11 @@ Not all service accounts interactions are malicious. Analyst must consider IP an
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-05-26-kubernetes_azure_detect_rbac_authorization_by_account.md b/docs/_posts/2020-05-26-kubernetes_azure_detect_rbac_authorization_by_account.md
index 24c0a7eff0..3a8806a65a 100644
--- a/docs/_posts/2020-05-26-kubernetes_azure_detect_rbac_authorization_by_account.md
+++ b/docs/_posts/2020-05-26-kubernetes_azure_detect_rbac_authorization_by_account.md
@@ -20,14 +20,66 @@ tags:
This search provides information on Kubernetes RBAC authorizations by accounts, this search can be modified by adding rare or top to see both extremes of RBAC by accounts occurrences
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-05-26
- **Author**: Rod Soto, Splunk
- **ID**: 47af7d20-0607-4079-97d7-7a29af58b54e
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -44,7 +96,7 @@ This search provides information on Kubernetes RBAC authorizations by accounts,
The SPL above uses the following Macros:
* [kubernetes_azure](https://github.com/splunk/security_content/blob/develop/macros/kubernetes_azure.yml)
-Note that `kubernetes_azure_detect_rbac_authorization_by_account_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **kubernetes_azure_detect_rbac_authorization_by_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -60,9 +112,6 @@ Not all RBAC Authorications are malicious. RBAC authorizations can uncover malic
* [Kubernetes Sensitive Role Activity](/stories/kubernetes_sensitive_role_activity)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -72,13 +121,11 @@ Not all RBAC Authorications are malicious. RBAC authorizations can uncover malic
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-05-26-kubernetes_azure_detect_suspicious_kubectl_calls.md b/docs/_posts/2020-05-26-kubernetes_azure_detect_suspicious_kubectl_calls.md
index 35b59e1276..c251aa428b 100644
--- a/docs/_posts/2020-05-26-kubernetes_azure_detect_suspicious_kubectl_calls.md
+++ b/docs/_posts/2020-05-26-kubernetes_azure_detect_suspicious_kubectl_calls.md
@@ -20,14 +20,66 @@ tags:
This search provides information on rare Kubectl calls with IP, verb namespace and object access context
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-05-26
- **Author**: Rod Soto, Splunk
- **ID**: 4b6d1ba8-0000-4cec-87e6-6cbbd71651b5
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -44,7 +96,7 @@ This search provides information on rare Kubectl calls with IP, verb namespace a
The SPL above uses the following Macros:
* [kubernetes_azure](https://github.com/splunk/security_content/blob/develop/macros/kubernetes_azure.yml)
-Note that `kubernetes_azure_detect_suspicious_kubectl_calls_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **kubernetes_azure_detect_suspicious_kubectl_calls_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -60,9 +112,6 @@ Kubectl calls are not malicious by nature. However source IP, verb and Object ca
* [Kubernetes Sensitive Object Access Activity](/stories/kubernetes_sensitive_object_access_activity)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -72,13 +121,11 @@ Kubectl calls are not malicious by nature. However source IP, verb and Object ca
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-05-28-aws_cross_account_activity_from_previously_unseen_account.md b/docs/_posts/2020-05-28-aws_cross_account_activity_from_previously_unseen_account.md
index 55ab43e0f5..7c7c74b4bb 100644
--- a/docs/_posts/2020-05-28-aws_cross_account_activity_from_previously_unseen_account.md
+++ b/docs/_posts/2020-05-28-aws_cross_account_activity_from_previously_unseen_account.md
@@ -21,14 +21,72 @@ tags:
This search looks for AssumeRole events where an IAM role in a different account is requested for the first time.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Authentication](https://docs.splunk.com/Documentation/CIM/latest/User/Authentication)
-
- **Last Updated**: 2020-05-28
- **Author**: Rico Valdez, Splunk
- **ID**: 21193641-cb96-4a2c-a707-d9b9a7f7792b
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.AC
+* PR.DS
+* DE.AE
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -50,7 +108,7 @@ This search looks for AssumeRole events where an IAM role in a different account
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `aws_cross_account_activity_from_previously_unseen_account_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **aws_cross_account_activity_from_previously_unseen_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Lookups
The SPL above uses the following Lookups:
@@ -76,9 +134,6 @@ Using multiple AWS accounts and roles is perfectly valid behavior. It's suspicio
* [Suspicious Cloud Authentication Activities](/stories/suspicious_cloud_authentication_activities)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -88,13 +143,11 @@ Using multiple AWS accounts and roles is perfectly valid behavior. It's suspicio
| 15.0 | 30 | 50 | AWS account $requestingAccountId$ is trying to access resource from some other account $requestedAccountId$, for the first time. |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-05-28-detect_aws_console_login_by_new_user.md b/docs/_posts/2020-05-28-detect_aws_console_login_by_new_user.md
index b40d06a56c..30b0dc8279 100644
--- a/docs/_posts/2020-05-28-detect_aws_console_login_by_new_user.md
+++ b/docs/_posts/2020-05-28-detect_aws_console_login_by_new_user.md
@@ -21,14 +21,71 @@ tags:
This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Authentication](https://docs.splunk.com/Documentation/CIM/latest/User/Authentication)
-
- **Last Updated**: 2020-05-28
- **Author**: Rico Valdez, Splunk
- **ID**: bc91a8cd-35e7-4bb2-6140-e756cc46fd71
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.DP
+* DE.AE
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -48,7 +105,7 @@ This search looks for AWS CloudTrail events wherein a console login event by a u
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_aws_console_login_by_new_user_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_aws_console_login_by_new_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Lookups
The SPL above uses the following Lookups:
@@ -71,9 +128,6 @@ When a legitimate new user logins for the first time, this activity will be dete
* [Suspicious Cloud Authentication Activities](/stories/suspicious_cloud_authentication_activities)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -83,13 +137,11 @@ When a legitimate new user logins for the first time, this activity will be dete
| 30.0 | 50 | 60 | User $user$ is logging into the AWS console for the first time |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-06-23-aws_eks_kubernetes_cluster_sensitive_object_access.md b/docs/_posts/2020-06-23-aws_eks_kubernetes_cluster_sensitive_object_access.md
index d9e5c56ab1..b1337093ea 100644
--- a/docs/_posts/2020-06-23-aws_eks_kubernetes_cluster_sensitive_object_access.md
+++ b/docs/_posts/2020-06-23-aws_eks_kubernetes_cluster_sensitive_object_access.md
@@ -20,14 +20,66 @@ tags:
This search provides information on Kubernetes accounts accessing sensitve objects such as configmaps or secrets
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-06-23
- **Author**: Rod Soto, Splunk
- **ID**: 7f227943-2196-4d4d-8d6a-ac8cb308e61c
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -41,7 +93,7 @@ This search provides information on Kubernetes accounts accessing sensitve objec
The SPL above uses the following Macros:
* [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml)
-Note that `aws_eks_kubernetes_cluster_sensitive_object_access_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **aws_eks_kubernetes_cluster_sensitive_object_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -57,9 +109,6 @@ Sensitive object access is not necessarily malicious but user and object context
* [Kubernetes Sensitive Object Access Activity](/stories/kubernetes_sensitive_object_access_activity)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -69,13 +118,11 @@ Sensitive object access is not necessarily malicious but user and object context
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-06-23-kubernetes_aws_detect_most_active_service_accounts_by_pod.md b/docs/_posts/2020-06-23-kubernetes_aws_detect_most_active_service_accounts_by_pod.md
index ce40024bb8..55ea636b39 100644
--- a/docs/_posts/2020-06-23-kubernetes_aws_detect_most_active_service_accounts_by_pod.md
+++ b/docs/_posts/2020-06-23-kubernetes_aws_detect_most_active_service_accounts_by_pod.md
@@ -20,14 +20,66 @@ tags:
This search provides information on Kubernetes service accounts,accessing pods by IP address, verb and decision
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-06-23
- **Author**: Rod Soto, Splunk
- **ID**: 5b30b25d-7d32-42d8-95ca-64dfcd9076e6
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -41,7 +93,7 @@ This search provides information on Kubernetes service accounts,accessing pods b
The SPL above uses the following Macros:
* [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml)
-Note that `kubernetes_aws_detect_most_active_service_accounts_by_pod_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **kubernetes_aws_detect_most_active_service_accounts_by_pod_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -57,9 +109,6 @@ Not all service accounts interactions are malicious. Analyst must consider IP, v
* [Kubernetes Sensitive Role Activity](/stories/kubernetes_sensitive_role_activity)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -69,13 +118,11 @@ Not all service accounts interactions are malicious. Analyst must consider IP, v
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-06-23-kubernetes_aws_detect_rbac_authorization_by_account.md b/docs/_posts/2020-06-23-kubernetes_aws_detect_rbac_authorization_by_account.md
index 2c44bec2af..04dc1e5921 100644
--- a/docs/_posts/2020-06-23-kubernetes_aws_detect_rbac_authorization_by_account.md
+++ b/docs/_posts/2020-06-23-kubernetes_aws_detect_rbac_authorization_by_account.md
@@ -20,14 +20,66 @@ tags:
This search provides information on Kubernetes RBAC authorizations by accounts, this search can be modified by adding top to see both extremes of RBAC by accounts occurrences
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-06-23
- **Author**: Rod Soto, Splunk
- **ID**: de7264ed-3ed9-4fef-bb01-6eefc87cefe8
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -42,7 +94,7 @@ This search provides information on Kubernetes RBAC authorizations by accounts,
The SPL above uses the following Macros:
* [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml)
-Note that `kubernetes_aws_detect_rbac_authorization_by_account_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **kubernetes_aws_detect_rbac_authorization_by_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -58,9 +110,6 @@ Not all RBAC Authorications are malicious. RBAC authorizations can uncover malic
* [Kubernetes Sensitive Role Activity](/stories/kubernetes_sensitive_role_activity)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -70,13 +119,11 @@ Not all RBAC Authorications are malicious. RBAC authorizations can uncover malic
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-06-23-kubernetes_aws_detect_sensitive_role_access.md b/docs/_posts/2020-06-23-kubernetes_aws_detect_sensitive_role_access.md
index 3a0135a5f2..69f30eb677 100644
--- a/docs/_posts/2020-06-23-kubernetes_aws_detect_sensitive_role_access.md
+++ b/docs/_posts/2020-06-23-kubernetes_aws_detect_sensitive_role_access.md
@@ -20,14 +20,66 @@ tags:
This search provides information on Kubernetes accounts accessing sensitve objects such as configmpas or secrets
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-06-23
- **Author**: Rod Soto, Splunk
- **ID**: b6013a7b-85e0-4a45-b051-10b252d69569
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -41,7 +93,7 @@ This search provides information on Kubernetes accounts accessing sensitve objec
The SPL above uses the following Macros:
* [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml)
-Note that `kubernetes_aws_detect_sensitive_role_access_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **kubernetes_aws_detect_sensitive_role_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -57,9 +109,6 @@ Sensitive role resource access is necessary for cluster operation, however sourc
* [Kubernetes Sensitive Role Activity](/stories/kubernetes_sensitive_role_activity)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -69,13 +118,11 @@ Sensitive role resource access is necessary for cluster operation, however sourc
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-06-23-kubernetes_aws_detect_service_accounts_forbidden_failure_access.md b/docs/_posts/2020-06-23-kubernetes_aws_detect_service_accounts_forbidden_failure_access.md
index 4b8c2902a1..f25271fbc8 100644
--- a/docs/_posts/2020-06-23-kubernetes_aws_detect_service_accounts_forbidden_failure_access.md
+++ b/docs/_posts/2020-06-23-kubernetes_aws_detect_service_accounts_forbidden_failure_access.md
@@ -20,14 +20,66 @@ tags:
This search provides information on Kubernetes service accounts with failure or forbidden access status, this search can be extended by using top or rare operators to find trends or rarities in failure status, user agents, source IPs and request URI
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-06-23
- **Author**: Rod Soto, Splunk
- **ID**: a6959c57-fa8f-4277-bb86-7c32fba579d5
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -40,7 +92,7 @@ This search provides information on Kubernetes service accounts with failure or
The SPL above uses the following Macros:
* [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml)
-Note that `kubernetes_aws_detect_service_accounts_forbidden_failure_access_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **kubernetes_aws_detect_service_accounts_forbidden_failure_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -56,9 +108,6 @@ This search can give false positives as there might be inherent issues with auth
* [Kubernetes Sensitive Object Access Activity](/stories/kubernetes_sensitive_object_access_activity)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -68,13 +117,11 @@ This search can give false positives as there might be inherent issues with auth
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md b/docs/_posts/2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md
index 7f367b77da..cc32b964f1 100644
--- a/docs/_posts/2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md
+++ b/docs/_posts/2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md
@@ -22,14 +22,66 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search provides information on anonymous Kubectl calls with IP, verb namespace and object access context
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-06-23
- **Author**: Rod Soto, Splunk
- **ID**: 042a3d32-8318-4763-9679-09db2644a8f2
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -43,7 +95,7 @@ This search provides information on anonymous Kubectl calls with IP, verb namesp
The SPL above uses the following Macros:
* [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml)
-Note that `kubernetes_aws_detect_suspicious_kubectl_calls_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **kubernetes_aws_detect_suspicious_kubectl_calls_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -65,9 +117,6 @@ Kubectl calls are not malicious by nature. However source IP, verb and Object ca
* [Kubernetes Sensitive Object Access Activity](/stories/kubernetes_sensitive_object_access_activity)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -77,13 +126,11 @@ Kubectl calls are not malicious by nature. However source IP, verb and Object ca
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-06-23-kubernetes_gcp_detect_service_accounts_forbidden_failure_access.md b/docs/_posts/2020-06-23-kubernetes_gcp_detect_service_accounts_forbidden_failure_access.md
index 8a29907893..788220f545 100644
--- a/docs/_posts/2020-06-23-kubernetes_gcp_detect_service_accounts_forbidden_failure_access.md
+++ b/docs/_posts/2020-06-23-kubernetes_gcp_detect_service_accounts_forbidden_failure_access.md
@@ -20,14 +20,66 @@ tags:
This search provides information on Kubernetes service accounts with failure or forbidden access status, this search can be extended by using top or rare operators to find trends or rarities in failure status, user agents, source IPs and request URI
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-06-23
- **Author**: Rod Soto, Splunk
- **ID**: 7094808d-432a-48e7-bb3c-77e96c894f3b
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -41,7 +93,7 @@ This search provides information on Kubernetes service accounts with failure or
The SPL above uses the following Macros:
* [google_gcp_pubsub_message](https://github.com/splunk/security_content/blob/develop/macros/google_gcp_pubsub_message.yml)
-Note that `kubernetes_gcp_detect_service_accounts_forbidden_failure_access_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **kubernetes_gcp_detect_service_accounts_forbidden_failure_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -57,9 +109,6 @@ This search can give false positives as there might be inherent issues with auth
* [Kubernetes Sensitive Object Access Activity](/stories/kubernetes_sensitive_object_access_activity)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -69,13 +118,11 @@ This search can give false positives as there might be inherent issues with auth
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-03-detect_path_interception_by_creation_of_program_exe.md b/docs/_posts/2020-07-03-detect_path_interception_by_creation_of_program_exe.md
index 9f0ab55a0d..c6f67e1323 100644
--- a/docs/_posts/2020-07-03-detect_path_interception_by_creation_of_program_exe.md
+++ b/docs/_posts/2020-07-03-detect_path_interception_by_creation_of_program_exe.md
@@ -31,16 +31,21 @@ tags:
The detection Detect Path Interception By Creation Of program exe is detecting the abuse of unquoted service paths, which is a popular technique for privilege escalation.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2020-07-03
- **Author**: Patrick Bareiss, Splunk
- **ID**: cbef820c-e1ff-407f-887f-0a9240a2d477
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -48,6 +53,56 @@ The detection Detect Path Interception By Creation Of program exe is detecting t
| [T1574](https://attack.mitre.org/techniques/T1574/) | Hijack Execution Flow | Defense Evasion, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -68,10 +123,10 @@ The detection Detect Path Interception By Creation Of program exe is detecting t
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_path_interception_by_creation_of_program_exe_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_path_interception_by_creation_of_program_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -98,9 +153,6 @@ unknown
* [Windows Persistence Techniques](/stories/windows_persistence_techniques)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -110,8 +162,6 @@ unknown
| 49.0 | 70 | 70 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to perform privilege escalation by using unquoted service paths. |
-
-
#### Reference
* [https://medium.com/@SumitVerma101/windows-privilege-escalation-part-1-unquoted-service-path-c7a011a8d8ae](https://medium.com/@SumitVerma101/windows-privilege-escalation-part-1-unquoted-service-path-c7a011a8d8ae)
@@ -119,7 +169,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-06-short_lived_windows_accounts.md b/docs/_posts/2020-07-06-short_lived_windows_accounts.md
index 61bc46fad6..c53a4ec86a 100644
--- a/docs/_posts/2020-07-06-short_lived_windows_accounts.md
+++ b/docs/_posts/2020-07-06-short_lived_windows_accounts.md
@@ -27,16 +27,21 @@ tags:
This search detects accounts that were created and deleted in a short time period.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change)
-
- **Last Updated**: 2020-07-06
- **Author**: David Dorsey, Splunk
- **ID**: b25f6f62-0782-43c1-b403-083231ffd97d
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,55 @@ This search detects accounts that were created and deleted in a short time perio
| [T1136](https://attack.mitre.org/techniques/T1136/) | Create Account | Persistence |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* PR.IP
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -60,10 +114,10 @@ This search detects accounts that were created and deleted in a short time perio
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `short_lived_windows_accounts_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **short_lived_windows_accounts_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -82,9 +136,6 @@ It is possible that an administrator created and deleted an account in a short t
* [Account Monitoring and Controls](/stories/account_monitoring_and_controls)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -94,13 +145,11 @@ It is possible that an administrator created and deleted an account in a short t
| 63.0 | 70 | 90 | A user account created or delete shortly in host $dest$ |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-06-windows_event_log_cleared.md b/docs/_posts/2020-07-06-windows_event_log_cleared.md
index f5f08984b9..5fe6fe26ad 100644
--- a/docs/_posts/2020-07-06-windows_event_log_cleared.md
+++ b/docs/_posts/2020-07-06-windows_event_log_cleared.md
@@ -26,16 +26,21 @@ tags:
The following analytic utilizes Windows Security Event ID 1102 or System log event 104 to identify when a Windows event log is cleared. Note that this analytic will require tuning or restricted to specific endpoints based on criticality. During triage, based on time of day and user, determine if this was planned. If not planned, follow through with reviewing parallel alerts and other data sources to determine what else may have occurred.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-07-06
- **Author**: Rico Valdez, Michael Haag, Splunk
- **ID**: ad517544-aff9-4c96-bd99-d6eb43bfbb6a
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,61 @@ The following analytic utilizes Windows Security Event ID 1102 or System log eve
| [T1070.001](https://attack.mitre.org/techniques/T1070/001/) | Clear Windows Event Logs | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.DP
+* PR.IP
+* PR.AC
+* PR.AT
+* DE.AE
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 6
+
+
+
+
+
+
+
#### Search
```
@@ -55,11 +115,11 @@ The following analytic utilizes Windows Security Event ID 1102 or System log eve
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml)
* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `windows_event_log_cleared_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **windows_event_log_cleared_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -79,9 +139,6 @@ It is possible that these logs may be legitimately cleared by Administrators. Fi
* [Clop Ransomware](/stories/clop_ransomware)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -91,8 +148,6 @@ It is possible that these logs may be legitimately cleared by Administrators. Fi
| 70.0 | 70 | 100 | Windows event logs cleared on $dest$ via EventCode $EventCode$ |
-
-
#### Reference
* [https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-1102](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-1102)
@@ -103,7 +158,7 @@ It is possible that these logs may be legitimately cleared by Administrators. Fi
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-07-remote_desktop_network_traffic.md b/docs/_posts/2020-07-07-remote_desktop_network_traffic.md
index 09f82206e6..2eb14ff048 100644
--- a/docs/_posts/2020-07-07-remote_desktop_network_traffic.md
+++ b/docs/_posts/2020-07-07-remote_desktop_network_traffic.md
@@ -29,16 +29,21 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search looks for network traffic on TCP/3389, the default port used by remote desktop. While remote desktop traffic is not uncommon on a network, it is usually associated with known hosts. This search will ignore common RDP sources and common RDP destinations so you can focus on the uncommon uses of remote desktop on your network.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic)
-
- **Last Updated**: 2020-07-07
- **Author**: David Dorsey, Splunk
- **ID**: 272b8407-842d-4b3d-bead-a704584003d3
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,59 @@ This search looks for network traffic on TCP/3389, the default port used by remo
| [T1021](https://attack.mitre.org/techniques/T1021/) | Remote Services | Lateral Movement |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.AE
+* PR.AC
+* PR.IP
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 9
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -59,10 +117,10 @@ This search looks for network traffic on TCP/3389, the default port used by remo
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `remote_desktop_network_traffic_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **remote_desktop_network_traffic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -87,9 +145,6 @@ Remote Desktop may be used legitimately by users on the network.
* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -99,13 +154,11 @@ Remote Desktop may be used legitimately by users on the network.
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-08-detect_new_local_admin_account.md b/docs/_posts/2020-07-08-detect_new_local_admin_account.md
index 2692f48711..052f8233cd 100644
--- a/docs/_posts/2020-07-08-detect_new_local_admin_account.md
+++ b/docs/_posts/2020-07-08-detect_new_local_admin_account.md
@@ -26,16 +26,21 @@ tags:
This search looks for newly created accounts that have been elevated to local administrators.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-07-08
- **Author**: David Dorsey, Splunk
- **ID**: b25f6f62-0712-43c1-b203-083231ffd97d
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,57 @@ This search looks for newly created accounts that have been elevated to local ad
| [T1136](https://attack.mitre.org/techniques/T1136/) | Create Account | Persistence |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+* Command & Control
+
+
+
+
+
+
+NIST
+ +
+
+* PR.AC
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +113,10 @@ This search looks for newly created accounts that have been elevated to local ad
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_new_local_admin_account_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_new_local_admin_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -82,10 +138,6 @@ The activity may be legitimate. For this reason, it's best to verify the account
* [HAFNIUM Group](/stories/hafnium_group)
-#### Kill Chain Phase
-* Actions on Objectives
-* Command & Control
-
#### RBA
@@ -95,13 +147,11 @@ The activity may be legitimate. For this reason, it's best to verify the account
| 42.0 | 60 | 70 | A $user$ on $dest$ was added recently. Identify if this was legitimate behavior or not. |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-10-kubernetes_gcp_detect_most_active_service_accounts_by_pod.md b/docs/_posts/2020-07-10-kubernetes_gcp_detect_most_active_service_accounts_by_pod.md
index eef2483788..67e134b92b 100644
--- a/docs/_posts/2020-07-10-kubernetes_gcp_detect_most_active_service_accounts_by_pod.md
+++ b/docs/_posts/2020-07-10-kubernetes_gcp_detect_most_active_service_accounts_by_pod.md
@@ -20,14 +20,66 @@ tags:
This search provides information on Kubernetes service accounts,accessing pods by IP address, verb and decision
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-07-10
- **Author**: Rod Soto, Splunk
- **ID**: 7f5c2779-88a0-4824-9caa-0f606c8f260f
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -41,7 +93,7 @@ This search provides information on Kubernetes service accounts,accessing pods b
The SPL above uses the following Macros:
* [google_gcp_pubsub_message](https://github.com/splunk/security_content/blob/develop/macros/google_gcp_pubsub_message.yml)
-Note that `kubernetes_gcp_detect_most_active_service_accounts_by_pod_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **kubernetes_gcp_detect_most_active_service_accounts_by_pod_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -57,9 +109,6 @@ Not all service accounts interactions are malicious. Analyst must consider IP, v
* [Kubernetes Sensitive Role Activity](/stories/kubernetes_sensitive_role_activity)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -69,13 +118,11 @@ Not all service accounts interactions are malicious. Analyst must consider IP, v
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-11-kubernetes_gcp_detect_rbac_authorizations_by_account.md b/docs/_posts/2020-07-11-kubernetes_gcp_detect_rbac_authorizations_by_account.md
index a5ac453246..6082cd709b 100644
--- a/docs/_posts/2020-07-11-kubernetes_gcp_detect_rbac_authorizations_by_account.md
+++ b/docs/_posts/2020-07-11-kubernetes_gcp_detect_rbac_authorizations_by_account.md
@@ -20,14 +20,66 @@ tags:
This search provides information on Kubernetes RBAC authorizations by accounts, this search can be modified by adding top to see both extremes of RBAC by accounts occurrences
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-07-11
- **Author**: Rod Soto, Splunk
- **ID**: 99487de3-7192-4b41-939d-fbe9acfb1340
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -41,7 +93,7 @@ This search provides information on Kubernetes RBAC authorizations by accounts,
The SPL above uses the following Macros:
* [google_gcp_pubsub_message](https://github.com/splunk/security_content/blob/develop/macros/google_gcp_pubsub_message.yml)
-Note that `kubernetes_gcp_detect_rbac_authorizations_by_account_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **kubernetes_gcp_detect_rbac_authorizations_by_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -57,9 +109,6 @@ Not all RBAC Authorications are malicious. RBAC authorizations can uncover malic
* [Kubernetes Sensitive Role Activity](/stories/kubernetes_sensitive_role_activity)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -69,13 +118,11 @@ Not all RBAC Authorications are malicious. RBAC authorizations can uncover malic
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-11-kubernetes_gcp_detect_sensitive_object_access.md b/docs/_posts/2020-07-11-kubernetes_gcp_detect_sensitive_object_access.md
index 99bdfea5c5..5103eaf88e 100644
--- a/docs/_posts/2020-07-11-kubernetes_gcp_detect_sensitive_object_access.md
+++ b/docs/_posts/2020-07-11-kubernetes_gcp_detect_sensitive_object_access.md
@@ -20,14 +20,66 @@ tags:
This search provides information on Kubernetes accounts accessing sensitve objects such as configmaps or secrets
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-07-11
- **Author**: Rod Soto, Splunk
- **ID**: bdb6d596-86a0-4aba-8369-418ae8b9963a
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -41,7 +93,7 @@ This search provides information on Kubernetes accounts accessing sensitve objec
The SPL above uses the following Macros:
* [google_gcp_pubsub_message](https://github.com/splunk/security_content/blob/develop/macros/google_gcp_pubsub_message.yml)
-Note that `kubernetes_gcp_detect_sensitive_object_access_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **kubernetes_gcp_detect_sensitive_object_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -57,9 +109,6 @@ Sensitive object access is not necessarily malicious but user and object context
* [Kubernetes Sensitive Object Access Activity](/stories/kubernetes_sensitive_object_access_activity)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -69,13 +118,11 @@ Sensitive object access is not necessarily malicious but user and object context
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-11-kubernetes_gcp_detect_sensitive_role_access.md b/docs/_posts/2020-07-11-kubernetes_gcp_detect_sensitive_role_access.md
index 5cdf527055..28918e2e81 100644
--- a/docs/_posts/2020-07-11-kubernetes_gcp_detect_sensitive_role_access.md
+++ b/docs/_posts/2020-07-11-kubernetes_gcp_detect_sensitive_role_access.md
@@ -20,14 +20,66 @@ tags:
This search provides information on Kubernetes accounts accessing sensitve objects such as configmpas or secrets
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-07-11
- **Author**: Rod Soto, Splunk
- **ID**: a46923f6-36b9-4806-a681-31f314907c30
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -41,7 +93,7 @@ This search provides information on Kubernetes accounts accessing sensitve objec
The SPL above uses the following Macros:
* [google_gcp_pubsub_message](https://github.com/splunk/security_content/blob/develop/macros/google_gcp_pubsub_message.yml)
-Note that `kubernetes_gcp_detect_sensitive_role_access_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **kubernetes_gcp_detect_sensitive_role_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -57,9 +109,6 @@ Sensitive role resource access is necessary for cluster operation, however sourc
* [Kubernetes Sensitive Role Activity](/stories/kubernetes_sensitive_role_activity)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -69,13 +118,11 @@ Sensitive role resource access is necessary for cluster operation, however sourc
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-11-kubernetes_gcp_detect_suspicious_kubectl_calls.md b/docs/_posts/2020-07-11-kubernetes_gcp_detect_suspicious_kubectl_calls.md
index 445921b118..b56454d131 100644
--- a/docs/_posts/2020-07-11-kubernetes_gcp_detect_suspicious_kubectl_calls.md
+++ b/docs/_posts/2020-07-11-kubernetes_gcp_detect_suspicious_kubectl_calls.md
@@ -20,14 +20,66 @@ tags:
This search provides information on anonymous Kubectl calls with IP, verb namespace and object access context
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-07-11
- **Author**: Rod Soto, Splunk
- **ID**: a5bed417-070a-41f2-a1e4-82b6aa281557
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -41,7 +93,7 @@ This search provides information on anonymous Kubectl calls with IP, verb namesp
The SPL above uses the following Macros:
* [google_gcp_pubsub_message](https://github.com/splunk/security_content/blob/develop/macros/google_gcp_pubsub_message.yml)
-Note that `kubernetes_gcp_detect_suspicious_kubectl_calls_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **kubernetes_gcp_detect_suspicious_kubectl_calls_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -57,9 +109,6 @@ Kubectl calls are not malicious by nature. However source IP, source user, user
* [Kubernetes Sensitive Object Access Activity](/stories/kubernetes_sensitive_object_access_activity)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -69,13 +118,11 @@ Kubectl calls are not malicious by nature. However source IP, source user, user
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md b/docs/_posts/2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md
index 38fe9489e4..41ae84659d 100644
--- a/docs/_posts/2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md
+++ b/docs/_posts/2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md
@@ -25,21 +25,71 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search provides information of unauthenticated requests via user agent, and authentication data against Kubernetes cluster's pods
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-07-17
- **Author**: Rod Soto, Splunk
- **ID**: 19b53215-4a16-405b-8087-9e6acf619842
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1526](https://attack.mitre.org/techniques/T1526/) | Cloud Service Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -54,7 +104,7 @@ This search provides information of unauthenticated requests via user agent, and
The SPL above uses the following Macros:
* [google_gcp_pubsub_message](https://github.com/splunk/security_content/blob/develop/macros/google_gcp_pubsub_message.yml)
-Note that `gcp_kubernetes_cluster_pod_scan_detection_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **gcp_kubernetes_cluster_pod_scan_detection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -78,9 +128,6 @@ Not all unauthenticated requests are malicious, but frequency, User Agent, sourc
* [Kubernetes Scanning Activity](/stories/kubernetes_scanning_activity)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -90,13 +137,11 @@ Not all unauthenticated requests are malicious, but frequency, User Agent, sourc
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-21-abnormally_high_aws_instances_launched_by_user.md b/docs/_posts/2020-07-21-abnormally_high_aws_instances_launched_by_user.md
index e0809c9729..1509071b4b 100644
--- a/docs/_posts/2020-07-21-abnormally_high_aws_instances_launched_by_user.md
+++ b/docs/_posts/2020-07-21-abnormally_high_aws_instances_launched_by_user.md
@@ -26,21 +26,76 @@ tags:
This search looks for AWS CloudTrail events where a user successfully launches an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-07-21
- **Author**: Bhavin Patel, Splunk
- **ID**: 2a9b80d3-6340-4345-b5ad-290bf5d0dac4
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1078.004](https://attack.mitre.org/techniques/T1078/004/) | Cloud Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.DP
+* DE.AE
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 13
+
+
+
+
+
+
+
#### Search
```
@@ -60,7 +115,7 @@ This search looks for AWS CloudTrail events where a user successfully launches a
The SPL above uses the following Macros:
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
-Note that `abnormally_high_aws_instances_launched_by_user_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **abnormally_high_aws_instances_launched_by_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -80,9 +135,6 @@ Many service accounts configured within an AWS infrastructure are known to exhib
* [Suspicious AWS EC2 Activities](/stories/suspicious_aws_ec2_activities)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -92,13 +144,11 @@ Many service accounts configured within an AWS infrastructure are known to exhib
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-21-abnormally_high_aws_instances_launched_by_user_-_mltk.md b/docs/_posts/2020-07-21-abnormally_high_aws_instances_launched_by_user_-_mltk.md
index 26fcda1342..d421f248a0 100644
--- a/docs/_posts/2020-07-21-abnormally_high_aws_instances_launched_by_user_-_mltk.md
+++ b/docs/_posts/2020-07-21-abnormally_high_aws_instances_launched_by_user_-_mltk.md
@@ -26,21 +26,76 @@ tags:
This search looks for AWS CloudTrail events where a user successfully launches an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-07-21
- **Author**: Jason Brewer, Splunk
- **ID**: dec41ad5-d579-42cb-b4c6-f5dbb778bbe5
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1078.004](https://attack.mitre.org/techniques/T1078/004/) | Cloud Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.DP
+* DE.AE
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 13
+
+
+
+
+
+
+
#### Search
```
@@ -56,7 +111,7 @@ This search looks for AWS CloudTrail events where a user successfully launches a
The SPL above uses the following Macros:
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
-Note that `abnormally_high_aws_instances_launched_by_user_-_mltk_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **abnormally_high_aws_instances_launched_by_user_-_mltk_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -76,9 +131,6 @@ Many service accounts configured within an AWS infrastructure are known to exhib
* [Suspicious AWS EC2 Activities](/stories/suspicious_aws_ec2_activities)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -88,13 +140,11 @@ Many service accounts configured within an AWS infrastructure are known to exhib
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-21-abnormally_high_aws_instances_terminated_by_user.md b/docs/_posts/2020-07-21-abnormally_high_aws_instances_terminated_by_user.md
index a6673a6d64..bf95af286e 100644
--- a/docs/_posts/2020-07-21-abnormally_high_aws_instances_terminated_by_user.md
+++ b/docs/_posts/2020-07-21-abnormally_high_aws_instances_terminated_by_user.md
@@ -26,21 +26,76 @@ tags:
This search looks for AWS CloudTrail events where an abnormally high number of instances were successfully terminated by a user in a 10-minute window. This search is deprecated and have been translated to use the latest Change Datamodel.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-07-21
- **Author**: Bhavin Patel, Splunk
- **ID**: 8d301246-fccf-45e2-a8e7-3655fd14379c
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1078.004](https://attack.mitre.org/techniques/T1078/004/) | Cloud Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.DP
+* DE.AE
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 13
+
+
+
+
+
+
+
#### Search
```
@@ -60,7 +115,7 @@ This search looks for AWS CloudTrail events where an abnormally high number of i
The SPL above uses the following Macros:
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
-Note that `abnormally_high_aws_instances_terminated_by_user_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **abnormally_high_aws_instances_terminated_by_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -79,9 +134,6 @@ Many service accounts configured with your AWS infrastructure are known to exhib
* [Suspicious AWS EC2 Activities](/stories/suspicious_aws_ec2_activities)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -91,13 +143,11 @@ Many service accounts configured with your AWS infrastructure are known to exhib
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-21-abnormally_high_aws_instances_terminated_by_user_-_mltk.md b/docs/_posts/2020-07-21-abnormally_high_aws_instances_terminated_by_user_-_mltk.md
index 71f213dc1c..234156fdbb 100644
--- a/docs/_posts/2020-07-21-abnormally_high_aws_instances_terminated_by_user_-_mltk.md
+++ b/docs/_posts/2020-07-21-abnormally_high_aws_instances_terminated_by_user_-_mltk.md
@@ -26,21 +26,76 @@ tags:
This search looks for AWS CloudTrail events where a user successfully terminates an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-07-21
- **Author**: Jason Brewer, Splunk
- **ID**: 1c02b86a-cd85-473e-a50b-014a9ac8fe3e
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1078.004](https://attack.mitre.org/techniques/T1078/004/) | Cloud Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.DP
+* DE.AE
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 13
+
+
+
+
+
+
+
#### Search
```
@@ -56,7 +111,7 @@ This search looks for AWS CloudTrail events where a user successfully terminates
The SPL above uses the following Macros:
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
-Note that `abnormally_high_aws_instances_terminated_by_user_-_mltk_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **abnormally_high_aws_instances_terminated_by_user_-_mltk_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -75,9 +130,6 @@ Many service accounts configured within an AWS infrastructure are known to exhib
* [Suspicious AWS EC2 Activities](/stories/suspicious_aws_ec2_activities)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -87,13 +139,11 @@ Many service accounts configured within an AWS infrastructure are known to exhib
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-21-attempt_to_stop_security_service.md b/docs/_posts/2020-07-21-attempt_to_stop_security_service.md
index 2e95a9e912..a246fb3df8 100644
--- a/docs/_posts/2020-07-21-attempt_to_stop_security_service.md
+++ b/docs/_posts/2020-07-21-attempt_to_stop_security_service.md
@@ -27,16 +27,21 @@ tags:
This search looks for attempts to stop security-related services on the endpoint.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2020-07-21
- **Author**: Rico Valdez, Splunk
- **ID**: c8e349c6-b97c-486e-8949-bd7bcd1f3910
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,60 @@ This search looks for attempts to stop security-related services on the endpoint
| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Installation
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+* PR.IP
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -59,11 +118,11 @@ This search looks for attempts to stop security-related services on the endpoint
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `attempt_to_stop_security_service_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **attempt_to_stop_security_service_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Lookups
The SPL above uses the following Lookups:
@@ -97,10 +156,6 @@ None identified. Attempts to disable security-related services should be identif
* [WhisperGate](/stories/whispergate)
-#### Kill Chain Phase
-* Installation
-* Actions on Objectives
-
#### RBA
@@ -110,8 +165,6 @@ None identified. Attempts to disable security-related services should be identif
| 20.0 | 40 | 50 | An instance of $parent_process_name$ spawning $process_name$ was identified attempting to disable security services on endpoint $dest$ by user $user$. |
-
-
#### Reference
* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-14---disable-arbitrary-security-windows-service](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-14---disable-arbitrary-security-windows-service)
@@ -120,7 +173,7 @@ None identified. Attempts to disable security-related services should be identif
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-21-clients_connecting_to_multiple_dns_servers.md b/docs/_posts/2020-07-21-clients_connecting_to_multiple_dns_servers.md
index 03fc8f599e..3658556087 100644
--- a/docs/_posts/2020-07-21-clients_connecting_to_multiple_dns_servers.md
+++ b/docs/_posts/2020-07-21-clients_connecting_to_multiple_dns_servers.md
@@ -24,21 +24,79 @@ tags:
This search allows you to identify the endpoints that have connected to more than five DNS servers and made DNS Queries over the time frame of the search.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Network_Resolution](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkResolution)
-
- **Last Updated**: 2020-07-21
- **Author**: David Dorsey, Splunk
- **ID**: 74ec6f18-604b-4202-a567-86b2066be3ce
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1048.003](https://attack.mitre.org/techniques/T1048/003/) | Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol | Exfiltration |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Command & Control
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.AE
+* PR.DS
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 9
+* CIS 12
+* CIS 13
+
+
+
+
+
+
+
#### Search
```
@@ -53,7 +111,7 @@ This search allows you to identify the endpoints that have connected to more tha
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `clients_connecting_to_multiple_dns_servers_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **clients_connecting_to_multiple_dns_servers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -77,9 +135,6 @@ It's possible that an enterprise has more than five DNS servers that are configu
* [Command and Control](/stories/command_and_control)
-#### Kill Chain Phase
-* Command & Control
-
#### RBA
@@ -89,13 +144,11 @@ It's possible that an enterprise has more than five DNS servers that are configu
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-21-detect_aws_api_activities_from_unapproved_accounts.md b/docs/_posts/2020-07-21-detect_aws_api_activities_from_unapproved_accounts.md
index 15845099a2..6060e39577 100644
--- a/docs/_posts/2020-07-21-detect_aws_api_activities_from_unapproved_accounts.md
+++ b/docs/_posts/2020-07-21-detect_aws_api_activities_from_unapproved_accounts.md
@@ -26,21 +26,78 @@ tags:
This search looks for successful AWS CloudTrail activity by user accounts that are not listed in the identity table or `aws_service_accounts.csv`. It returns event names and count, as well as the first and last time a specific user or service is detected, grouped by users. Deprecated because managing this list can be quite hard.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-07-21
- **Author**: Bhavin Patel, Splunk
- **ID**: ada0f478-84a8-4641-a3f1-d82362d4bd55
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1078.004](https://attack.mitre.org/techniques/T1078/004/) | Cloud Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.DP
+* DE.CM
+* PR.AC
+* ID.AM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -61,10 +118,10 @@ This search looks for successful AWS CloudTrail activity by user accounts that a
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_aws_api_activities_from_unapproved_accounts_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_aws_api_activities_from_unapproved_accounts_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Lookups
The SPL above uses the following Lookups:
@@ -95,9 +152,6 @@ It's likely that you'll find activity detected by users/service accounts that ar
* [AWS User Monitoring](/stories/aws_user_monitoring)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -107,13 +161,11 @@ It's likely that you'll find activity detected by users/service accounts that ar
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md b/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md
index b467c88fbf..50b9b087cf 100644
--- a/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md
+++ b/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md
@@ -24,21 +24,81 @@ tags:
This search looks for DNS requests for phishing domains that are leveraging EvilGinx tools to mimic websites.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Network_Resolution](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkResolution)
-
- **Last Updated**: 2020-07-21
- **Author**: Bhavin Patel, Splunk
- **ID**: 24dd17b1-e2fb-4c31-878c-d4f226595bfa
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1566.003](https://attack.mitre.org/techniques/T1566/003/) | Spearphishing via Service | Initial Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Delivery
+* Command & Control
+
+
+
+
+
+
+NIST
+ +
+
+* ID.AM
+* PR.DS
+* PR.IP
+* DE.AE
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+* CIS 7
+
+
+
+
+
+
+
#### Search
```
@@ -63,16 +123,16 @@ This search looks for DNS requests for phishing domains that are leveraging Evil
#### Macros
The SPL above uses the following Macros:
-* [evilginx_phishlets_aws](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_aws.yml)
-* [evilginx_phishlets_github](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_github.yml)
-* [evilginx_phishlets_outlook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_outlook.yml)
-* [evilginx_phishlets_amazon](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_amazon.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [evilginx_phishlets_0365](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_0365.yml)
+* [evilginx_phishlets_aws](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_aws.yml)
* [evilginx_phishlets_facebook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_facebook.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [evilginx_phishlets_amazon](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_amazon.yml)
+* [evilginx_phishlets_outlook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_outlook.yml)
* [evilginx_phishlets_google](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_google.yml)
+* [evilginx_phishlets_github](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_github.yml)
-Note that `detect_dns_requests_to_phishing_sites_leveraging_evilginx2_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_dns_requests_to_phishing_sites_leveraging_evilginx2_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -97,10 +157,6 @@ If a known good domain is not listed in the legit_domains.csv file, then the sea
* [Common Phishing Frameworks](/stories/common_phishing_frameworks)
-#### Kill Chain Phase
-* Delivery
-* Command & Control
-
#### RBA
@@ -110,13 +166,11 @@ If a known good domain is not listed in the legit_domains.csv file, then the sea
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-21-detect_excessive_user_account_lockouts.md b/docs/_posts/2020-07-21-detect_excessive_user_account_lockouts.md
index f7f28ab6d9..b18dc909c4 100644
--- a/docs/_posts/2020-07-21-detect_excessive_user_account_lockouts.md
+++ b/docs/_posts/2020-07-21-detect_excessive_user_account_lockouts.md
@@ -33,16 +33,21 @@ tags:
This search detects user accounts that have been locked out a relatively high number of times in a short period.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change)
-
- **Last Updated**: 2020-07-21
- **Author**: David Dorsey, Splunk
- **ID**: 95a7f9a5-6096-437e-a19e-86f42ac609bd
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -50,6 +55,55 @@ This search detects user accounts that have been locked out a relatively high nu
| [T1078.003](https://attack.mitre.org/techniques/T1078/003/) | Local Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* PR.IP
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -65,10 +119,10 @@ This search detects user accounts that have been locked out a relatively high nu
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_excessive_user_account_lockouts_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_excessive_user_account_lockouts_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -87,9 +141,6 @@ It is possible that a legitimate user is experiencing an issue causing multiple
* [Account Monitoring and Controls](/stories/account_monitoring_and_controls)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -99,13 +150,11 @@ It is possible that a legitimate user is experiencing an issue causing multiple
| 36.0 | 60 | 60 | Multiple accounts have been locked out. Review $nodename$ and $result$ related to $user$. |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-21-detect_long_dns_txt_record_response.md b/docs/_posts/2020-07-21-detect_long_dns_txt_record_response.md
index 40a7662317..6e06cf8484 100644
--- a/docs/_posts/2020-07-21-detect_long_dns_txt_record_response.md
+++ b/docs/_posts/2020-07-21-detect_long_dns_txt_record_response.md
@@ -24,21 +24,80 @@ tags:
This search is used to detect attempts to use DNS tunneling, by calculating the length of responses to DNS TXT queries. Endpoints using DNS as a method of transmission for data exfiltration, command and control, or evasion of security controls can often be detected by noting unusually large volumes of DNS traffic. Deprecated because this detection should focus on DNS queries instead of DNS responses.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Network_Resolution](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkResolution)
-
- **Last Updated**: 2020-07-21
- **Author**: Rico Valdez, Splunk
- **ID**: 05437c07-62f5-452e-afdc-04dd44815bb9
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1048.003](https://attack.mitre.org/techniques/T1048/003/) | Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol | Exfiltration |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Command & Control
+
+
+
+
+
+
+NIST
+ +
+
+* PR.DS
+* PR.PT
+* DE.AE
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+* CIS 12
+* CIS 13
+
+
+
+
+
+
+
#### Search
```
@@ -56,10 +115,10 @@ This search is used to detect attempts to use DNS tunneling, by calculating the
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_long_dns_txt_record_response_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_long_dns_txt_record_response_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -81,9 +140,6 @@ It's possible that legitimate TXT record responses can be long enough to trigger
* [Command and Control](/stories/command_and_control)
-#### Kill Chain Phase
-* Command & Control
-
#### RBA
@@ -93,13 +149,11 @@ It's possible that legitimate TXT record responses can be long enough to trigger
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-21-detect_new_user_aws_console_login.md b/docs/_posts/2020-07-21-detect_new_user_aws_console_login.md
index df080df3c3..9a11a10b9e 100644
--- a/docs/_posts/2020-07-21-detect_new_user_aws_console_login.md
+++ b/docs/_posts/2020-07-21-detect_new_user_aws_console_login.md
@@ -26,21 +26,76 @@ tags:
This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour. Deprecated now this search is updated to use the Authentication datamodel.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-07-21
- **Author**: Bhavin Patel, Splunk
- **ID**: ada0f478-84a8-4641-a3f3-d82362dffd75
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1078.004](https://attack.mitre.org/techniques/T1078/004/) | Cloud Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.DP
+* DE.AE
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -58,10 +113,10 @@ This search looks for AWS CloudTrail events wherein a console login event by a u
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_new_user_aws_console_login_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_new_user_aws_console_login_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -79,9 +134,6 @@ When a legitimate new user logins for the first time, this activity will be dete
* [Suspicious AWS Login Activities](/stories/suspicious_aws_login_activities)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -91,13 +143,11 @@ When a legitimate new user logins for the first time, this activity will be dete
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md b/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md
index 1fdb31776a..912387e432 100644
--- a/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md
+++ b/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md
@@ -29,16 +29,21 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search looks for outbound SMB connections made by hosts within your network to the Internet. SMB traffic is used for Windows file-sharing activity. One of the techniques often used by attackers involves retrieving the credential hash using an SMB request made to a compromised server controlled by the threat actor.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic)
-
- **Last Updated**: 2020-07-21
- **Author**: Bhavin Patel, Stuart Hopkins from Splunk
- **ID**: 1bed7774-304a-4e8f-9d72-d80e45ff492b
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,56 @@ This search looks for outbound SMB connections made by hosts within your network
| [T1071](https://attack.mitre.org/techniques/T1071/) | Application Layer Protocol | Command And Control |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+* Command & Control
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 12
+
+
+
+
+
+
+
#### Search
```
@@ -59,10 +114,10 @@ This search looks for outbound SMB connections made by hosts within your network
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_outbound_smb_traffic_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_outbound_smb_traffic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -87,10 +142,6 @@ It is likely that the outbound Server Message Block (SMB) traffic is legitimate,
* [NOBELIUM Group](/stories/nobelium_group)
-#### Kill Chain Phase
-* Actions on Objectives
-* Command & Control
-
#### RBA
@@ -100,13 +151,11 @@ It is likely that the outbound Server Message Block (SMB) traffic is legitimate,
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md b/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md
index 64510a081a..8dc1096616 100644
--- a/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md
+++ b/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md
@@ -28,16 +28,21 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search looks for execution of process `outlook.exe` where the process is writing a `.zip` file to the disk.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-07-21
- **Author**: Bhavin Patel, Splunk
- **ID**: a51bfe1a-94f0-4822-b1e4-16ae10145893
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -45,6 +50,58 @@ This search looks for execution of process `outlook.exe` where the process is wr
| [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Installation
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* ID.AM
+* PR.DS
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 7
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -69,10 +126,10 @@ This search looks for execution of process `outlook.exe` where the process is wr
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_outlook_exe_writing_a_zip_file_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_outlook_exe_writing_a_zip_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -94,10 +151,6 @@ It is not uncommon for outlook to write legitimate zip files to the disk.
* [Spearphishing Attachments](/stories/spearphishing_attachments)
-#### Kill Chain Phase
-* Installation
-* Actions on Objectives
-
#### RBA
@@ -107,13 +160,11 @@ It is not uncommon for outlook to write legitimate zip files to the disk.
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-21-detect_spike_in_aws_api_activity.md b/docs/_posts/2020-07-21-detect_spike_in_aws_api_activity.md
index 32f34d7548..85a7a482f1 100644
--- a/docs/_posts/2020-07-21-detect_spike_in_aws_api_activity.md
+++ b/docs/_posts/2020-07-21-detect_spike_in_aws_api_activity.md
@@ -26,21 +26,77 @@ tags:
This search will detect users creating spikes of API activity in your AWS environment. It will also update the cache file that factors in the latest data. This search is deprecated and have been translated to use the latest Change Datamodel.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-07-21
- **Author**: David Dorsey, Splunk
- **ID**: ada0f478-84a8-4641-a3f1-d32362d4bd55
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1078.004](https://attack.mitre.org/techniques/T1078/004/) | Cloud Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.DP
+* DE.CM
+* PR.AC
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -70,7 +126,7 @@ This search will detect users creating spikes of API activity in your AWS enviro
The SPL above uses the following Macros:
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
-Note that `detect_spike_in_aws_api_activity_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_spike_in_aws_api_activity_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Lookups
The SPL above uses the following Lookups:
@@ -100,9 +156,6 @@ Detailed documentation on how to create a new field within Incident Review may b
* [AWS User Monitoring](/stories/aws_user_monitoring)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -112,13 +165,11 @@ Detailed documentation on how to create a new field within Incident Review may b
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md b/docs/_posts/2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md
index d52dbb470d..f8f3d5e76a 100644
--- a/docs/_posts/2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md
+++ b/docs/_posts/2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md
@@ -27,16 +27,21 @@ tags:
This search looks for the execution of the cscript.exe or wscript.exe processes, with a parent of cmd.exe. The search will return the count, the first and last time this execution was seen on a machine, the user, and the destination of the machine
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2020-07-21
- **Author**: Bhavin Patel, Mauricio Velazco, Splunk
- **ID**: b89919ed-fe5f-492c-b139-95dbb162039e
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,56 @@ This search looks for the execution of the cscript.exe or wscript.exe processes,
| [T1059.003](https://attack.mitre.org/techniques/T1059/003/) | Windows Command Shell | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +112,10 @@ This search looks for the execution of the cscript.exe or wscript.exe processes,
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_use_of_cmd_exe_to_launch_script_interpreters_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_use_of_cmd_exe_to_launch_script_interpreters_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -83,9 +138,6 @@ Some legitimate applications may exhibit this behavior.
* [Suspicious Command-Line Executions](/stories/suspicious_command-line_executions)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -95,13 +147,11 @@ Some legitimate applications may exhibit this behavior.
| 35.0 | 70 | 50 | cmd.exe launching script interpreters on $dest$ |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-21-detect_web_traffic_to_dynamic_domain_providers.md b/docs/_posts/2020-07-21-detect_web_traffic_to_dynamic_domain_providers.md
index 6bc1aa8272..b4679c36b8 100644
--- a/docs/_posts/2020-07-21-detect_web_traffic_to_dynamic_domain_providers.md
+++ b/docs/_posts/2020-07-21-detect_web_traffic_to_dynamic_domain_providers.md
@@ -24,21 +24,78 @@ tags:
This search looks for web connections to dynamic DNS providers.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Web](https://docs.splunk.com/Documentation/CIM/latest/User/Web)
-
- **Last Updated**: 2020-07-21
- **Author**: Bhavin Patel, Splunk
- **ID**: 134da869-e264-4a8f-8d7e-fcd01c18f301
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1071.001](https://attack.mitre.org/techniques/T1071/001/) | Web Protocols | Command And Control |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Command & Control
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.IP
+* DE.DP
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 7
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -52,11 +109,11 @@ This search looks for web connections to dynamic DNS providers.
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [dynamic_dns_web_traffic](https://github.com/splunk/security_content/blob/develop/macros/dynamic_dns_web_traffic.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_web_traffic_to_dynamic_domain_providers_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_web_traffic_to_dynamic_domain_providers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -78,10 +135,6 @@ It is possible that list of dynamic DNS providers is outdated and/or that the UR
* [Dynamic DNS](/stories/dynamic_dns)
-#### Kill Chain Phase
-* Command & Control
-* Actions on Objectives
-
#### RBA
@@ -91,13 +144,11 @@ It is possible that list of dynamic DNS providers is outdated and/or that the UR
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md b/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md
index 9905b1d349..f57c3c016a 100644
--- a/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md
+++ b/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md
@@ -27,21 +27,76 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search looks for specific command-line arguments that may indicate the execution of tools made by Nirsoft, which are legitimate, but may be abused by attackers.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2020-07-21
- **Author**: Bhavin Patel, Splunk
- **ID**: 3d8d201c-aa03-422d-b0ee-2e5ecf9718c0
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1072](https://attack.mitre.org/techniques/T1072/) | Software Deployment Tools | Execution, Lateral Movement |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Installation
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.IP
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+
+
+
+
+
+
+
#### Search
```
@@ -55,10 +110,10 @@ This search looks for specific command-line arguments that may indicate the exec
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detection_of_tools_built_by_nirsoft_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detection_of_tools_built_by_nirsoft_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -78,10 +133,6 @@ While legitimate, these NirSoft tools are prone to abuse. You should verfiy that
* [Emotet Malware DHS Report TA18-201A ](/stories/emotet_malware__dhs_report_ta18-201a_)
-#### Kill Chain Phase
-* Installation
-* Actions on Objectives
-
#### RBA
@@ -91,13 +142,11 @@ While legitimate, these NirSoft tools are prone to abuse. You should verfiy that
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-21-dns_query_requests_resolved_by_unauthorized_dns_servers.md b/docs/_posts/2020-07-21-dns_query_requests_resolved_by_unauthorized_dns_servers.md
index 3eb8b2efc4..fc3e11fff9 100644
--- a/docs/_posts/2020-07-21-dns_query_requests_resolved_by_unauthorized_dns_servers.md
+++ b/docs/_posts/2020-07-21-dns_query_requests_resolved_by_unauthorized_dns_servers.md
@@ -24,21 +24,82 @@ tags:
This search will detect DNS requests resolved by unauthorized DNS servers. Legitimate DNS servers should be identified in the Enterprise Security Assets and Identity Framework.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Network_Resolution](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkResolution)
-
- **Last Updated**: 2020-07-21
- **Author**: Bhavin Patel, Splunk
- **ID**: 1a67f15a-f4ff-4170-84e9-08cf6f75d6f6
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1071.004](https://attack.mitre.org/techniques/T1071/004/) | DNS | Command And Control |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Command & Control
+
+
+
+
+
+
+NIST
+ +
+
+* ID.AM
+* PR.DS
+* PR.IP
+* DE.AE
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 1
+* CIS 3
+* CIS 8
+* CIS 12
+
+
+
+
+
+
+
#### Search
```
@@ -52,7 +113,7 @@ This search will detect DNS requests resolved by unauthorized DNS servers. Legit
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `dns_query_requests_resolved_by_unauthorized_dns_servers_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **dns_query_requests_resolved_by_unauthorized_dns_servers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -75,9 +136,6 @@ Legitimate DNS activity can be detected in this search. Investigate, verify and
* [Command and Control](/stories/command_and_control)
-#### Kill Chain Phase
-* Command & Control
-
#### RBA
@@ -87,13 +145,11 @@ Legitimate DNS activity can be detected in this search. Investigate, verify and
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-21-dns_record_changed.md b/docs/_posts/2020-07-21-dns_record_changed.md
index 130b17effa..cd248af252 100644
--- a/docs/_posts/2020-07-21-dns_record_changed.md
+++ b/docs/_posts/2020-07-21-dns_record_changed.md
@@ -24,21 +24,82 @@ tags:
The search takes the DNS records and their answers results of the discovered_dns_records lookup and finds if any records have changed by searching DNS response from the Network_Resolution datamodel across the last day.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Network_Resolution](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkResolution)
-
- **Last Updated**: 2020-07-21
- **Author**: Jose Hernandez, Splunk
- **ID**: 44d3a43e-dcd5-49f7-8356-5209bb369065
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1071.004](https://attack.mitre.org/techniques/T1071/004/) | DNS | Command And Control |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Command & Control
+
+
+
+
+
+
+NIST
+ +
+
+* ID.AM
+* PR.DS
+* PR.IP
+* DE.AE
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 1
+* CIS 3
+* CIS 8
+* CIS 12
+
+
+
+
+
+
+
#### Search
```
@@ -67,7 +128,7 @@ The search takes the DNS records and their answers results of the discovered_dns
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `dns_record_changed_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **dns_record_changed_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Lookups
The SPL above uses the following Lookups:
@@ -97,9 +158,6 @@ Legitimate DNS changes can be detected in this search. Investigate, verify and u
* [DNS Hijacking](/stories/dns_hijacking)
-#### Kill Chain Phase
-* Command & Control
-
#### RBA
@@ -109,13 +167,11 @@ Legitimate DNS changes can be detected in this search. Investigate, verify and u
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-21-ec2_instance_modified_with_previously_unseen_user.md b/docs/_posts/2020-07-21-ec2_instance_modified_with_previously_unseen_user.md
index f10187e3b5..cf2dd06696 100644
--- a/docs/_posts/2020-07-21-ec2_instance_modified_with_previously_unseen_user.md
+++ b/docs/_posts/2020-07-21-ec2_instance_modified_with_previously_unseen_user.md
@@ -26,21 +26,75 @@ tags:
This search looks for EC2 instances being modified by users who have not previously modified them. This search is deprecated and have been translated to use the latest Change Datamodel.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-07-21
- **Author**: David Dorsey, Splunk
- **ID**: 56f91724-cf3f-4666-84e1-e3712fb41e76
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1078.004](https://attack.mitre.org/techniques/T1078/004/) | Cloud Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* ID.AM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 1
+
+
+
+
+
+
+
#### Search
```
@@ -64,11 +118,11 @@ This search looks for EC2 instances being modified by users who have not previou
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [ec2_modification_api_calls](https://github.com/splunk/security_content/blob/develop/macros/ec2_modification_api_calls.yml)
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `ec2_instance_modified_with_previously_unseen_user_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **ec2_instance_modified_with_previously_unseen_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Lookups
The SPL above uses the following Lookups:
@@ -92,9 +146,6 @@ It's possible that a new user will start to modify EC2 instances when they haven
* [Unusual AWS EC2 Modifications](/stories/unusual_aws_ec2_modifications)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -104,13 +155,11 @@ It's possible that a new user will start to modify EC2 instances when they haven
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-21-ec2_instance_started_with_previously_unseen_user.md b/docs/_posts/2020-07-21-ec2_instance_started_with_previously_unseen_user.md
index c6a34f5efb..c91ae03d9a 100644
--- a/docs/_posts/2020-07-21-ec2_instance_started_with_previously_unseen_user.md
+++ b/docs/_posts/2020-07-21-ec2_instance_started_with_previously_unseen_user.md
@@ -26,21 +26,75 @@ tags:
This search looks for EC2 instances being created by users who have not created them before. This search is deprecated and have been translated to use the latest Change Datamodel.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-07-21
- **Author**: David Dorsey, Splunk
- **ID**: 22773e84-bac0-4595-b086-20d3f735b4f1
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1078.004](https://attack.mitre.org/techniques/T1078/004/) | Cloud Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* ID.AM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 1
+
+
+
+
+
+
+
#### Search
```
@@ -63,10 +117,10 @@ This search looks for EC2 instances being created by users who have not created
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `ec2_instance_started_with_previously_unseen_user_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **ec2_instance_started_with_previously_unseen_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -86,9 +140,6 @@ It's possible that a user will start to create EC2 instances when they haven't b
* [Suspicious AWS EC2 Activities](/stories/suspicious_aws_ec2_activities)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -98,13 +149,11 @@ It's possible that a user will start to create EC2 instances when they haven't b
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md b/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md
index b0db0ed787..c20cd71e8f 100644
--- a/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md
+++ b/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md
@@ -29,16 +29,21 @@ We have not been able to test, simulate, or build datasets for this object. Use
The search looks at the change-analysis data model and detects email files created outside the normal Outlook directory.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2020-07-21
- **Author**: Bhavin Patel, Splunk
- **ID**: 8d52cf03-ba25-4101-aa78-07994aed4f74
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,53 @@ The search looks at the change-analysis data model and detects email files creat
| [T1114.001](https://attack.mitre.org/techniques/T1114/001/) | Local Email Collection | Collection |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -59,10 +111,10 @@ The search looks at the change-analysis data model and detects email files creat
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `email_files_written_outside_of_the_outlook_directory_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **email_files_written_outside_of_the_outlook_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -83,9 +135,6 @@ Administrators and users sometimes prefer backing up their email data by moving
* [Collection and Staging](/stories/collection_and_staging)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -95,13 +144,11 @@ Administrators and users sometimes prefer backing up their email data by moving
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md b/docs/_posts/2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md
index 39d8a5065f..b645d108aa 100644
--- a/docs/_posts/2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md
+++ b/docs/_posts/2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md
@@ -29,16 +29,21 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search looks for an increase of data transfers from your email server to your clients. This could be indicative of a malicious actor collecting data using your email server.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic)
-
- **Last Updated**: 2020-07-21
- **Author**: Bhavin Patel, Splunk
- **ID**: 7f5fb3e1-4209-4914-90db-0ec21b556378
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,57 @@ This search looks for an increase of data transfers from your email server to yo
| [T1114.002](https://attack.mitre.org/techniques/T1114/002/) | Remote Email Collection | Collection |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+* DE.AE
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 7
+
+
+
+
+
+
+
#### Search
```
@@ -65,7 +121,7 @@ This search looks for an increase of data transfers from your email server to yo
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `email_servers_sending_high_volume_traffic_to_hosts_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **email_servers_sending_high_volume_traffic_to_hosts_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -85,9 +141,6 @@ The false-positive rate will vary based on how you set the deviation_threshold a
* [HAFNIUM Group](/stories/hafnium_group)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -97,13 +150,11 @@ The false-positive rate will vary based on how you set the deviation_threshold a
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-21-excessive_dns_failures.md b/docs/_posts/2020-07-21-excessive_dns_failures.md
index f4ba929683..33ea7afb51 100644
--- a/docs/_posts/2020-07-21-excessive_dns_failures.md
+++ b/docs/_posts/2020-07-21-excessive_dns_failures.md
@@ -29,16 +29,21 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search identifies DNS query failures by counting the number of DNS responses that do not indicate success, and trigger on more than 50 occurrences.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Network_Resolution](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkResolution)
-
- **Last Updated**: 2020-07-21
- **Author**: Bhavin Patel, Splunk
- **ID**: 104658f4-afdc-499e-9719-17243f9826f1
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,59 @@ This search identifies DNS query failures by counting the number of DNS response
| [T1071](https://attack.mitre.org/techniques/T1071/) | Application Layer Protocol | Command And Control |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Command & Control
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.AE
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+* CIS 9
+* CIS 12
+
+
+
+
+
+
+
#### Search
```
@@ -66,7 +124,7 @@ This search identifies DNS query failures by counting the number of DNS response
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `excessive_dns_failures_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **excessive_dns_failures_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -86,9 +144,6 @@ It is possible legitimate traffic can trigger this rule. Please investigate as a
* [Command and Control](/stories/command_and_control)
-#### Kill Chain Phase
-* Command & Control
-
#### RBA
@@ -98,13 +153,11 @@ It is possible legitimate traffic can trigger this rule. Please investigate as a
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-21-first_time_seen_command_line_argument.md b/docs/_posts/2020-07-21-first_time_seen_command_line_argument.md
index 401259a350..c73e0ff14c 100644
--- a/docs/_posts/2020-07-21-first_time_seen_command_line_argument.md
+++ b/docs/_posts/2020-07-21-first_time_seen_command_line_argument.md
@@ -27,16 +27,21 @@ tags:
This search looks for command-line arguments that use a `/c` parameter to execute a command that has not previously been seen.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2020-07-21
- **Author**: Bhavin Patel, Splunk
- **ID**: a1b6e73f-98d5-470f-99ac-77aacd578473
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,59 @@ This search looks for command-line arguments that use a `/c` parameter to execut
| [T1059.003](https://attack.mitre.org/techniques/T1059/003/) | Windows Command Shell | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Command & Control
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+* PR.IP
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -68,10 +126,10 @@ This search looks for command-line arguments that use a `/c` parameter to execut
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `first_time_seen_command_line_argument_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **first_time_seen_command_line_argument_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Lookups
The SPL above uses the following Lookups:
@@ -101,10 +159,6 @@ Legitimate programs can also use command-line arguments to execute. Please verif
* [Hidden Cobra Malware](/stories/hidden_cobra_malware)
-#### Kill Chain Phase
-* Command & Control
-* Actions on Objectives
-
#### RBA
@@ -114,13 +168,11 @@ Legitimate programs can also use command-line arguments to execute. Please verif
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md b/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md
index c9526db45b..b37c976fbc 100644
--- a/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md
+++ b/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md
@@ -28,16 +28,21 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search looks for the first and last time a Windows service is seen running in your environment. This table is then cached.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-07-21
- **Author**: David Dorsey, Splunk
- **ID**: 823136f2-d755-4b6d-ae04-372b486a5808
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -45,6 +50,60 @@ This search looks for the first and last time a Windows service is seen running
| [T1569.002](https://attack.mitre.org/techniques/T1569/002/) | Service Execution | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Installation
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* ID.AM
+* PR.DS
+* PR.AC
+* DE.AE
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 2
+* CIS 9
+
+
+
+
+
+
+
#### Search
```
@@ -59,10 +118,10 @@ This search looks for the first and last time a Windows service is seen running
#### Macros
The SPL above uses the following Macros:
-* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml)
* [previously_seen_windows_services_window](https://github.com/splunk/security_content/blob/develop/macros/previously_seen_windows_services_window.yml)
+* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml)
-Note that `first_time_seen_running_windows_service_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **first_time_seen_running_windows_service_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Lookups
The SPL above uses the following Lookups:
@@ -88,10 +147,6 @@ A previously unseen service is not necessarily malicious. Verify that the servic
* [NOBELIUM Group](/stories/nobelium_group)
-#### Kill Chain Phase
-* Installation
-* Actions on Objectives
-
#### RBA
@@ -101,13 +156,11 @@ A previously unseen service is not necessarily malicious. Verify that the servic
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-21-hiding_files_and_directories_with_attrib_exe.md b/docs/_posts/2020-07-21-hiding_files_and_directories_with_attrib_exe.md
index 4f1df7ade7..74ca087556 100644
--- a/docs/_posts/2020-07-21-hiding_files_and_directories_with_attrib_exe.md
+++ b/docs/_posts/2020-07-21-hiding_files_and_directories_with_attrib_exe.md
@@ -27,16 +27,21 @@ tags:
Attackers leverage an existing Windows binary, attrib.exe, to mark specific as hidden by using specific flags so that the victim does not see the file. The search looks for specific command-line arguments to detect the use of attrib.exe to hide files.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2020-07-21
- **Author**: Bhavin Patel, Splunk
- **ID**: 6e5a3ae4-90a3-462d-9aa6-0119f638c0f1
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,55 @@ Attackers leverage an existing Windows binary, attrib.exe, to mark specific as h
| [T1222.001](https://attack.mitre.org/techniques/T1222/001/) | Windows File and Directory Permissions Modification | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +111,10 @@ Attackers leverage an existing Windows binary, attrib.exe, to mark specific as h
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `hiding_files_and_directories_with_attrib_exe_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **hiding_files_and_directories_with_attrib_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -82,9 +136,6 @@ Some applications and users may legitimately use attrib.exe to interact with the
* [Windows Persistence Techniques](/stories/windows_persistence_techniques)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -94,13 +145,11 @@ Some applications and users may legitimately use attrib.exe to interact with the
| 72.0 | 90 | 80 | Attrib.exe with +h flag to hide files on $dest$ executed by $user$ is detected. |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md b/docs/_posts/2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md
index 98bb3a2a99..332dbc6015 100644
--- a/docs/_posts/2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md
+++ b/docs/_posts/2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md
@@ -29,16 +29,21 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search looks for an increase of data transfers from your email server to your clients. This could be indicative of a malicious actor collecting data using your email server.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic)
-
- **Last Updated**: 2020-07-21
- **Author**: Bhavin Patel, Splunk
- **ID**: 7f5fb3e1-4209-4914-90db-0ec21b556368
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,57 @@ This search looks for an increase of data transfers from your email server to yo
| [T1114](https://attack.mitre.org/techniques/T1114/) | Email Collection | Collection |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+* DE.AE
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 7
+
+
+
+
+
+
+
#### Search
```
@@ -65,7 +121,7 @@ This search looks for an increase of data transfers from your email server to yo
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `hosts_receiving_high_volume_of_network_traffic_from_email_server_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **hosts_receiving_high_volume_of_network_traffic_from_email_server_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +140,6 @@ The false-positive rate will vary based on how you set the deviation_threshold a
* [Collection and Staging](/stories/collection_and_staging)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -96,13 +149,11 @@ The false-positive rate will vary based on how you set the deviation_threshold a
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md b/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md
index 5fa7a1e036..10b6bd6cff 100644
--- a/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md
+++ b/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md
@@ -27,16 +27,21 @@ tags:
This search looks for PowerShell processes started with parameters used to bypass the local execution policy for scripts. These parameters are often observed in attacks leveraging PowerShell scripts as they override the default PowerShell execution policy.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2020-07-21
- **Author**: Rico Valdez, Mauricio Velazco, Splunk
- **ID**: 9be56c82-b1cc-4318-87eb-d138afaaca39
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,60 @@ This search looks for PowerShell processes started with parameters used to bypas
| [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Command & Control
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+* PR.IP
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 7
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -57,11 +116,11 @@ This search looks for PowerShell processes started with parameters used to bypas
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `malicious_powershell_process_-_execution_policy_bypass_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **malicious_powershell_process_-_execution_policy_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -89,10 +148,6 @@ There may be legitimate reasons to bypass the PowerShell execution policy. The P
* [HAFNIUM Group](/stories/hafnium_group)
-#### Kill Chain Phase
-* Command & Control
-* Actions on Objectives
-
#### RBA
@@ -102,13 +157,11 @@ There may be legitimate reasons to bypass the PowerShell execution policy. The P
| 42.0 | 70 | 60 | PowerShell local execution policy bypass attempt on $dest$ |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md b/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md
index 2134c220c1..0d4ae796db 100644
--- a/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md
+++ b/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md
@@ -34,16 +34,21 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search detects Okta login failures due to bad credentials for multiple users originating from the same ip address.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-07-21
- **Author**: Rico Valdez, Splunk
- **ID**: 19cba45f-cad3-4032-8911-0c09e0444552
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -51,6 +56,55 @@ This search detects Okta login failures due to bad credentials for multiple user
| [T1078.001](https://attack.mitre.org/techniques/T1078/001/) | Default Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -65,10 +119,10 @@ This search detects Okta login failures due to bad credentials for multiple user
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [okta](https://github.com/splunk/security_content/blob/develop/macros/okta.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `multiple_okta_users_with_invalid_credentials_from_the_same_ip_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **multiple_okta_users_with_invalid_credentials_from_the_same_ip_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -91,9 +145,6 @@ A single public IP address servicing multiple legitmate users may trigger this s
* [Suspicious Okta Activity](/stories/suspicious_okta_activity)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -103,13 +154,11 @@ A single public IP address servicing multiple legitmate users may trigger this s
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-21-okta_account_lockout_events.md b/docs/_posts/2020-07-21-okta_account_lockout_events.md
index b63b9d82bb..122cef7fb1 100644
--- a/docs/_posts/2020-07-21-okta_account_lockout_events.md
+++ b/docs/_posts/2020-07-21-okta_account_lockout_events.md
@@ -34,16 +34,21 @@ We have not been able to test, simulate, or build datasets for this object. Use
Detect Okta user lockout events
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-07-21
- **Author**: Rico Valdez, Splunk
- **ID**: 62b70968-a0a5-4724-8ac4-67871e6f544d
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -51,6 +56,55 @@ Detect Okta user lockout events
| [T1078.001](https://attack.mitre.org/techniques/T1078/001/) | Default Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -64,7 +118,7 @@ Detect Okta user lockout events
The SPL above uses the following Macros:
* [okta](https://github.com/splunk/security_content/blob/develop/macros/okta.yml)
-Note that `okta_account_lockout_events_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **okta_account_lockout_events_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +138,6 @@ None. Account lockouts should be followed up on to determine if the actual user
* [Suspicious Okta Activity](/stories/suspicious_okta_activity)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -96,13 +147,11 @@ None. Account lockouts should be followed up on to determine if the actual user
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-21-okta_failed_sso_attempts.md b/docs/_posts/2020-07-21-okta_failed_sso_attempts.md
index 7d9d2643aa..ed1e9a3086 100644
--- a/docs/_posts/2020-07-21-okta_failed_sso_attempts.md
+++ b/docs/_posts/2020-07-21-okta_failed_sso_attempts.md
@@ -34,16 +34,21 @@ We have not been able to test, simulate, or build datasets for this object. Use
Detect failed Okta SSO events
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-07-21
- **Author**: Rico Valdez, Splunk
- **ID**: 371a6545-2618-4032-ad84-93386b8698c5
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -51,6 +56,55 @@ Detect failed Okta SSO events
| [T1078.001](https://attack.mitre.org/techniques/T1078/001/) | Default Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -63,10 +117,10 @@ Detect failed Okta SSO events
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [okta](https://github.com/splunk/security_content/blob/develop/macros/okta.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `okta_failed_sso_attempts_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **okta_failed_sso_attempts_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -87,9 +141,6 @@ There may be a faulty config preventing legitmate users from accessing apps they
* [Suspicious Okta Activity](/stories/suspicious_okta_activity)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -99,13 +150,11 @@ There may be a faulty config preventing legitmate users from accessing apps they
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md b/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md
index 9324cb5133..e628063e6e 100644
--- a/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md
+++ b/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md
@@ -34,16 +34,21 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search detects logins from the same user from different cities in a 24 hour period.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-07-21
- **Author**: Rico Valdez, Splunk
- **ID**: 7594fa07-9f34-4d01-81cc-d6af6a5db9e8
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -51,6 +56,55 @@ This search detects logins from the same user from different cities in a 24 hour
| [T1078.001](https://attack.mitre.org/techniques/T1078/001/) | Default Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -64,10 +118,10 @@ This search detects logins from the same user from different cities in a 24 hour
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [okta](https://github.com/splunk/security_content/blob/develop/macros/okta.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `okta_user_logins_from_multiple_cities_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **okta_user_logins_from_multiple_cities_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -87,9 +141,6 @@ Users in your enviornment may legitmately be travelling and loggin in from diffe
* [Suspicious Okta Activity](/stories/suspicious_okta_activity)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -99,13 +150,11 @@ Users in your enviornment may legitmately be travelling and loggin in from diffe
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-21-overwriting_accessibility_binaries.md b/docs/_posts/2020-07-21-overwriting_accessibility_binaries.md
index 54184b6ed2..131764c0e4 100644
--- a/docs/_posts/2020-07-21-overwriting_accessibility_binaries.md
+++ b/docs/_posts/2020-07-21-overwriting_accessibility_binaries.md
@@ -29,16 +29,21 @@ tags:
Microsoft Windows contains accessibility features that can be launched with a key combination before a user has logged in. An adversary can modify or replace these programs so they can get a command prompt or backdoor without logging in to the system. This search looks for modifications to these binaries.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2020-07-21
- **Author**: David Dorsey, Splunk
- **ID**: 13c2f6c3-10c5-4deb-9ba1-7c4460ebe4ae
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,56 @@ Microsoft Windows contains accessibility features that can be launched with a ke
| [T1546.008](https://attack.mitre.org/techniques/T1546/008/) | Accessibility Features | Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -59,10 +114,10 @@ Microsoft Windows contains accessibility features that can be launched with a ke
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `overwriting_accessibility_binaries_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **overwriting_accessibility_binaries_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -82,9 +137,6 @@ Microsoft may provide updates to these binaries. Verify that these changes do no
* [Windows Privilege Escalation](/stories/windows_privilege_escalation)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -94,13 +146,11 @@ Microsoft may provide updates to these binaries. Verify that these changes do no
| 72.0 | 80 | 90 | A suspicious file modification or replace in $file_path$ in host $dest$ |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md b/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md
index e61a4a521f..e62f64d154 100644
--- a/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md
+++ b/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md
@@ -26,21 +26,78 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search looks for network traffic defined by port and transport layer protocol in the Enterprise Security lookup table "lookup_interesting_ports", that is marked as prohibited, and has an associated 'allow' action in the Network_Traffic data model. This could be indicative of a misconfigured network device.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic)
-
- **Last Updated**: 2020-07-21
- **Author**: Rico Valdez, Splunk
- **ID**: ce5a0962-849f-4720-a678-753fe6674479
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1048](https://attack.mitre.org/techniques/T1048/) | Exfiltration Over Alternative Protocol | Exfiltration |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Delivery
+* Command & Control
+
+
+
+
+
+
+NIST
+ +
+
+* DE.AE
+* PR.AC
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 9
+* CIS 12
+
+
+
+
+
+
+
#### Search
```
@@ -56,10 +113,10 @@ This search looks for network traffic defined by port and transport layer protoc
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `prohibited_network_traffic_allowed_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **prohibited_network_traffic_allowed_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -81,10 +138,6 @@ None identified
* [Command and Control](/stories/command_and_control)
-#### Kill Chain Phase
-* Delivery
-* Command & Control
-
#### RBA
@@ -94,13 +147,11 @@ None identified
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-21-protocol_or_port_mismatch.md b/docs/_posts/2020-07-21-protocol_or_port_mismatch.md
index 4135135727..4c55abfac6 100644
--- a/docs/_posts/2020-07-21-protocol_or_port_mismatch.md
+++ b/docs/_posts/2020-07-21-protocol_or_port_mismatch.md
@@ -29,16 +29,21 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search looks for network traffic on common ports where a higher layer protocol does not match the port that is being used. For example, this search should identify cases where protocols other than HTTP are running on TCP port 80. This can be used by attackers to circumvent firewall restrictions, or as an attempt to hide malicious communications over ports and protocols that are typically allowed and not well inspected.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic)
-
- **Last Updated**: 2020-07-21
- **Author**: Rico Valdez, Splunk
- **ID**: 54dc1265-2f74-4b6d-b30d-49eb506a31b3
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,57 @@ This search looks for network traffic on common ports where a higher layer proto
| [T1048](https://attack.mitre.org/techniques/T1048/) | Exfiltration Over Alternative Protocol | Exfiltration |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Command & Control
+
+
+
+
+
+
+NIST
+ +
+
+* DE.AE
+* PR.AC
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 9
+* CIS 12
+
+
+
+
+
+
+
#### Search
```
@@ -59,10 +115,10 @@ This search looks for network traffic on common ports where a higher layer proto
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `protocol_or_port_mismatch_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **protocol_or_port_mismatch_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -83,9 +139,6 @@ None identified
* [Command and Control](/stories/command_and_control)
-#### Kill Chain Phase
-* Command & Control
-
#### RBA
@@ -95,13 +148,11 @@ None identified
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md b/docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md
index 8537e4341b..0f334bd42e 100644
--- a/docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md
+++ b/docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md
@@ -29,16 +29,21 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search looks for RDP application network traffic and filters any source/destination pair generating more than twice the standard deviation of the average traffic.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic)
-
- **Last Updated**: 2020-07-21
- **Author**: Jose Hernandez, Splunk
- **ID**: a98727cc-286b-4ff2-b898-41df64695923
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,60 @@ This search looks for RDP application network traffic and filters any source/des
| [T1021](https://attack.mitre.org/techniques/T1021/) | Remote Services | Lateral Movement |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+* Delivery
+
+
+
+
+
+
+NIST
+ +
+
+* DE.AE
+* PR.AC
+* PR.IP
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 12
+* CIS 9
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -62,7 +121,7 @@ This search looks for RDP application network traffic and filters any source/des
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `remote_desktop_network_bruteforce_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **remote_desktop_network_bruteforce_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -83,10 +142,6 @@ RDP gateways may have unusually high amounts of traffic from all other hosts' RD
* [Ryuk Ransomware](/stories/ryuk_ransomware)
-#### Kill Chain Phase
-* Reconnaissance
-* Delivery
-
#### RBA
@@ -96,13 +151,11 @@ RDP gateways may have unusually high amounts of traffic from all other hosts' RD
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md b/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md
index 1912ab8e39..7309b95c4d 100644
--- a/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md
+++ b/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md
@@ -29,16 +29,21 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search looks for the remote desktop process mstsc.exe running on systems upon which it doesn't typically run. This is accomplished by filtering out all systems that are noted in the `common_rdp_source category` in the Assets and Identity framework.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2020-07-21
- **Author**: David Dorsey, Splunk
- **ID**: f5939373-8054-40ad-8c64-cec478a22a4a
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,59 @@ This search looks for the remote desktop process mstsc.exe running on systems up
| [T1021](https://attack.mitre.org/techniques/T1021/) | Remote Services | Lateral Movement |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.AE
+* PR.AC
+* PR.IP
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 9
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -59,10 +117,10 @@ This search looks for the remote desktop process mstsc.exe running on systems up
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `remote_desktop_process_running_on_system_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **remote_desktop_process_running_on_system_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -83,9 +141,6 @@ Remote Desktop may be used legitimately by users on the network.
* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -95,13 +150,11 @@ Remote Desktop may be used legitimately by users on the network.
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-21-sc_exe_manipulating_windows_services.md b/docs/_posts/2020-07-21-sc_exe_manipulating_windows_services.md
index cac51fb601..063f6913a4 100644
--- a/docs/_posts/2020-07-21-sc_exe_manipulating_windows_services.md
+++ b/docs/_posts/2020-07-21-sc_exe_manipulating_windows_services.md
@@ -29,16 +29,21 @@ tags:
This search looks for arguments to sc.exe indicating the creation or modification of a Windows service.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2020-07-21
- **Author**: Rico Valdez, Splunk
- **ID**: f0c693d8-2a89-4ce7-80b4-98fea4c3ea6d
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,61 @@ This search looks for arguments to sc.exe indicating the creation or modificatio
| [T1543](https://attack.mitre.org/techniques/T1543/) | Create or Modify System Process | Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Installation
+
+
+
+
+
+
+NIST
+ +
+
+* PR.IP
+* PR.PT
+* PR.AC
+* PR.AT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -59,10 +119,10 @@ This search looks for arguments to sc.exe indicating the creation or modificatio
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `sc_exe_manipulating_windows_services_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **sc_exe_manipulating_windows_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -88,9 +148,6 @@ Using sc.exe to manipulate Windows services is uncommon. However, there may be l
* [NOBELIUM Group](/stories/nobelium_group)
-#### Kill Chain Phase
-* Installation
-
#### RBA
@@ -100,13 +157,11 @@ Using sc.exe to manipulate Windows services is uncommon. However, there may be l
| 56.0 | 70 | 80 | A sc process $process_name$ with commandline $process$ to create of configure services in host $dest$ |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-21-scheduled_tasks_used_in_badrabbit_ransomware.md b/docs/_posts/2020-07-21-scheduled_tasks_used_in_badrabbit_ransomware.md
index 1a574ac55e..0adc1b3fc5 100644
--- a/docs/_posts/2020-07-21-scheduled_tasks_used_in_badrabbit_ransomware.md
+++ b/docs/_posts/2020-07-21-scheduled_tasks_used_in_badrabbit_ransomware.md
@@ -26,21 +26,75 @@ tags:
This search looks for flags passed to schtasks.exe on the command-line that indicate that task names related to the execution of Bad Rabbit ransomware were created or deleted. Deprecated because we already have a similar detection
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2020-07-21
- **Author**: Bhavin Patel, Splunk
- **ID**: 1297fb80-f42a-4b4a-9c8b-78c066437cf6
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1053.005](https://attack.mitre.org/techniques/T1053/005/) | Scheduled Task | Execution, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.IP
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+
+
+
+
+
+
+
#### Search
```
@@ -55,10 +109,10 @@ This search looks for flags passed to schtasks.exe on the command-line that indi
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `scheduled_tasks_used_in_badrabbit_ransomware_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **scheduled_tasks_used_in_badrabbit_ransomware_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -74,9 +128,6 @@ No known false positives
* [Ransomware](/stories/ransomware)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -86,13 +137,11 @@ No known false positives
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-22-smb_traffic_spike.md b/docs/_posts/2020-07-22-smb_traffic_spike.md
index 5b46863348..4da164dcf2 100644
--- a/docs/_posts/2020-07-22-smb_traffic_spike.md
+++ b/docs/_posts/2020-07-22-smb_traffic_spike.md
@@ -29,16 +29,21 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search looks for spikes in the number of Server Message Block (SMB) traffic connections.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic)
-
- **Last Updated**: 2020-07-22
- **Author**: David Dorsey, Splunk
- **ID**: 7f5fb3e1-4209-4914-90db-0ec21b936378
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,55 @@ This search looks for spikes in the number of Server Message Block (SMB) traffic
| [T1021](https://attack.mitre.org/techniques/T1021/) | Remote Services | Lateral Movement |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -64,7 +118,7 @@ This search looks for spikes in the number of Server Message Block (SMB) traffic
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `smb_traffic_spike_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **smb_traffic_spike_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -86,9 +140,6 @@ A file server may experience high-demand loads that could cause this analytic to
* [DHS Report TA18-074A](/stories/dhs_report_ta18-074a)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -98,13 +149,11 @@ A file server may experience high-demand loads that could cause this analytic to
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md b/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md
index 3bfb0cd54b..5ce11663b5 100644
--- a/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md
+++ b/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md
@@ -29,16 +29,21 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search uses the Machine Learning Toolkit (MLTK) to identify spikes in the number of Server Message Block (SMB) connections.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic)
-
- **Last Updated**: 2020-07-22
- **Author**: Rico Valdez, Splunk
- **ID**: d25773ba-9ad8-48d1-858e-07ad0bbeb828
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,55 @@ This search uses the Machine Learning Toolkit (MLTK) to identify spikes in the n
| [T1021](https://attack.mitre.org/techniques/T1021/) | Remote Services | Lateral Movement |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -66,7 +120,7 @@ This search uses the Machine Learning Toolkit (MLTK) to identify spikes in the n
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `smb_traffic_spike_-_mltk_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **smb_traffic_spike_-_mltk_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -92,9 +146,6 @@ If you are seeing more results than desired, you may consider reducing the value
* [DHS Report TA18-074A](/stories/dhs_report_ta18-074a)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -104,13 +155,11 @@ If you are seeing more results than desired, you may consider reducing the value
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-22-suspicious_changes_to_file_associations.md b/docs/_posts/2020-07-22-suspicious_changes_to_file_associations.md
index d806eb03eb..e48b2a88bd 100644
--- a/docs/_posts/2020-07-22-suspicious_changes_to_file_associations.md
+++ b/docs/_posts/2020-07-22-suspicious_changes_to_file_associations.md
@@ -24,21 +24,78 @@ tags:
This search looks for changes to registry values that control Windows file associations, executed by a process that is not typical for legitimate, routine changes to this area.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-07-22
- **Author**: Rico Valdez, Splunk
- **ID**: 1b989a0e-0129-4446-a695-f193a5b746fc
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1546.001](https://attack.mitre.org/techniques/T1546/001/) | Change Default File Association | Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+* PR.PT
+* PR.IP
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -56,10 +113,10 @@ This search looks for changes to registry values that control Windows file assoc
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `suspicious_changes_to_file_associations_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **suspicious_changes_to_file_associations_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -76,9 +133,6 @@ There may be other processes in your environment that users may legitimately use
* [Windows File Extension and Association Abuse](/stories/windows_file_extension_and_association_abuse)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -88,13 +142,11 @@ There may be other processes in your environment that users may legitimately use
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-22-suspicious_email_-_uba_anomaly.md b/docs/_posts/2020-07-22-suspicious_email_-_uba_anomaly.md
index 5e325f0a4c..746344acbe 100644
--- a/docs/_posts/2020-07-22-suspicious_email_-_uba_anomaly.md
+++ b/docs/_posts/2020-07-22-suspicious_email_-_uba_anomaly.md
@@ -24,21 +24,75 @@ tags:
This detection looks for emails that are suspicious because of their sender, domain rareness, or behavior differences. This is an anomaly generated by Splunk User Behavior Analytics (UBA).
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [UEBA](https://docs.splunk.com/Documentation/CIM/latest/User/UEBA)
-
- **Last Updated**: 2020-07-22
- **Author**: Bhavin Patel, Splunk
- **ID**: 56e877a6-1455-4479-ad16-0550dc1e33f8
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1566](https://attack.mitre.org/techniques/T1566/) | Phishing | Initial Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Delivery
+
+
+
+
+
+
+NIST
+ +
+
+* PR.IP
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 7
+
+
+
+
+
+
+
#### Search
```
@@ -53,10 +107,10 @@ This detection looks for emails that are suspicious because of their sender, dom
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `suspicious_email_-_uba_anomaly_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **suspicious_email_-_uba_anomaly_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -72,9 +126,6 @@ This detection model will alert on any sender domain that is seen for the first
* [Suspicious Emails](/stories/suspicious_emails)
-#### Kill Chain Phase
-* Delivery
-
#### RBA
@@ -84,13 +135,11 @@ This detection model will alert on any sender domain that is seen for the first
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md b/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md
index 4757cb85e5..fad26fb353 100644
--- a/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md
+++ b/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md
@@ -29,16 +29,21 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search looks for emails that have attachments with suspicious file extensions.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Email](https://docs.splunk.com/Documentation/CIM/latest/User/Email)
-
- **Last Updated**: 2020-07-22
- **Author**: David Dorsey, Splunk
- **ID**: 473bd65f-06ca-4dfe-a2b8-ba04ab4a0084
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,58 @@ This search looks for emails that have attachments with suspicious file extensio
| [T1566](https://attack.mitre.org/techniques/T1566/) | Phishing | Initial Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Delivery
+
+
+
+
+
+
+NIST
+ +
+
+* DE.AE
+* PR.IP
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 7
+* CIS 12
+
+
+
+
+
+
+
#### Search
```
@@ -60,11 +117,11 @@ This search looks for emails that have attachments with suspicious file extensio
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [suspicious_email_attachments](https://github.com/splunk/security_content/blob/develop/macros/suspicious_email_attachments.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `suspicious_email_attachment_extensions_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **suspicious_email_attachment_extensions_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -86,9 +143,6 @@ None identified
* [Suspicious Emails](/stories/suspicious_emails)
-#### Kill Chain Phase
-* Delivery
-
#### RBA
@@ -98,13 +152,11 @@ None identified
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-22-suspicious_reg_exe_process.md b/docs/_posts/2020-07-22-suspicious_reg_exe_process.md
index e581f47272..9c8f73d6e0 100644
--- a/docs/_posts/2020-07-22-suspicious_reg_exe_process.md
+++ b/docs/_posts/2020-07-22-suspicious_reg_exe_process.md
@@ -24,21 +24,75 @@ tags:
This search looks for reg.exe being launched from a command prompt not started by the user. When a user launches cmd.exe, the parent process is usually explorer.exe. This search filters out those instances.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2020-07-22
- **Author**: David Dorsey, Splunk
- **ID**: a6b3ab4e-dd77-4213-95fa-fc94701995e0
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -60,10 +114,10 @@ This search looks for reg.exe being launched from a command prompt not started b
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `suspicious_reg_exe_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **suspicious_reg_exe_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -88,9 +142,6 @@ It's possible for system administrators to write scripts that exhibit this behav
* [DHS Report TA18-074A](/stories/dhs_report_ta18-074a)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -100,8 +151,6 @@ It's possible for system administrators to write scripts that exhibit this behav
| 35.0 | 70 | 50 | Suspicious $Processes.process_path.file_path$ process running with an uncommon parent process $Processes.parent_process_name$ |
-
-
#### Reference
* [https://car.mitre.org/wiki/CAR-2013-03-001](https://car.mitre.org/wiki/CAR-2013-03-001)
@@ -109,7 +158,7 @@ It's possible for system administrators to write scripts that exhibit this behav
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-22-suspicious_writes_to_system_volume_information.md b/docs/_posts/2020-07-22-suspicious_writes_to_system_volume_information.md
index de2ae755ee..5a1aa00ddb 100644
--- a/docs/_posts/2020-07-22-suspicious_writes_to_system_volume_information.md
+++ b/docs/_posts/2020-07-22-suspicious_writes_to_system_volume_information.md
@@ -23,21 +23,75 @@ tags:
This search detects writes to the 'System Volume Information' folder by something other than the System process.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-07-22
- **Author**: Rico Valdez, Splunk
- **ID**: cd6297cd-2bdd-4aa1-84aa-5d2f84228fac
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1036](https://attack.mitre.org/techniques/T1036/) | Masquerading | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -50,10 +104,10 @@ This search detects writes to the 'System Volume Information' folder by somethin
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `suspicious_writes_to_system_volume_information_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **suspicious_writes_to_system_volume_information_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -69,9 +123,6 @@ It is possible that other utilities or system processes may legitimately write t
* [Collection and Staging](/stories/collection_and_staging)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -81,13 +132,11 @@ It is possible that other utilities or system processes may legitimately write t
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-22-suspicious_writes_to_windows_recycle_bin.md b/docs/_posts/2020-07-22-suspicious_writes_to_windows_recycle_bin.md
index 25e4653508..9681c6beed 100644
--- a/docs/_posts/2020-07-22-suspicious_writes_to_windows_recycle_bin.md
+++ b/docs/_posts/2020-07-22-suspicious_writes_to_windows_recycle_bin.md
@@ -23,21 +23,75 @@ tags:
This search detects writes to the recycle bin by a process other than explorer.exe.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-07-22
- **Author**: Rico Valdez, Splunk
- **ID**: b5541828-8ffd-4070-9d95-b3da4de924cb
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1036](https://attack.mitre.org/techniques/T1036/) | Masquerading | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -55,7 +109,7 @@ This search detects writes to the recycle bin by a process other than explorer.e
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `suspicious_writes_to_windows_recycle_bin_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **suspicious_writes_to_windows_recycle_bin_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -80,9 +134,6 @@ Because the Recycle Bin is a hidden folder in modern versions of Windows, it wou
* [Collection and Staging](/stories/collection_and_staging)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -92,13 +143,11 @@ Because the Recycle Bin is a hidden folder in modern versions of Windows, it wou
| 28.0 | 40 | 70 | Suspicious writes to windows Recycle Bin process $Processes.process_name$ |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-22-tor_traffic.md b/docs/_posts/2020-07-22-tor_traffic.md
index 37da246a1a..8001dd1e4e 100644
--- a/docs/_posts/2020-07-22-tor_traffic.md
+++ b/docs/_posts/2020-07-22-tor_traffic.md
@@ -29,16 +29,21 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search looks for network traffic identified as The Onion Router (TOR), a benign anonymity network which can be abused for a variety of nefarious purposes.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic)
-
- **Last Updated**: 2020-07-22
- **Author**: David Dorsey, Splunk
- **ID**: ea688274-9c06-4473-b951-e4cb7a5d7a45
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,56 @@ This search looks for network traffic identified as The Onion Router (TOR), a be
| [T1071.001](https://attack.mitre.org/techniques/T1071/001/) | Web Protocols | Command And Control |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Command & Control
+
+
+
+
+
+
+NIST
+ +
+
+* DE.AE
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 9
+* CIS 12
+
+
+
+
+
+
+
#### Search
```
@@ -59,10 +114,10 @@ This search looks for network traffic identified as The Onion Router (TOR), a be
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `tor_traffic_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **tor_traffic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -86,9 +141,6 @@ None at this time
* [Command and Control](/stories/command_and_control)
-#### Kill Chain Phase
-* Command & Control
-
#### RBA
@@ -98,13 +150,11 @@ None at this time
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-22-uncommon_processes_on_endpoint.md b/docs/_posts/2020-07-22-uncommon_processes_on_endpoint.md
index 1fd41890b6..ffccb288b3 100644
--- a/docs/_posts/2020-07-22-uncommon_processes_on_endpoint.md
+++ b/docs/_posts/2020-07-22-uncommon_processes_on_endpoint.md
@@ -24,21 +24,76 @@ tags:
This search looks for applications on the endpoint that you have marked as uncommon.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2020-07-22
- **Author**: David Dorsey, Splunk
- **ID**: 29ccce64-a10c-4389-a45f-337cb29ba1f7
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1204.002](https://attack.mitre.org/techniques/T1204/002/) | Malicious File | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* ID.AM
+* PR.DS
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 2
+
+
+
+
+
+
+
#### Search
```
@@ -53,11 +108,11 @@ This search looks for applications on the endpoint that you have marked as uncom
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [uncommon_processes](https://github.com/splunk/security_content/blob/develop/macros/uncommon_processes.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `uncommon_processes_on_endpoint_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **uncommon_processes_on_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -74,9 +129,6 @@ None identified
* [Unusual Processes](/stories/unusual_processes)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -86,13 +138,11 @@ None identified
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-22-unload_sysmon_filter_driver.md b/docs/_posts/2020-07-22-unload_sysmon_filter_driver.md
index fbcfcc12d1..67c9dc6275 100644
--- a/docs/_posts/2020-07-22-unload_sysmon_filter_driver.md
+++ b/docs/_posts/2020-07-22-unload_sysmon_filter_driver.md
@@ -27,16 +27,21 @@ tags:
Attackers often disable security tools to avoid detection. This search looks for the usage of process `fltMC.exe` to unload a Sysmon Driver that will stop sysmon from collecting the data.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2020-07-22
- **Author**: Bhavin Patel, Splunk
- **ID**: e5928ff3-23eb-4d8b-b8a4-dcbc844fdfbe
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,55 @@ Attackers often disable security tools to avoid detection. This search looks for
| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -58,10 +112,10 @@ Attackers often disable security tools to avoid detection. This search looks for
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `unload_sysmon_filter_driver_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **unload_sysmon_filter_driver_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -83,9 +137,6 @@ You must be ingesting data that records process activity from your hosts to popu
* [Disabling Security Tools](/stories/disabling_security_tools)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -95,13 +146,11 @@ You must be ingesting data that records process activity from your hosts to popu
| 45.0 | 50 | 90 | Possible Sysmon filter driver unloading on $dest$ |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md b/docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md
index 4ce631c0a2..70cb37dd9b 100644
--- a/docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md
+++ b/docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md
@@ -28,21 +28,71 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search provides detection of an user attaching itself to a different role trust policy. This can be used for lateral movement and escalation of privileges.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-07-27
- **Author**: Rod Soto, Splunk
- **ID**: 88fc31dd-f331-448c-9856-d3d51dd5d3a1
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -56,7 +106,7 @@ This search provides detection of an user attaching itself to a different role t
The SPL above uses the following Macros:
* [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml)
-Note that `aws_detect_attach_to_role_policy_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **aws_detect_attach_to_role_policy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -73,9 +123,6 @@ Attach to policy can create a lot of noise. This search can be adjusted to provi
* [AWS Cross Account Activity](/stories/aws_cross_account_activity)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -85,13 +132,11 @@ Attach to policy can create a lot of noise. This search can be adjusted to provi
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md b/docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md
index 87ad85d0fa..f6cf61a2b8 100644
--- a/docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md
+++ b/docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md
@@ -28,21 +28,71 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search provides detection of accounts creating permanent keys. Permanent keys are not created by default and they are only needed for programmatic calls. Creation of Permanent key is an important event to monitor.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-07-27
- **Author**: Rod Soto, Splunk
- **ID**: 12d6d713-3cb4-4ffc-a064-1dca3d1cca01
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,7 +107,7 @@ This search provides detection of accounts creating permanent keys. Permanent ke
The SPL above uses the following Macros:
* [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml)
-Note that `aws_detect_permanent_key_creation_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **aws_detect_permanent_key_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -83,9 +133,6 @@ Not all permanent key creations are malicious. If there is a policy of rotating
* [AWS Cross Account Activity](/stories/aws_cross_account_activity)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -95,13 +142,11 @@ Not all permanent key creations are malicious. If there is a policy of rotating
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-27-aws_detect_role_creation.md b/docs/_posts/2020-07-27-aws_detect_role_creation.md
index 20b5709870..a3bd6b5f6b 100644
--- a/docs/_posts/2020-07-27-aws_detect_role_creation.md
+++ b/docs/_posts/2020-07-27-aws_detect_role_creation.md
@@ -28,21 +28,71 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search provides detection of role creation by IAM users. Role creation is an event by itself if user is creating a new role with trust policies different than the available in AWS and it can be used for lateral movement and escalation of privileges.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-07-27
- **Author**: Rod Soto, Splunk
- **ID**: 5f04081e-ddee-4353-afe4-504f288de9ad
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -55,7 +105,7 @@ This search provides detection of role creation by IAM users. Role creation is a
The SPL above uses the following Macros:
* [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml)
-Note that `aws_detect_role_creation_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **aws_detect_role_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -88,9 +138,6 @@ CreateRole is not very common in common users. This search can be adjusted to pr
* [AWS Cross Account Activity](/stories/aws_cross_account_activity)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -100,13 +147,11 @@ CreateRole is not very common in common users. This search can be adjusted to pr
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md b/docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md
index 5cf3cdc3f0..d0ebbd3224 100644
--- a/docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md
+++ b/docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md
@@ -28,21 +28,71 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search provides detection of suspicious use of sts:AssumeRole. These tokens can be created on the go and used by attackers to move laterally and escalate privileges.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-07-27
- **Author**: Rod Soto, Splunk
- **ID**: 8e565314-b6a2-46d8-9f05-1a34a176a662
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -55,7 +105,7 @@ This search provides detection of suspicious use of sts:AssumeRole. These tokens
The SPL above uses the following Macros:
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
-Note that `aws_detect_sts_assume_role_abuse_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **aws_detect_sts_assume_role_abuse_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -82,9 +132,6 @@ Sts:AssumeRole can be very noisy as it is a standard mechanism to provide cross
* [AWS Cross Account Activity](/stories/aws_cross_account_activity)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -94,13 +141,11 @@ Sts:AssumeRole can be very noisy as it is a standard mechanism to provide cross
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md b/docs/_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md
index a3c9a81e39..a5eeabea8a 100644
--- a/docs/_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md
+++ b/docs/_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md
@@ -26,21 +26,71 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search provides detection of suspicious use of sts:GetSessionToken. These tokens can be created on the go and used by attackers to move laterally and escalate privileges.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-07-27
- **Author**: Rod Soto, Splunk
- **ID**: 85d7b35f-b8b5-4b01-916f-29b81e7a0551
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1550](https://attack.mitre.org/techniques/T1550/) | Use Alternate Authentication Material | Defense Evasion, Lateral Movement |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -55,7 +105,7 @@ This search provides detection of suspicious use of sts:GetSessionToken. These t
The SPL above uses the following Macros:
* [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml)
-Note that `aws_detect_sts_get_session_token_abuse_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **aws_detect_sts_get_session_token_abuse_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -81,9 +131,6 @@ Sts:GetSessionToken can be very noisy as in certain environments numerous calls
* [AWS Cross Account Activity](/stories/aws_cross_account_activity)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -93,13 +140,11 @@ Sts:GetSessionToken can be very noisy as in certain environments numerous calls
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md
index 67858fb07e..8b976ae96a 100644
--- a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md
+++ b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md
@@ -26,21 +26,80 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search detects SIGRed via Splunk Stream.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-07-28
- **Author**: Shannon Davis, Splunk
- **ID**: babd8d10-d073-11ea-87d0-0242ac130003
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1203](https://attack.mitre.org/techniques/T1203/) | Exploitation for Client Execution | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+* CIS 12
+
+
+
+
+
+
+
#### Search
```
@@ -58,10 +117,10 @@ This search detects SIGRed via Splunk Stream.
#### Macros
The SPL above uses the following Macros:
-* [stream_dns](https://github.com/splunk/security_content/blob/develop/macros/stream_dns.yml)
* [stream_tcp](https://github.com/splunk/security_content/blob/develop/macros/stream_tcp.yml)
+* [stream_dns](https://github.com/splunk/security_content/blob/develop/macros/stream_dns.yml)
-Note that `detect_windows_dns_sigred_via_splunk_stream_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_windows_dns_sigred_via_splunk_stream_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -77,9 +136,6 @@ unknown
* [Windows DNS SIGRed CVE-2020-1350](/stories/windows_dns_sigred_cve-2020-1350)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -89,19 +145,11 @@ unknown
| 25.0 | 50 | 50 | tbd |
-#### CVE
-
-| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
-| ----------- | ----------- | -------------- |
-| [CVE-2020-1350](https://nvd.nist.gov/vuln/detail/CVE-2020-1350) | A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows DNS Server Remote Code Execution Vulnerability'. | 10.0 |
-
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md
index c347f574bc..4034326e39 100644
--- a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md
+++ b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md
@@ -27,21 +27,80 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search detects SIGRed via Zeek DNS and Zeek Conn data.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Network_Resolution](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkResolution)
-
- **Last Updated**: 2020-07-28
- **Author**: Shannon Davis, Splunk
- **ID**: c5c622e4-d073-11ea-87d0-0242ac130003
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
+| ----------- | ----------- | -------------- |
+| [CVE-2020-1350](https://nvd.nist.gov/vuln/detail/CVE-2020-1350) | A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows DNS Server Remote Code Execution Vulnerability'. | 10.0 |
+
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1203](https://attack.mitre.org/techniques/T1203/) | Exploitation for Client Execution | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -61,7 +120,7 @@ This search detects SIGRed via Zeek DNS and Zeek Conn data.
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `detect_windows_dns_sigred_via_zeek_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_windows_dns_sigred_via_zeek_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -81,9 +140,6 @@ unknown
* [Windows DNS SIGRed CVE-2020-1350](/stories/windows_dns_sigred_cve-2020-1350)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -93,19 +149,11 @@ unknown
| 25.0 | 50 | 50 | tbd |
-#### CVE
-
-| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
-| ----------- | ----------- | -------------- |
-| [CVE-2020-1350](https://nvd.nist.gov/vuln/detail/CVE-2020-1350) | A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows DNS Server Remote Code Execution Vulnerability'. | 10.0 |
-
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-07-29-cloud_instance_modified_by_previously_unseen_user.md b/docs/_posts/2020-07-29-cloud_instance_modified_by_previously_unseen_user.md
index 261a7c6cee..64b17deb2a 100644
--- a/docs/_posts/2020-07-29-cloud_instance_modified_by_previously_unseen_user.md
+++ b/docs/_posts/2020-07-29-cloud_instance_modified_by_previously_unseen_user.md
@@ -33,16 +33,21 @@ tags:
This search looks for cloud instances being modified by users who have not previously modified them.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change)
-- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719)
+- **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change)- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719)
- **Last Updated**: 2020-07-29
- **Author**: Rico Valdez, Splunk
- **ID**: 7fb15084-b14e-405a-bd61-a6de15a40722
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
+| ----------- | ----------- | -------------- |
+| [CVE-2020-1350](https://nvd.nist.gov/vuln/detail/CVE-2020-1350) | A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows DNS Server Remote Code Execution Vulnerability'. | 10.0 |
+
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -50,6 +55,55 @@ This search looks for cloud instances being modified by users who have not previ
| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* ID.AM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 1
+
+
+
+
+
+
+
#### Search
```
@@ -68,10 +122,10 @@ This search looks for cloud instances being modified by users who have not previ
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `cloud_instance_modified_by_previously_unseen_user_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **cloud_instance_modified_by_previously_unseen_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Lookups
The SPL above uses the following Lookups:
@@ -98,9 +152,6 @@ It's possible that a new user will start to modify EC2 instances when they haven
* [Suspicious Cloud Instance Activities](/stories/suspicious_cloud_instance_activities)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -110,13 +161,11 @@ It's possible that a new user will start to modify EC2 instances when they haven
| 42.0 | 70 | 60 | User $user$ is modifying an instance $dest$ for the first time. |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md b/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md
index f71b3f49da..63c1f1e698 100644
--- a/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md
+++ b/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md
@@ -26,21 +26,80 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search detects remote code exploit attempts on F5 BIG-IP, BIG-IQ, and Traffix SDC devices
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-08-02
- **Author**: Shannon Davis, Splunk
- **ID**: 810e4dbc-d46e-11ea-87d0-0242ac130003
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1190](https://attack.mitre.org/techniques/T1190/) | Exploit Public-Facing Application | Initial Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+* CIS 11
+
+
+
+
+
+
+
#### Search
```
@@ -54,7 +113,7 @@ This search detects remote code exploit attempts on F5 BIG-IP, BIG-IQ, and Traff
The SPL above uses the following Macros:
* [f5_bigip_rogue](https://github.com/splunk/security_content/blob/develop/macros/f5_bigip_rogue.yml)
-Note that `detect_f5_tmui_rce_cve-2020-5902_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_f5_tmui_rce_cve-2020-5902_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -70,9 +129,6 @@ unknown
* [F5 TMUI RCE CVE-2020-5902](/stories/f5_tmui_rce_cve-2020-5902)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -82,14 +138,6 @@ unknown
| 25.0 | 50 | 50 | tbd |
-#### CVE
-
-| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
-| ----------- | ----------- | -------------- |
-| [CVE-2020-5902](https://nvd.nist.gov/vuln/detail/CVE-2020-5902) | In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages. | 10.0 |
-
-
-
#### Reference
* [https://www.ptsecurity.com/ww-en/about/news/f5-fixes-critical-vulnerability-discovered-by-positive-technologies-in-big-ip-application-delivery-controller/](https://www.ptsecurity.com/ww-en/about/news/f5-fixes-critical-vulnerability-discovered-by-positive-technologies-in-big-ip-application-delivery-controller/)
@@ -98,7 +146,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md b/docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md
index 55ddb83e5e..f1946af888 100644
--- a/docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md
+++ b/docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md
@@ -25,21 +25,77 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search looks for GCP PubSub events where a user has created an open/public GCP Storage bucket.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-08-05
- **Author**: Shannon Davis, Splunk
- **ID**: f6ea3466-d6bb-11ea-87d0-0242ac130003
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
+| ----------- | ----------- | -------------- |
+| [CVE-2020-5902](https://nvd.nist.gov/vuln/detail/CVE-2020-5902) | In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages. | 10.0 |
+
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1530](https://attack.mitre.org/techniques/T1530/) | Data from Cloud Storage Object | Collection |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.DS
+* PR.AC
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 13
+
+
+
+
+
+
+
#### Search
```
@@ -60,7 +116,7 @@ This search looks for GCP PubSub events where a user has created an open/public
The SPL above uses the following Macros:
* [google_gcp_pubsub_message](https://github.com/splunk/security_content/blob/develop/macros/google_gcp_pubsub_message.yml)
-Note that `detect_new_open_gcp_storage_buckets_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_new_open_gcp_storage_buckets_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -85,9 +141,6 @@ While this search has no known false positives, it is possible that a GCP admin
* [Suspicious GCP Storage Activities](/stories/suspicious_gcp_storage_activities)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -97,13 +150,11 @@ While this search has no known false positives, it is possible that a GCP admin
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-08-10-detect_gcp_storage_access_from_a_new_ip.md b/docs/_posts/2020-08-10-detect_gcp_storage_access_from_a_new_ip.md
index 46bb91f84b..065db4f9c3 100644
--- a/docs/_posts/2020-08-10-detect_gcp_storage_access_from_a_new_ip.md
+++ b/docs/_posts/2020-08-10-detect_gcp_storage_access_from_a_new_ip.md
@@ -25,21 +25,78 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search looks at GCP Storage bucket-access logs and detects new or previously unseen remote IP addresses that have successfully accessed a GCP Storage bucket.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-08-10
- **Author**: Shannon Davis, Splunk
- **ID**: ccc3246a-daa1-11ea-87d0-0242ac130022
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1530](https://attack.mitre.org/techniques/T1530/) | Data from Cloud Storage Object | Collection |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.DS
+* PR.AC
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 13
+* CIS 14
+
+
+
+
+
+
+
#### Search
```
@@ -68,7 +125,7 @@ This search looks at GCP Storage bucket-access logs and detects new or previousl
The SPL above uses the following Macros:
* [google_gcp_pubsub_message](https://github.com/splunk/security_content/blob/develop/macros/google_gcp_pubsub_message.yml)
-Note that `detect_gcp_storage_access_from_a_new_ip_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_gcp_storage_access_from_a_new_ip_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Lookups
The SPL above uses the following Lookups:
@@ -95,9 +152,6 @@ GCP Storage buckets can be accessed from any IP (if the ACLs are open to allow i
* [Suspicious GCP Storage Activities](/stories/suspicious_gcp_storage_activities)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -107,13 +161,11 @@ GCP Storage buckets can be accessed from any IP (if the ACLs are open to allow i
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-08-11-detect_arp_poisoning.md b/docs/_posts/2020-08-11-detect_arp_poisoning.md
index 52c0ac9f47..9bad7b85c1 100644
--- a/docs/_posts/2020-08-11-detect_arp_poisoning.md
+++ b/docs/_posts/2020-08-11-detect_arp_poisoning.md
@@ -36,16 +36,21 @@ We have not been able to test, simulate, or build datasets for this object. Use
By enabling Dynamic ARP Inspection as a Layer 2 Security measure on the organization's network devices, we will be able to detect ARP Poisoning attacks in the Infrastructure.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-08-11
- **Author**: Mikael Bjerkeland, Splunk
- **ID**: b44bebd6-bd39-467b-9321-73971bcd7aac
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -57,6 +62,59 @@ By enabling Dynamic ARP Inspection as a Layer 2 Security measure on the organiza
| [T1557.002](https://attack.mitre.org/techniques/T1557/002/) | ARP Cache Poisoning | Collection, Credential Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+* Delivery
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* ID.AM
+* PR.DS
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 1
+* CIS 11
+
+
+
+
+
+
+
#### Search
```
@@ -70,10 +128,10 @@ By enabling Dynamic ARP Inspection as a Layer 2 Security measure on the organiza
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [cisco_networks](https://github.com/splunk/security_content/blob/develop/macros/cisco_networks.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_arp_poisoning_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_arp_poisoning_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -96,11 +154,6 @@ This search might be prone to high false positives if DHCP Snooping or ARP inspe
* [Router and Infrastructure Security](/stories/router_and_infrastructure_security)
-#### Kill Chain Phase
-* Reconnaissance
-* Delivery
-* Actions on Objectives
-
#### RBA
@@ -110,13 +163,11 @@ This search might be prone to high false positives if DHCP Snooping or ARP inspe
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md b/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md
index 3b62f9cf34..f57584d02f 100644
--- a/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md
+++ b/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md
@@ -32,16 +32,21 @@ We have not been able to test, simulate, or build datasets for this object. Use
By enabling DHCP Snooping as a Layer 2 Security measure on the organization's network devices, we will be able to detect unauthorized DHCP servers handing out DHCP leases to devices on the network (Man in the Middle attack).
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-08-11
- **Author**: Mikael Bjerkeland, Splunk
- **ID**: 6e1ada88-7a0d-4ac1-92c6-03d354686079
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -51,6 +56,59 @@ By enabling DHCP Snooping as a Layer 2 Security measure on the organization's ne
| [T1557](https://attack.mitre.org/techniques/T1557/) | Adversary-in-the-Middle | Collection, Credential Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+* Delivery
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* ID.AM
+* PR.DS
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 1
+* CIS 11
+
+
+
+
+
+
+
#### Search
```
@@ -63,10 +121,10 @@ By enabling DHCP Snooping as a Layer 2 Security measure on the organization's ne
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [cisco_networks](https://github.com/splunk/security_content/blob/develop/macros/cisco_networks.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_rogue_dhcp_server_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_rogue_dhcp_server_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -87,11 +145,6 @@ This search might be prone to high false positives if DHCP Snooping has been inc
* [Router and Infrastructure Security](/stories/router_and_infrastructure_security)
-#### Kill Chain Phase
-* Reconnaissance
-* Delivery
-* Actions on Objectives
-
#### RBA
@@ -101,13 +154,11 @@ This search might be prone to high false positives if DHCP Snooping has been inc
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_ip_address.md b/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_ip_address.md
index 476141ca5c..c62e53acfe 100644
--- a/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_ip_address.md
+++ b/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_ip_address.md
@@ -27,21 +27,75 @@ tags:
This search looks for cloud provisioning activities from previously unseen IP addresses. Provisioning activities are defined broadly as any event that runs or creates something.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change)
-- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719)
+- **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change)- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719)
- **Last Updated**: 2020-08-16
- **Author**: Rico Valdez, Splunk
- **ID**: f86a8ec9-b042-45eb-92f4-e9ed1d781078
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* ID.AM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 1
+
+
+
+
+
+
+
#### Search
```
@@ -60,10 +114,10 @@ This search looks for cloud provisioning activities from previously unseen IP ad
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [previously_unseen_cloud_provisioning_activity_window](https://github.com/splunk/security_content/blob/develop/macros/previously_unseen_cloud_provisioning_activity_window.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `cloud_provisioning_activity_from_previously_unseen_ip_address_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **cloud_provisioning_activity_from_previously_unseen_ip_address_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Lookups
The SPL above uses the following Lookups:
@@ -91,9 +145,6 @@ This is a strictly behavioral search, so we define "false positive" slightly dif
* [Suspicious Cloud Provisioning Activities](/stories/suspicious_cloud_provisioning_activities)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -103,13 +154,11 @@ This is a strictly behavioral search, so we define "false positive" slightly dif
| 42.0 | 70 | 60 | User $user$ is starting or creating an instance $object_id$ for the first time from IP address $src$ |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_region.md b/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_region.md
index 9beb4c03b7..50ec849700 100644
--- a/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_region.md
+++ b/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_region.md
@@ -27,21 +27,75 @@ tags:
This search looks for cloud provisioning activities from previously unseen regions. Provisioning activities are defined broadly as any event that runs or creates something.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change)
-- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719)
+- **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change)- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719)
- **Last Updated**: 2020-08-16
- **Author**: Rico Valdez, Bhavin Patel, Splunk
- **ID**: 5aba1860-9617-4af9-b19d-aecac16fe4f2
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* ID.AM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 1
+
+
+
+
+
+
+
#### Search
```
@@ -62,10 +116,10 @@ This search looks for cloud provisioning activities from previously unseen regio
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [previously_unseen_cloud_provisioning_activity_window](https://github.com/splunk/security_content/blob/develop/macros/previously_unseen_cloud_provisioning_activity_window.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `cloud_provisioning_activity_from_previously_unseen_region_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **cloud_provisioning_activity_from_previously_unseen_region_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Lookups
The SPL above uses the following Lookups:
@@ -93,9 +147,6 @@ This is a strictly behavioral search, so we define "false positive" slightly dif
* [Suspicious Cloud Provisioning Activities](/stories/suspicious_cloud_provisioning_activities)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -105,13 +156,11 @@ This is a strictly behavioral search, so we define "false positive" slightly dif
| 42.0 | 70 | 60 | User $user$ is starting or creating an instance $object$ for the first time in region $Region$ from IP address $src$ |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md b/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md
index 45646fdb13..725d122879 100644
--- a/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md
+++ b/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md
@@ -35,16 +35,21 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search finds for the number successfully destroyed cloud instances for every 4 hour block. This is split up between weekdays and the weekend. It then applies the probability densitiy model previously created and alerts on any outliers.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change)
-
- **Last Updated**: 2020-08-21
- **Author**: David Dorsey, Splunk
- **ID**: ef629fc9-1583-4590-b62a-f2247fbf7bbf
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -52,6 +57,56 @@ This search finds for the number successfully destroyed cloud instances for ever
| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.DP
+* DE.AE
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 13
+
+
+
+
+
+
+
#### Search
```
@@ -76,7 +131,7 @@ This search finds for the number successfully destroyed cloud instances for ever
#### Macros
The SPL above uses the following Macros:
-Note that `abnormally_high_number_of_cloud_instances_destroyed_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **abnormally_high_number_of_cloud_instances_destroyed_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -97,9 +152,6 @@ Many service accounts configured within a cloud infrastructure are known to exhi
* [Suspicious Cloud Instance Activities](/stories/suspicious_cloud_instance_activities)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -109,13 +161,11 @@ Many service accounts configured within a cloud infrastructure are known to exhi
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_launched.md b/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_launched.md
index 9a9cf0252d..87429d2be7 100644
--- a/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_launched.md
+++ b/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_launched.md
@@ -35,16 +35,21 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search finds for the number successfully created cloud instances for every 4 hour block. This is split up between weekdays and the weekend. It then applies the probability densitiy model previously created and alerts on any outliers.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change)
-
- **Last Updated**: 2020-08-21
- **Author**: David Dorsey, Splunk
- **ID**: f2361e9f-3928-496c-a556-120cd4223a65
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -52,6 +57,56 @@ This search finds for the number successfully created cloud instances for every
| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.DP
+* DE.AE
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 13
+
+
+
+
+
+
+
#### Search
```
@@ -76,7 +131,7 @@ This search finds for the number successfully created cloud instances for every
#### Macros
The SPL above uses the following Macros:
-Note that `abnormally_high_number_of_cloud_instances_launched_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **abnormally_high_number_of_cloud_instances_launched_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -98,9 +153,6 @@ Many service accounts configured within an AWS infrastructure are known to exhib
* [Suspicious Cloud Instance Activities](/stories/suspicious_cloud_instance_activities)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -110,13 +162,11 @@ Many service accounts configured within an AWS infrastructure are known to exhib
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-09-01-gcp_detect_oauth_token_abuse.md b/docs/_posts/2020-09-01-gcp_detect_oauth_token_abuse.md
index 3d434cfc87..d58665dbcd 100644
--- a/docs/_posts/2020-09-01-gcp_detect_oauth_token_abuse.md
+++ b/docs/_posts/2020-09-01-gcp_detect_oauth_token_abuse.md
@@ -26,21 +26,71 @@ tags:
This search provides detection of possible GCP Oauth token abuse. GCP Oauth token without time limit can be exfiltrated and reused for keeping access sessions alive without further control of authentication, allowing attackers to access and move laterally.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-09-01
- **Author**: Rod Soto, Splunk
- **ID**: a7e9f7bb-8901-4ad0-8d88-0a4ab07b1972
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -53,7 +103,7 @@ This search provides detection of possible GCP Oauth token abuse. GCP Oauth toke
The SPL above uses the following Macros:
* [google_gcp_pubsub_message](https://github.com/splunk/security_content/blob/develop/macros/google_gcp_pubsub_message.yml)
-Note that `gcp_detect_oauth_token_abuse_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **gcp_detect_oauth_token_abuse_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -69,9 +119,6 @@ GCP Oauth token abuse detection will only work if there are access policies in p
* [GCP Cross Account Activity](/stories/gcp_cross_account_activity)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -81,8 +128,6 @@ GCP Oauth token abuse detection will only work if there are access policies in p
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
* [https://www.netskope.com/blog/gcp-oauth-token-hijacking-in-google-cloud-part-1](https://www.netskope.com/blog/gcp-oauth-token-hijacking-in-google-cloud-part-1)
@@ -91,7 +136,7 @@ GCP Oauth token abuse detection will only work if there are access policies in p
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-09-02-cloud_compute_instance_created_in_previously_unused_region.md b/docs/_posts/2020-09-02-cloud_compute_instance_created_in_previously_unused_region.md
index 3eb21dff3d..05ae4bc9ff 100644
--- a/docs/_posts/2020-09-02-cloud_compute_instance_created_in_previously_unused_region.md
+++ b/docs/_posts/2020-09-02-cloud_compute_instance_created_in_previously_unused_region.md
@@ -24,21 +24,76 @@ tags:
This search looks at cloud-infrastructure events where an instance is created in any region within the last hour and then compares it to a lookup file of previously seen regions where instances have been created.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change)
-- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719)
+- **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change)- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719)
- **Last Updated**: 2020-09-02
- **Author**: David Dorsey, Splunk
- **ID**: fa4089e2-50e3-40f7-8469-d2cc1564ca59
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1535](https://attack.mitre.org/techniques/T1535/) | Unused/Unsupported Cloud Regions | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.DP
+* DE.AE
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 12
+
+
+
+
+
+
+
#### Search
```
@@ -59,7 +114,7 @@ This search looks at cloud-infrastructure events where an instance is created in
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `cloud_compute_instance_created_in_previously_unused_region_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **cloud_compute_instance_created_in_previously_unused_region_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Lookups
The SPL above uses the following Lookups:
@@ -84,9 +139,6 @@ It's possible that a user has unknowingly started an instance in a new region. P
* [Cloud Cryptomining](/stories/cloud_cryptomining)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -96,13 +148,11 @@ It's possible that a user has unknowingly started an instance in a new region. P
| 42.0 | 70 | 60 | User $user$ is creating an instance $dest$ in a new region for the first time |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-09-04-cloud_api_calls_from_previously_unseen_user_roles.md b/docs/_posts/2020-09-04-cloud_api_calls_from_previously_unseen_user_roles.md
index 87c126f76f..e4fe7f07d7 100644
--- a/docs/_posts/2020-09-04-cloud_api_calls_from_previously_unseen_user_roles.md
+++ b/docs/_posts/2020-09-04-cloud_api_calls_from_previously_unseen_user_roles.md
@@ -27,21 +27,75 @@ tags:
This search looks for new commands from each user role.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change)
-- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719)
+- **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change)- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719)
- **Last Updated**: 2020-09-04
- **Author**: David Dorsey, Splunk
- **ID**: 2181ad1f-1e73-4d0c-9780-e8880482a08f
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* ID.AM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 1
+
+
+
+
+
+
+
#### Search
```
@@ -63,7 +117,7 @@ This search looks for new commands from each user role.
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `cloud_api_calls_from_previously_unseen_user_roles_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **cloud_api_calls_from_previously_unseen_user_roles_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Lookups
The SPL above uses the following Lookups:
@@ -89,9 +143,6 @@ You must be ingesting your cloud infrastructure logs from your cloud provider.
* [Suspicious Cloud User Activities](/stories/suspicious_cloud_user_activities)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -101,13 +152,11 @@ You must be ingesting your cloud infrastructure logs from your cloud provider.
| 36.0 | 60 | 60 | User $user$ of type AssumedRole attempting to execute new API calls $command$ that have not been seen before |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_infrastructure_api_calls.md b/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_infrastructure_api_calls.md
index 84c33540ab..0a35691f4e 100644
--- a/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_infrastructure_api_calls.md
+++ b/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_infrastructure_api_calls.md
@@ -33,16 +33,21 @@ tags:
This search will detect a spike in the number of API calls made to your cloud infrastructure environment by a user.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change)
-- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719)
+- **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change)- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719)
- **Last Updated**: 2020-09-07
- **Author**: David Dorsey, Splunk
- **ID**: 0840ddf1-8c89-46ff-b730-c8d6722478c0
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -50,6 +55,57 @@ This search will detect a spike in the number of API calls made to your cloud in
| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.DP
+* DE.CM
+* PR.AC
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -75,7 +131,7 @@ This search will detect a spike in the number of API calls made to your cloud in
#### Macros
The SPL above uses the following Macros:
-Note that `abnormally_high_number_of_cloud_infrastructure_api_calls_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **abnormally_high_number_of_cloud_infrastructure_api_calls_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -94,9 +150,6 @@ You must be ingesting your cloud infrastructure logs. You also must run the base
* [Suspicious Cloud User Activities](/stories/suspicious_cloud_user_activities)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -106,13 +159,11 @@ You must be ingesting your cloud infrastructure logs. You also must run the base
| 15.0 | 30 | 50 | user $user$ has made $api_calls$ api calls, violating the dynamic threshold of $expected_upper_threshold$ with the following command $command$. |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_security_group_api_calls.md b/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_security_group_api_calls.md
index 96347e13a3..62e821ae4d 100644
--- a/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_security_group_api_calls.md
+++ b/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_security_group_api_calls.md
@@ -33,16 +33,21 @@ tags:
This search will detect a spike in the number of API calls made to your cloud infrastructure environment about security groups by a user.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change)
-- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719)
+- **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change)- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719)
- **Last Updated**: 2020-09-07
- **Author**: David Dorsey, Splunk
- **ID**: d4dfb7f3-7a37-498a-b5df-f19334e871af
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -50,6 +55,57 @@ This search will detect a spike in the number of API calls made to your cloud in
| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.DP
+* DE.CM
+* PR.AC
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -75,7 +131,7 @@ This search will detect a spike in the number of API calls made to your cloud in
#### Macros
The SPL above uses the following Macros:
-Note that `abnormally_high_number_of_cloud_security_group_api_calls_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **abnormally_high_number_of_cloud_security_group_api_calls_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -95,9 +151,6 @@ You must be ingesting your cloud infrastructure logs. You also must run the base
* [Suspicious Cloud User Activities](/stories/suspicious_cloud_user_activities)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -107,13 +160,11 @@ You must be ingesting your cloud infrastructure logs. You also must run the base
| 15.0 | 30 | 50 | user $user$ has made $api_calls$ api calls related to security groups, violating the dynamic threshold of $expected_upper_threshold$ with the following command $command$. |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-09-08-cloud_network_access_control_list_deleted.md b/docs/_posts/2020-09-08-cloud_network_access_control_list_deleted.md
index a919c8823c..8e6d952edd 100644
--- a/docs/_posts/2020-09-08-cloud_network_access_control_list_deleted.md
+++ b/docs/_posts/2020-09-08-cloud_network_access_control_list_deleted.md
@@ -20,14 +20,71 @@ tags:
Enforcing network-access controls is one of the defensive mechanisms used by cloud administrators to restrict access to a cloud instance. After the attacker has gained control of the console by compromising an admin account, they can delete a network ACL and gain access to the instance from anywhere. This search will query the Change datamodel to detect users deleting network ACLs. Deprecated because it's a duplicate
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-09-08
- **Author**: Peter Gael, Splunk
- **ID**: 021abc51-1862-41dd-ad43-43c739c0a983
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.DP
+* DE.AE
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 11
+
+
+
+
+
+
+
#### Search
```
@@ -41,10 +98,10 @@ Enforcing network-access controls is one of the defensive mechanisms used by clo
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `cloud_network_access_control_list_deleted_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **cloud_network_access_control_list_deleted_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -68,9 +125,6 @@ It's possible that a user has legitimately deleted a network ACL.
* [Cloud Network ACL Activity](/stories/cloud_network_acl_activity)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -80,13 +134,11 @@ It's possible that a user has legitimately deleted a network ACL.
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-09-12-cloud_compute_instance_created_with_previously_unseen_instance_type.md b/docs/_posts/2020-09-12-cloud_compute_instance_created_with_previously_unseen_instance_type.md
index 1cf9674336..ff6f217d9e 100644
--- a/docs/_posts/2020-09-12-cloud_compute_instance_created_with_previously_unseen_instance_type.md
+++ b/docs/_posts/2020-09-12-cloud_compute_instance_created_with_previously_unseen_instance_type.md
@@ -21,14 +21,70 @@ tags:
Find EC2 instances being created with previously unseen instance types.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change)
-- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719)
+- **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change)- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719)
- **Last Updated**: 2020-09-12
- **Author**: David Dorsey, Splunk
- **ID**: c6ddbf53-9715-49f3-bb4c-fb2e8a309cda
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* ID.AM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 1
+
+
+
+
+
+
+
#### Search
```
@@ -51,7 +107,7 @@ Find EC2 instances being created with previously unseen instance types.
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `cloud_compute_instance_created_with_previously_unseen_instance_type_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **cloud_compute_instance_created_with_previously_unseen_instance_type_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Lookups
The SPL above uses the following Lookups:
@@ -76,9 +132,6 @@ It is possible that an admin will create a new system using a new instance type
* [Cloud Cryptomining](/stories/cloud_cryptomining)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -88,13 +141,11 @@ It is possible that an admin will create a new system using a new instance type
| 30.0 | 50 | 60 | User $user$ is creating an instance $dest$ with an instance type $instance_type$ that has not been previously seen. |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-09-15-detect_zerologon_via_zeek.md b/docs/_posts/2020-09-15-detect_zerologon_via_zeek.md
index c21a8f2b0d..bf1121c205 100644
--- a/docs/_posts/2020-09-15-detect_zerologon_via_zeek.md
+++ b/docs/_posts/2020-09-15-detect_zerologon_via_zeek.md
@@ -26,21 +26,80 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search detects attempts to run exploits for the Zerologon CVE-2020-1472 vulnerability via Zeek RPC
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-09-15
- **Author**: Shannon Davis, Splunk
- **ID**: bf7a06ec-f703-11ea-adc1-0242ac120002
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1190](https://attack.mitre.org/techniques/T1190/) | Exploit Public-Facing Application | Initial Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+* CIS 11
+
+
+
+
+
+
+
#### Search
```
@@ -55,7 +114,7 @@ This search detects attempts to run exploits for the Zerologon CVE-2020-1472 vul
The SPL above uses the following Macros:
* [zeek_rpc](https://github.com/splunk/security_content/blob/develop/macros/zeek_rpc.yml)
-Note that `detect_zerologon_via_zeek_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_zerologon_via_zeek_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -72,9 +131,6 @@ unknown
* [Detect Zerologon Attack](/stories/detect_zerologon_attack)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -84,14 +140,6 @@ unknown
| 25.0 | 50 | 50 | tbd |
-#### CVE
-
-| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
-| ----------- | ----------- | -------------- |
-| [CVE-2020-1472](https://nvd.nist.gov/vuln/detail/CVE-2020-1472) | An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC), aka 'Netlogon Elevation of Privilege Vulnerability'. | 9.3 |
-
-
-
#### Reference
* [https://www.secura.com/blog/zero-logon](https://www.secura.com/blog/zero-logon)
@@ -101,7 +149,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md b/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md
index 6425c8d6ac..acfcc29d2a 100644
--- a/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md
+++ b/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md
@@ -27,16 +27,21 @@ tags:
This search looks for the creation or deletion of hidden shares using net.exe.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2020-09-16
- **Author**: Bhavin Patel, Splunk
- **ID**: 743a322c-9a68-4a0f-9c17-85d9cce2a27c
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
+| ----------- | ----------- | -------------- |
+| [CVE-2020-1472](https://nvd.nist.gov/vuln/detail/CVE-2020-1472) | An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC), aka 'Netlogon Elevation of Privilege Vulnerability'. | 9.3 |
+
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,56 @@ This search looks for the creation or deletion of hidden shares using net.exe.
| [T1070.005](https://attack.mitre.org/techniques/T1070/005/) | Network Share Connection Removal | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -58,11 +113,11 @@ This search looks for the creation or deletion of hidden shares using net.exe.
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `create_or_delete_windows_shares_using_net_exe_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **create_or_delete_windows_shares_using_net_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -89,9 +144,6 @@ Administrators often leverage net.exe to create or delete network shares. You sh
* [Hidden Cobra Malware](/stories/hidden_cobra_malware)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -101,8 +153,6 @@ Administrators often leverage net.exe to create or delete network shares. You sh
| 25.0 | 50 | 50 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ enumerating Windows file shares. |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1070/005](https://attack.mitre.org/techniques/T1070/005)
@@ -110,7 +160,7 @@ Administrators often leverage net.exe to create or delete network shares. You sh
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md b/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md
index b1f25c09cf..27746874e4 100644
--- a/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md
+++ b/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md
@@ -26,21 +26,81 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search looks for Event Code 4742 (Computer Change) or EventCode 4624 (An account was successfully logged on) with an anonymous account.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-09-18
- **Author**: Rod Soto, Jose Hernandez, Splunk
- **ID**: 1400624a-d42d-484d-8843-e6753e6e3645
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1210](https://attack.mitre.org/techniques/T1210/) | Exploitation of Remote Services | Lateral Movement |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.AE
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 6
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -53,7 +113,7 @@ This search looks for Event Code 4742 (Computer Change) or EventCode 4624 (An ac
The SPL above uses the following Macros:
* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
-Note that `detect_computer_changed_with_anonymous_account_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_computer_changed_with_anonymous_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -74,9 +134,6 @@ None thus far found
* [Detect Zerologon Attack](/stories/detect_zerologon_attack)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -86,14 +143,6 @@ None thus far found
| 49.0 | 70 | 70 | The following $EventCode$ occurred on $dest$ by $user$ with Logon Type 3, which may be indicative of the an account or group being changed by an anonymous account. |
-#### CVE
-
-| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
-| ----------- | ----------- | -------------- |
-| [CVE-2020-1472](https://nvd.nist.gov/vuln/detail/CVE-2020-1472) | An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC), aka 'Netlogon Elevation of Privilege Vulnerability'. | 9.3 |
-
-
-
#### Reference
* [https://www.lares.com/blog/from-lares-labs-defensive-guidance-for-zerologon-cve-2020-1472/](https://www.lares.com/blog/from-lares-labs-defensive-guidance-for-zerologon-cve-2020-1472/)
@@ -101,7 +150,7 @@ None thus far found
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_city.md b/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_city.md
index 8ba257a7ab..2661650d56 100644
--- a/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_city.md
+++ b/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_city.md
@@ -24,21 +24,76 @@ tags:
This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Authentication](https://docs.splunk.com/Documentation/CIM/latest/User/Authentication)
-
- **Last Updated**: 2020-10-07
- **Author**: Bhavin Patel, Splunk
- **ID**: 121b0b11-f8ac-4ed6-a132-3800ca4fc07a
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
+| ----------- | ----------- | -------------- |
+| [CVE-2020-1472](https://nvd.nist.gov/vuln/detail/CVE-2020-1472) | An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC), aka 'Netlogon Elevation of Privilege Vulnerability'. | 9.3 |
+
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1535](https://attack.mitre.org/techniques/T1535/) | Unused/Unsupported Cloud Regions | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.DP
+* DE.AE
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -64,7 +119,7 @@ This search looks for AWS CloudTrail events wherein a console login event by a u
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_aws_console_login_by_user_from_new_city_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_aws_console_login_by_user_from_new_city_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Lookups
The SPL above uses the following Lookups:
@@ -89,9 +144,6 @@ When a legitimate new user logins for the first time, this activity will be dete
* [Suspicious Cloud Authentication Activities](/stories/suspicious_cloud_authentication_activities)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -101,13 +153,11 @@ When a legitimate new user logins for the first time, this activity will be dete
| 18.0 | 30 | 60 | User $user$ is logging into the AWS console from City $City$ for the first time |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_country.md b/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_country.md
index bf9a109e59..7fca14f159 100644
--- a/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_country.md
+++ b/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_country.md
@@ -24,21 +24,76 @@ tags:
This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Authentication](https://docs.splunk.com/Documentation/CIM/latest/User/Authentication)
-
- **Last Updated**: 2020-10-07
- **Author**: Bhavin Patel, Splunk
- **ID**: 67bd3def-c41c-4bf6-837b-ae196b4257c6
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1535](https://attack.mitre.org/techniques/T1535/) | Unused/Unsupported Cloud Regions | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.DP
+* DE.AE
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -64,7 +119,7 @@ This search looks for AWS CloudTrail events wherein a console login event by a u
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_aws_console_login_by_user_from_new_country_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_aws_console_login_by_user_from_new_country_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Lookups
The SPL above uses the following Lookups:
@@ -89,9 +144,6 @@ When a legitimate new user logins for the first time, this activity will be dete
* [Suspicious Cloud Authentication Activities](/stories/suspicious_cloud_authentication_activities)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -101,13 +153,11 @@ When a legitimate new user logins for the first time, this activity will be dete
| 42.0 | 70 | 60 | User $user$ is logging into the AWS console from Country $Country$ for the first time |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_region.md b/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_region.md
index a856b7bfe3..3c23e9ebd4 100644
--- a/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_region.md
+++ b/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_region.md
@@ -24,21 +24,76 @@ tags:
This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Authentication](https://docs.splunk.com/Documentation/CIM/latest/User/Authentication)
-
- **Last Updated**: 2020-10-07
- **Author**: Bhavin Patel, Splunk
- **ID**: 9f31aa8e-e37c-46bc-bce1-8b3be646d026
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1535](https://attack.mitre.org/techniques/T1535/) | Unused/Unsupported Cloud Regions | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.DP
+* DE.AE
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -64,7 +119,7 @@ This search looks for AWS CloudTrail events wherein a console login event by a u
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_aws_console_login_by_user_from_new_region_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_aws_console_login_by_user_from_new_region_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Lookups
The SPL above uses the following Lookups:
@@ -89,9 +144,6 @@ When a legitimate new user logins for the first time, this activity will be dete
* [Suspicious Cloud Authentication Activities](/stories/suspicious_cloud_authentication_activities)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -101,13 +153,11 @@ When a legitimate new user logins for the first time, this activity will be dete
| 36.0 | 60 | 60 | User $user$ is logging into the AWS console from Region $Region$ for the first time |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md b/docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md
index f3f09de893..e95210d731 100644
--- a/docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md
+++ b/docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md
@@ -28,21 +28,71 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search provides detection of GCPloit exploitation framework. This framework can be used to escalate privileges and move laterally from compromised high privilege accounts.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-10-08
- **Author**: Rod Soto, Splunk
- **ID**: a1c5a85e-a162-410c-a5d9-99ff639e5a52
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -55,7 +105,7 @@ This search provides detection of GCPloit exploitation framework. This framework
The SPL above uses the following Macros:
* [google_gcp_pubsub_message](https://github.com/splunk/security_content/blob/develop/macros/google_gcp_pubsub_message.yml)
-Note that `gcp_detect_gcploit_framework_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **gcp_detect_gcploit_framework_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -79,9 +129,6 @@ Payload.request.function.timeout value can possibly be match with other function
* [GCP Cross Account Activity](/stories/gcp_cross_account_activity)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -91,8 +138,6 @@ Payload.request.function.timeout value can possibly be match with other function
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
* [https://github.com/dxa4481/gcploit](https://github.com/dxa4481/gcploit)
@@ -101,7 +146,7 @@ Payload.request.function.timeout value can possibly be match with other function
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_city.md b/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_city.md
index 4f0cd5537a..93ae6e9aa2 100644
--- a/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_city.md
+++ b/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_city.md
@@ -27,21 +27,75 @@ tags:
This search looks for cloud provisioning activities from previously unseen cities. Provisioning activities are defined broadly as any event that runs or creates something.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change)
-- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719)
+- **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change)- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719)
- **Last Updated**: 2020-10-09
- **Author**: Rico Valdez, Bhavin Patel, Splunk
- **ID**: e7ecc5e0-88df-48b9-91af-51104c68f02f
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* ID.AM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 1
+
+
+
+
+
+
+
#### Search
```
@@ -62,10 +116,10 @@ This search looks for cloud provisioning activities from previously unseen citie
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [previously_unseen_cloud_provisioning_activity_window](https://github.com/splunk/security_content/blob/develop/macros/previously_unseen_cloud_provisioning_activity_window.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `cloud_provisioning_activity_from_previously_unseen_city_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **cloud_provisioning_activity_from_previously_unseen_city_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Lookups
The SPL above uses the following Lookups:
@@ -93,9 +147,6 @@ This is a strictly behavioral search, so we define "false positive" slightly dif
* [Suspicious Cloud Provisioning Activities](/stories/suspicious_cloud_provisioning_activities)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -105,13 +156,11 @@ This is a strictly behavioral search, so we define "false positive" slightly dif
| 18.0 | 30 | 60 | User $user$ is starting or creating an instance $dest$ for the first time in City $City$ from IP address $src$ |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_country.md b/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_country.md
index a8b277a7f0..6021c70aa9 100644
--- a/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_country.md
+++ b/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_country.md
@@ -27,21 +27,75 @@ tags:
This search looks for cloud provisioning activities from previously unseen countries. Provisioning activities are defined broadly as any event that runs or creates something.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change)
-- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719)
+- **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change)- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719)
- **Last Updated**: 2020-10-09
- **Author**: Rico Valdez, Bhavin Patel, Splunk
- **ID**: 94994255-3acf-4213-9b3f-0494df03bb31
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* ID.AM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 1
+
+
+
+
+
+
+
#### Search
```
@@ -64,7 +118,7 @@ This search looks for cloud provisioning activities from previously unseen count
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `cloud_provisioning_activity_from_previously_unseen_country_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **cloud_provisioning_activity_from_previously_unseen_country_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Lookups
The SPL above uses the following Lookups:
@@ -92,9 +146,6 @@ This is a strictly behavioral search, so we define "false positive" slightly dif
* [Suspicious Cloud Provisioning Activities](/stories/suspicious_cloud_provisioning_activities)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -104,13 +155,11 @@ This is a strictly behavioral search, so we define "false positive" slightly dif
| 42.0 | 70 | 60 | User $user$ is starting or creating an instance $object$ for the first time in Country $Country$ from IP address $src$ |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-10-09-gcp_detect_accounts_with_high_risk_roles_by_project.md b/docs/_posts/2020-10-09-gcp_detect_accounts_with_high_risk_roles_by_project.md
index fd324a7444..fb787ff0ca 100644
--- a/docs/_posts/2020-10-09-gcp_detect_accounts_with_high_risk_roles_by_project.md
+++ b/docs/_posts/2020-10-09-gcp_detect_accounts_with_high_risk_roles_by_project.md
@@ -26,21 +26,71 @@ tags:
This search provides detection of accounts with high risk roles by projects. Compromised accounts with high risk roles can move laterally or even scalate privileges at different projects depending on organization schema.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-10-09
- **Author**: Rod Soto, Splunk
- **ID**: 27af8c15-38b0-4408-b339-920170724adb
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -53,7 +103,7 @@ This search provides detection of accounts with high risk roles by projects. Com
The SPL above uses the following Macros:
* [google_gcp_pubsub_message](https://github.com/splunk/security_content/blob/develop/macros/google_gcp_pubsub_message.yml)
-Note that `gcp_detect_accounts_with_high_risk_roles_by_project_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **gcp_detect_accounts_with_high_risk_roles_by_project_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -75,9 +125,6 @@ Accounts with high risk roles should be reduced to the minimum number needed, ho
* [GCP Cross Account Activity](/stories/gcp_cross_account_activity)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -87,8 +134,6 @@ Accounts with high risk roles should be reduced to the minimum number needed, ho
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
* [https://github.com/dxa4481/gcploit](https://github.com/dxa4481/gcploit)
@@ -98,7 +143,7 @@ Accounts with high risk roles should be reduced to the minimum number needed, ho
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-10-09-gcp_detect_high_risk_permissions_by_resource_and_account.md b/docs/_posts/2020-10-09-gcp_detect_high_risk_permissions_by_resource_and_account.md
index ab54f85b31..07fc7148c8 100644
--- a/docs/_posts/2020-10-09-gcp_detect_high_risk_permissions_by_resource_and_account.md
+++ b/docs/_posts/2020-10-09-gcp_detect_high_risk_permissions_by_resource_and_account.md
@@ -26,21 +26,71 @@ tags:
This search provides detection of high risk permissions by resource and accounts. These are permissions that can allow attackers with compromised accounts to move laterally and escalate privileges.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-10-09
- **Author**: Rod Soto, Splunk
- **ID**: 2e70ef35-2187-431f-aedc-4503dc9b06ba
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -53,7 +103,7 @@ This search provides detection of high risk permissions by resource and accounts
The SPL above uses the following Macros:
* [google_gcp_pubsub_message](https://github.com/splunk/security_content/blob/develop/macros/google_gcp_pubsub_message.yml)
-Note that `gcp_detect_high_risk_permissions_by_resource_and_account_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **gcp_detect_high_risk_permissions_by_resource_and_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -75,9 +125,6 @@ High risk permissions are part of any GCP environment, however it is important t
* [GCP Cross Account Activity](/stories/gcp_cross_account_activity)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -87,8 +134,6 @@ High risk permissions are part of any GCP environment, however it is important t
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
* [https://github.com/dxa4481/gcploit](https://github.com/dxa4481/gcploit)
@@ -98,7 +143,7 @@ High risk permissions are part of any GCP environment, however it is important t
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md b/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md
index 1d4da0ee26..369753c2c9 100644
--- a/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md
+++ b/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md
@@ -28,16 +28,21 @@ tags:
This search looks for specific authentication events from the Windows Security Event logs to detect potential attempts at using the Pass-the-Hash technique.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-10-15
- **Author**: Bhavin Patel, Patrick Bareiss, Splunk
- **ID**: f5939373-8054-40ad-8c64-cec478a22a4b
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -45,6 +50,60 @@ This search looks for specific authentication events from the Windows Security E
| [T1550.002](https://attack.mitre.org/techniques/T1550/002/) | Pass the Hash | Defense Evasion, Lateral Movement |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* PR.AT
+* PR.AC
+* PR.IP
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -58,10 +117,10 @@ This search looks for specific authentication events from the Windows Security E
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_activity_related_to_pass_the_hash_attacks_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_activity_related_to_pass_the_hash_attacks_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -83,9 +142,6 @@ Legitimate logon activity by authorized NTLM systems may be detected by this sea
* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -95,13 +151,11 @@ Legitimate logon activity by authorized NTLM systems may be detected by this sea
| 49.0 | 70 | 70 | The following $EventCode$ occurred on $dest$ by $user$ with Logon Type 3, which may be indicative of the pass the hash technique. |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md b/docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md
index 800f6c62c0..c66ed418e7 100644
--- a/docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md
+++ b/docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md
@@ -25,21 +25,77 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search looks for commands that the SNICat tool uses in the TLS SNI field.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-10-21
- **Author**: Shannon Davis, Splunk
- **ID**: 82d06410-134c-11eb-adc1-0242ac120002
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1041](https://attack.mitre.org/techniques/T1041/) | Exfiltration Over C2 Channel | Exfiltration |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.DS
+* DE.CM
+* DE.AE
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 13
+
+
+
+
+
+
+
#### Search
```
@@ -65,7 +121,7 @@ This search looks for commands that the SNICat tool uses in the TLS SNI field.
The SPL above uses the following Macros:
* [zeek_ssl](https://github.com/splunk/security_content/blob/develop/macros/zeek_ssl.yml)
-Note that `detect_snicat_sni_exfiltration_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_snicat_sni_exfiltration_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +140,6 @@ Unknown
* [Data Exfiltration](/stories/data_exfiltration)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -96,8 +149,6 @@ Unknown
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
* [https://www.mnemonic.no/blog/introducing-snicat/](https://www.mnemonic.no/blog/introducing-snicat/)
@@ -107,7 +158,7 @@ Unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md b/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md
index 6fbbabab3d..f75b40d407 100644
--- a/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md
+++ b/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md
@@ -36,16 +36,21 @@ We have not been able to test, simulate, or build datasets for this object. Use
By enabling IPv6 First Hop Security as a Layer 2 Security measure on the organization's network devices, we will be able to detect various attacks such as packet forging in the Infrastructure.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-10-28
- **Author**: Mikael Bjerkeland, Splunk
- **ID**: c3be767e-7959-44c5-8976-0e9c12a91ad2
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -57,6 +62,59 @@ By enabling IPv6 First Hop Security as a Layer 2 Security measure on the organiz
| [T1557.002](https://attack.mitre.org/techniques/T1557/002/) | ARP Cache Poisoning | Collection, Credential Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+* Delivery
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* ID.AM
+* PR.DS
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 1
+* CIS 11
+
+
+
+
+
+
+
#### Search
```
@@ -72,10 +130,10 @@ By enabling IPv6 First Hop Security as a Layer 2 Security measure on the organiz
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [cisco_networks](https://github.com/splunk/security_content/blob/develop/macros/cisco_networks.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_ipv6_network_infrastructure_threats_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_ipv6_network_infrastructure_threats_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -101,11 +159,6 @@ None currently known
* [Router and Infrastructure Security](/stories/router_and_infrastructure_security)
-#### Kill Chain Phase
-* Reconnaissance
-* Delivery
-* Actions on Objectives
-
#### RBA
@@ -115,8 +168,6 @@ None currently known
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
* [https://www.ciscolive.com/c/dam/r/ciscolive/emea/docs/2019/pdf/BRKSEC-3200.pdf](https://www.ciscolive.com/c/dam/r/ciscolive/emea/docs/2019/pdf/BRKSEC-3200.pdf)
@@ -131,7 +182,7 @@ None currently known
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-10-28-detect_port_security_violation.md b/docs/_posts/2020-10-28-detect_port_security_violation.md
index 3fa866187e..71e5f21e2a 100644
--- a/docs/_posts/2020-10-28-detect_port_security_violation.md
+++ b/docs/_posts/2020-10-28-detect_port_security_violation.md
@@ -36,16 +36,21 @@ We have not been able to test, simulate, or build datasets for this object. Use
By enabling Port Security on a Cisco switch you can restrict input to an interface by limiting and identifying MAC addresses of the workstations that are allowed to access the port. When you assign secure MAC addresses to a secure port, the port does not forward packets with source addresses outside the group of defined addresses. If you limit the number of secure MAC addresses to one and assign a single secure MAC address, the workstation attached to that port is assured the full bandwidth of the port. If a port is configured as a secure port and the maximum number of secure MAC addresses is reached, when the MAC address of a workstation attempting to access the port is different from any of the identified secure MAC addresses, a security violation occurs.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-10-28
- **Author**: Mikael Bjerkeland, Splunk
- **ID**: 2de3d5b8-a4fa-45c5-8540-6d071c194d24
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -57,6 +62,60 @@ By enabling Port Security on a Cisco switch you can restrict input to an interfa
| [T1557.002](https://attack.mitre.org/techniques/T1557/002/) | ARP Cache Poisoning | Collection, Credential Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+* Delivery
+* Exploitation
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* ID.AM
+* PR.DS
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 1
+* CIS 11
+
+
+
+
+
+
+
#### Search
```
@@ -70,10 +129,10 @@ By enabling Port Security on a Cisco switch you can restrict input to an interfa
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [cisco_networks](https://github.com/splunk/security_content/blob/develop/macros/cisco_networks.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_port_security_violation_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_port_security_violation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -99,12 +158,6 @@ This search might be prone to high false positives if you have malfunctioning de
* [Router and Infrastructure Security](/stories/router_and_infrastructure_security)
-#### Kill Chain Phase
-* Reconnaissance
-* Delivery
-* Exploitation
-* Actions on Objectives
-
#### RBA
@@ -114,13 +167,11 @@ This search might be prone to high false positives if you have malfunctioning de
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-10-28-detect_software_download_to_network_device.md b/docs/_posts/2020-10-28-detect_software_download_to_network_device.md
index 38738b3f46..37506021e4 100644
--- a/docs/_posts/2020-10-28-detect_software_download_to_network_device.md
+++ b/docs/_posts/2020-10-28-detect_software_download_to_network_device.md
@@ -31,16 +31,21 @@ We have not been able to test, simulate, or build datasets for this object. Use
Adversaries may abuse netbooting to load an unauthorized network device operating system from a Trivial File Transfer Protocol (TFTP) server. TFTP boot (netbooting) is commonly used by network administrators to load configuration-controlled network device images from a centralized management server. Netbooting is one option in the boot sequence and can be used to centralize, manage, and control device images.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic)
-
- **Last Updated**: 2020-10-28
- **Author**: Mikael Bjerkeland, Splunk
- **ID**: cc590c66-f65f-48f2-986a-4797244762f8
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -48,6 +53,57 @@ Adversaries may abuse netbooting to load an unauthorized network device operatin
| [T1542](https://attack.mitre.org/techniques/T1542/) | Pre-OS Boot | Defense Evasion, Persistence |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Delivery
+
+
+
+
+
+
+NIST
+ +
+
+* ID.AM
+* PR.DS
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 1
+* CIS 11
+
+
+
+
+
+
+
#### Search
```
@@ -61,10 +117,10 @@ Adversaries may abuse netbooting to load an unauthorized network device operatin
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_software_download_to_network_device_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_software_download_to_network_device_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -86,9 +142,6 @@ This search will also report any legitimate attempts of software downloads to ne
* [Router and Infrastructure Security](/stories/router_and_infrastructure_security)
-#### Kill Chain Phase
-* Delivery
-
#### RBA
@@ -98,13 +151,11 @@ This search will also report any legitimate attempts of software downloads to ne
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-10-28-detect_traffic_mirroring.md b/docs/_posts/2020-10-28-detect_traffic_mirroring.md
index 9765cf0211..f8405f4c7e 100644
--- a/docs/_posts/2020-10-28-detect_traffic_mirroring.md
+++ b/docs/_posts/2020-10-28-detect_traffic_mirroring.md
@@ -34,16 +34,21 @@ We have not been able to test, simulate, or build datasets for this object. Use
Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised network infrastructure. Traffic mirroring is a native feature for some network devices and used for network analysis and may be configured to duplicate traffic and forward to one or more destinations for analysis by a network analyzer or other monitoring device.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-10-28
- **Author**: Mikael Bjerkeland, Splunk
- **ID**: 42b3b753-5925-49c5-9742-36fa40a73990
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -55,6 +60,58 @@ Adversaries may leverage traffic mirroring in order to automate data exfiltratio
| [T1020.001](https://attack.mitre.org/techniques/T1020/001/) | Traffic Duplication | Exfiltration |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Delivery
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* ID.AM
+* PR.DS
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 1
+* CIS 11
+
+
+
+
+
+
+
#### Search
```
@@ -67,10 +124,10 @@ Adversaries may leverage traffic mirroring in order to automate data exfiltratio
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [cisco_networks](https://github.com/splunk/security_content/blob/develop/macros/cisco_networks.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_traffic_mirroring_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_traffic_mirroring_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -89,10 +146,6 @@ This search will return false positives for any legitimate traffic captures by n
* [Router and Infrastructure Security](/stories/router_and_infrastructure_security)
-#### Kill Chain Phase
-* Delivery
-* Actions on Objectives
-
#### RBA
@@ -102,13 +155,11 @@ This search will return false positives for any legitimate traffic captures by n
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-11-06-ryuk_test_files_detected.md b/docs/_posts/2020-11-06-ryuk_test_files_detected.md
index e2b5bcf991..9523f43cb4 100644
--- a/docs/_posts/2020-11-06-ryuk_test_files_detected.md
+++ b/docs/_posts/2020-11-06-ryuk_test_files_detected.md
@@ -23,21 +23,76 @@ tags:
The search looks for files that contain the key word *Ryuk* under any folder in the C drive, which is consistent with Ryuk propagation.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-11-06
- **Author**: Rod Soto, Jose Hernandez, Splunk
- **ID**: 57d44d70-28d9-4ed1-acf5-1c80ae2bbce3
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1486](https://attack.mitre.org/techniques/T1486/) | Data Encrypted for Impact | Impact |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Delivery
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -51,10 +106,10 @@ The search looks for files that contain the key word *Ryuk* under any folder in
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `ryuk_test_files_detected_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **ryuk_test_files_detected_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -73,9 +128,6 @@ If there are files with this keywoord as file names it might trigger false possi
* [Ryuk Ransomware](/stories/ryuk_ransomware)
-#### Kill Chain Phase
-* Delivery
-
#### RBA
@@ -85,13 +137,11 @@ If there are files with this keywoord as file names it might trigger false possi
| 70.0 | 70 | 100 | A creation of ryuk test file $file_path$ in host $dest$ |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-11-06-windows_connhost_exe_started_forcefully.md b/docs/_posts/2020-11-06-windows_connhost_exe_started_forcefully.md
index e0b308b035..ffa3d2b441 100644
--- a/docs/_posts/2020-11-06-windows_connhost_exe_started_forcefully.md
+++ b/docs/_posts/2020-11-06-windows_connhost_exe_started_forcefully.md
@@ -23,21 +23,76 @@ tags:
The search looks for the Console Window Host process (connhost.exe) executed using the force flag -ForceV1. This is not regular behavior in the Windows OS and is often seen executed by the Ryuk Ransomware. DEPRECATED This event is actually seen in the windows 10 client of attack_range_local. After further testing we realized this is not specific to Ryuk.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-11-06
- **Author**: Rod Soto, Jose Hernandez, Splunk
- **ID**: c114aaca-68ee-41c2-ad8c-32bf21db8769
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1059.003](https://attack.mitre.org/techniques/T1059/003/) | Windows Command Shell | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Delivery
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -51,10 +106,10 @@ The search looks for the Console Window Host process (connhost.exe) executed usi
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `windows_connhost_exe_started_forcefully_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **windows_connhost_exe_started_forcefully_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -70,9 +125,6 @@ This process should not be ran forcefully, we have not see any false positives f
* [Ryuk Ransomware](/stories/ryuk_ransomware)
-#### Kill Chain Phase
-* Delivery
-
#### RBA
@@ -82,13 +134,11 @@ This process should not be ran forcefully, we have not see any false positives f
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-11-06-windows_security_account_manager_stopped.md b/docs/_posts/2020-11-06-windows_security_account_manager_stopped.md
index 3e84dae4d9..36c61ed7ff 100644
--- a/docs/_posts/2020-11-06-windows_security_account_manager_stopped.md
+++ b/docs/_posts/2020-11-06-windows_security_account_manager_stopped.md
@@ -23,21 +23,76 @@ tags:
The search looks for a Windows Security Account Manager (SAM) was stopped via command-line. This is consistent with Ryuk infections across a fleet of endpoints.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-11-06
- **Author**: Rod Soto, Jose Hernandez, Splunk
- **ID**: 69c12d59-d951-431e-ab77-ec426b8d65e6
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1489](https://attack.mitre.org/techniques/T1489/) | Service Stop | Impact |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Delivery
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -51,10 +106,10 @@ The search looks for a Windows Security Account Manager (SAM) was stopped via co
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `windows_security_account_manager_stopped_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **windows_security_account_manager_stopped_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -74,9 +129,6 @@ SAM is a critical windows service, stopping it would cause major issues on an en
* [Ryuk Ransomware](/stories/ryuk_ransomware)
-#### Kill Chain Phase
-* Delivery
-
#### RBA
@@ -86,13 +138,11 @@ SAM is a critical windows service, stopping it would cause major issues on an en
| 70.0 | 70 | 100 | The Windows Security Account Manager (SAM) was stopped via cli by $user$ on $dest$ by this command: $processs$ |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-11-09-common_ransomware_extensions.md b/docs/_posts/2020-11-09-common_ransomware_extensions.md
index 97db431465..f02fcac7ba 100644
--- a/docs/_posts/2020-11-09-common_ransomware_extensions.md
+++ b/docs/_posts/2020-11-09-common_ransomware_extensions.md
@@ -24,21 +24,76 @@ tags:
The search looks for file modifications with extensions commonly used by Ransomware
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2020-11-09
- **Author**: David Dorsey, Splunk
- **ID**: a9e5c5db-db11-43ca-86a8-c852d1b2c0ec
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1485](https://attack.mitre.org/techniques/T1485/) | Data Destruction | Impact |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -54,11 +109,11 @@ The search looks for file modifications with extensions commonly used by Ransomw
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [ransomware_extensions](https://github.com/splunk/security_content/blob/develop/macros/ransomware_extensions.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `common_ransomware_extensions_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **common_ransomware_extensions_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -85,9 +140,6 @@ It is possible for a legitimate file with these extensions to be created. If thi
* [Clop Ransomware](/stories/clop_ransomware)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -97,13 +149,11 @@ It is possible for a legitimate file with these extensions to be created. If thi
| 90.0 | 90 | 100 | A file - $file_name$ was written to disk on endpoint $dest$ by user $user$, this is indicative of a known ransomware file extension and should be reviewed immediately. |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-11-09-common_ransomware_notes.md b/docs/_posts/2020-11-09-common_ransomware_notes.md
index 85a6ad80f6..543db29468 100644
--- a/docs/_posts/2020-11-09-common_ransomware_notes.md
+++ b/docs/_posts/2020-11-09-common_ransomware_notes.md
@@ -24,21 +24,76 @@ tags:
The search looks for files created with names matching those typically used in ransomware notes that tell the victim how to get their data back.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2020-11-09
- **Author**: David Dorsey, Splunk
- **ID**: ada0f478-84a8-4641-a3f1-d82362d6bd71
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1485](https://attack.mitre.org/techniques/T1485/) | Data Destruction | Impact |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -53,11 +108,11 @@ The search looks for files created with names matching those typically used in r
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [ransomware_notes](https://github.com/splunk/security_content/blob/develop/macros/ransomware_notes.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `common_ransomware_notes_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **common_ransomware_notes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -80,9 +135,6 @@ It's possible that a legitimate file could be created with the same name used by
* [Clop Ransomware](/stories/clop_ransomware)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -92,13 +144,11 @@ It's possible that a legitimate file could be created with the same name used by
| 90.0 | 90 | 100 | A file - $file_name$ was written to disk on endpoint $dest$ by user $user$, this is indicative of a known ransomware note file and should be reviewed immediately. |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-11-09-deleting_shadow_copies.md b/docs/_posts/2020-11-09-deleting_shadow_copies.md
index 930b4405c1..fa8862e06e 100644
--- a/docs/_posts/2020-11-09-deleting_shadow_copies.md
+++ b/docs/_posts/2020-11-09-deleting_shadow_copies.md
@@ -24,21 +24,78 @@ tags:
The vssadmin.exe utility is used to interact with the Volume Shadow Copy Service. Wmic is an interface to the Windows Management Instrumentation. This search looks for either of these tools being used to delete shadow copies.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2020-11-09
- **Author**: David Dorsey, Splunk
- **ID**: b89919ed-ee5f-492c-b139-95dbb162039e
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1490](https://attack.mitre.org/techniques/T1490/) | Inhibit System Recovery | Impact |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+* PR.IP
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+* CIS 10
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +109,10 @@ The vssadmin.exe utility is used to interact with the Volume Shadow Copy Service
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `deleting_shadow_copies_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **deleting_shadow_copies_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -85,9 +142,6 @@ vssadmin.exe and wmic.exe are standard applications shipped with modern versions
* [Clop Ransomware](/stories/clop_ransomware)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -97,13 +151,11 @@ vssadmin.exe and wmic.exe are standard applications shipped with modern versions
| 81.0 | 90 | 90 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to delete shadow copies. |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-11-09-detect_excessive_account_lockouts_from_endpoint.md b/docs/_posts/2020-11-09-detect_excessive_account_lockouts_from_endpoint.md
index 3a461a3d92..e75d7d4931 100644
--- a/docs/_posts/2020-11-09-detect_excessive_account_lockouts_from_endpoint.md
+++ b/docs/_posts/2020-11-09-detect_excessive_account_lockouts_from_endpoint.md
@@ -33,16 +33,21 @@ tags:
This search identifies endpoints that have caused a relatively high number of account lockouts in a short period.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change)
-
- **Last Updated**: 2020-11-09
- **Author**: David Dorsey, Splunk
- **ID**: c026e3dd-7e18-4abb-8f41-929e836efe74
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -50,6 +55,55 @@ This search identifies endpoints that have caused a relatively high number of ac
| [T1078.002](https://attack.mitre.org/techniques/T1078/002/) | Domain Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* PR.IP
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -65,10 +119,10 @@ This search identifies endpoints that have caused a relatively high number of ac
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_excessive_account_lockouts_from_endpoint_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_excessive_account_lockouts_from_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -92,9 +146,6 @@ It's possible that a widely used system, such as a kiosk, could cause a large nu
* [Account Monitoring and Controls](/stories/account_monitoring_and_controls)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -104,13 +155,11 @@ It's possible that a widely used system, such as a kiosk, could cause a large nu
| 36.0 | 60 | 60 | Multiple accounts have been locked out. Review $dest$ and results related to $user$. |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md b/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md
index 1e1544dfe8..502f692553 100644
--- a/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md
+++ b/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md
@@ -24,21 +24,78 @@ tags:
This search looks for fast execution of processes used for system network configuration discovery on the endpoint.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2020-11-10
- **Author**: Bhavin Patel, Splunk
- **ID**: a51bfe1a-94f0-48cc-b1e4-16ae10145893
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1016](https://attack.mitre.org/techniques/T1016/) | System Network Configuration Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Installation
+* Command & Control
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* ID.AM
+* PR.DS
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 2
+
+
+
+
+
+
+
#### Search
```
@@ -56,11 +113,11 @@ This search looks for fast execution of processes used for system network config
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [system_network_configuration_discovery_tools](https://github.com/splunk/security_content/blob/develop/macros/system_network_configuration_discovery_tools.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_processes_used_for_system_network_configuration_discovery_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_processes_used_for_system_network_configuration_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -87,11 +144,6 @@ It is uncommon for normal users to execute a series of commands used for network
* [Unusual Processes](/stories/unusual_processes)
-#### Kill Chain Phase
-* Installation
-* Command & Control
-* Actions on Objectives
-
#### RBA
@@ -101,13 +153,11 @@ It is uncommon for normal users to execute a series of commands used for network
| 32.0 | 40 | 80 | An instance of $parent_process_name$ spawning multiple $process_name$ was identified on endpoint $dest$ by user $user$ typically not a normal behavior of the process. |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md b/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md
index c7a5b7f98c..31b758e8ec 100644
--- a/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md
+++ b/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md
@@ -27,16 +27,21 @@ tags:
This search looks for executions of cmd.exe spawned by a process that is often abused by attackers and that does not typically launch cmd.exe.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2020-11-10
- **Author**: Bhavin Patel, Splunk
- **ID**: dcfd6b40-42f9-469d-a433-2e53f7486664
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,56 @@ This search looks for executions of cmd.exe spawned by a process that is often a
| [T1059.003](https://attack.mitre.org/techniques/T1059/003/) | Windows Command Shell | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -58,12 +113,12 @@ This search looks for executions of cmd.exe spawned by a process that is often a
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
* [prohibited_apps_launching_cmd](https://github.com/splunk/security_content/blob/develop/macros/prohibited_apps_launching_cmd.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
-Note that `detect_prohibited_applications_spawning_cmd_exe_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_prohibited_applications_spawning_cmd_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -93,9 +148,6 @@ There are circumstances where an application may legitimately execute and intera
* [NOBELIUM Group](/stories/nobelium_group)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -105,13 +157,11 @@ There are circumstances where an application may legitimately execute and intera
| 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ running prohibited applications. |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-11-18-disabling_remote_user_account_control.md b/docs/_posts/2020-11-18-disabling_remote_user_account_control.md
index bf337dca1b..134244855f 100644
--- a/docs/_posts/2020-11-18-disabling_remote_user_account_control.md
+++ b/docs/_posts/2020-11-18-disabling_remote_user_account_control.md
@@ -28,16 +28,21 @@ tags:
The search looks for modifications to registry keys that control the enforcement of Windows User Account Control (UAC).
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-11-18
- **Author**: David Dorsey, Patrick Bareiss, Splunk
- **ID**: bbc644bc-37df-4e1a-9c88-ec9a53e2038c
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -45,6 +50,56 @@ The search looks for modifications to registry keys that control the enforcement
| [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -58,7 +113,7 @@ The search looks for modifications to registry keys that control the enforcement
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `disabling_remote_user_account_control_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **disabling_remote_user_account_control_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -83,9 +138,6 @@ This registry key may be modified via administrators to implement a change in sy
* [Windows Registry Abuse](/stories/windows_registry_abuse)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -95,13 +147,11 @@ This registry key may be modified via administrators to implement a change in sy
| 42.0 | 70 | 60 | The Windows registry keys that control the enforcement of Windows User Account Control (UAC) were modified on $dest$ by $user$. |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-11-18-execution_of_file_with_multiple_extensions.md b/docs/_posts/2020-11-18-execution_of_file_with_multiple_extensions.md
index 12c2392339..7c6c0f01f0 100644
--- a/docs/_posts/2020-11-18-execution_of_file_with_multiple_extensions.md
+++ b/docs/_posts/2020-11-18-execution_of_file_with_multiple_extensions.md
@@ -27,16 +27,21 @@ tags:
This search looks for processes launched from files that have double extensions in the file name. This is typically done to obscure the "real" file extension and make it appear as though the file being accessed is a data file, as opposed to executable content.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2020-11-18
- **Author**: Rico Valdez, Splunk
- **ID**: b06a555e-dce0-417d-a2eb-28a5d8d66ef7
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,58 @@ This search looks for processes launched from files that have double extensions
| [T1036.003](https://attack.mitre.org/techniques/T1036/003/) | Rename System Utilities | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+* PR.PT
+* PR.IP
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +114,10 @@ This search looks for processes launched from files that have double extensions
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `execution_of_file_with_multiple_extensions_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **execution_of_file_with_multiple_extensions_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -81,9 +138,6 @@ None identified.
* [Masquerading - Rename System Utilities](/stories/masquerading_-_rename_system_utilities)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -93,13 +147,11 @@ None identified.
| 56.0 | 80 | 70 | process $process$ have double extensions in the file name is executed on $dest$ by $user$ |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-11-19-execution_of_file_with_spaces_before_extension.md b/docs/_posts/2020-11-19-execution_of_file_with_spaces_before_extension.md
index 256a09e976..87ee25c640 100644
--- a/docs/_posts/2020-11-19-execution_of_file_with_spaces_before_extension.md
+++ b/docs/_posts/2020-11-19-execution_of_file_with_spaces_before_extension.md
@@ -24,21 +24,78 @@ tags:
This search looks for processes launched from files with at least five spaces in the name before the extension. This is typically done to obfuscate the file extension by pushing it outside of the default view.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2020-11-19
- **Author**: Rico Valdez, Splunk
- **ID**: ab0353e6-a956-420b-b724-a8b4846d5d5a
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1036.003](https://attack.mitre.org/techniques/T1036/003/) | Rename System Utilities | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+* PR.PT
+* PR.IP
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +109,10 @@ This search looks for processes launched from files with at least five spaces in
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `execution_of_file_with_spaces_before_extension_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **execution_of_file_with_spaces_before_extension_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -77,9 +134,6 @@ None identified.
* [Masquerading - Rename System Utilities](/stories/masquerading_-_rename_system_utilities)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -89,13 +143,11 @@ None identified.
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-11-23-processes_created_by_netsh.md b/docs/_posts/2020-11-23-processes_created_by_netsh.md
index 405d4bb774..18a23c62e3 100644
--- a/docs/_posts/2020-11-23-processes_created_by_netsh.md
+++ b/docs/_posts/2020-11-23-processes_created_by_netsh.md
@@ -24,21 +24,76 @@ tags:
This search looks for processes launching netsh.exe to execute various commands via the netsh command-line utility. Netsh.exe is a command-line scripting utility that allows you to, either locally or remotely, display or modify the network configuration of a computer that is currently running. Netsh can be used as a persistence proxy technique to execute a helper .dll when netsh.exe is executed. In this search, we are looking for processes spawned by netsh.exe that are executing commands via the command line. Deprecated because we have another detection of the same type.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2020-11-23
- **Author**: Bhavin Patel, Splunk
- **ID**: b89919ed-fe5f-492c-b139-95dbb162041e
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1562.004](https://attack.mitre.org/techniques/T1562/004/) | Disable or Modify System Firewall | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +107,10 @@ This search looks for processes launching netsh.exe to execute various commands
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `processes_created_by_netsh_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **processes_created_by_netsh_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -71,9 +126,6 @@ It is unusual for netsh.exe to have any child processes in most environments. It
* [Netsh Abuse](/stories/netsh_abuse)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -83,13 +135,11 @@ It is unusual for netsh.exe to have any child processes in most environments. It
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-11-23-shim_database_installation_with_suspicious_parameters.md b/docs/_posts/2020-11-23-shim_database_installation_with_suspicious_parameters.md
index d85334dab8..6bd8aaf93b 100644
--- a/docs/_posts/2020-11-23-shim_database_installation_with_suspicious_parameters.md
+++ b/docs/_posts/2020-11-23-shim_database_installation_with_suspicious_parameters.md
@@ -29,16 +29,21 @@ tags:
This search detects the process execution and arguments required to silently create a shim database. The sdbinst.exe application is used to install shim database files (.sdb). A shim is a small library which transparently intercepts an API, changes the parameters passed, handles the operation itself, or redirects the operation elsewhere.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2020-11-23
- **Author**: David Dorsey, Splunk
- **ID**: 404620de-46d8-48b6-90cc-8a8d7b0876a3
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,55 @@ This search detects the process execution and arguments required to silently cre
| [T1546](https://attack.mitre.org/techniques/T1546/) | Event Triggered Execution | Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -59,10 +113,10 @@ This search detects the process execution and arguments required to silently cre
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `shim_database_installation_with_suspicious_parameters_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **shim_database_installation_with_suspicious_parameters_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -82,9 +136,6 @@ None identified
* [Windows Persistence Techniques](/stories/windows_persistence_techniques)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -94,13 +145,11 @@ None identified
| 63.0 | 70 | 90 | A process $process_name$ that possible create a shim db silently in host $dest$ |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md b/docs/_posts/2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md
index 7024a166ca..bc69dca97c 100644
--- a/docs/_posts/2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md
+++ b/docs/_posts/2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md
@@ -31,16 +31,21 @@ tags:
The search looks for reg.exe modifying registry keys that define Windows services and their configurations.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2020-11-26
- **Author**: Rico Valdez, Splunk
- **ID**: 8470d755-0c13-45b3-bd63-387a373c10cf
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -48,6 +53,61 @@ The search looks for reg.exe modifying registry keys that define Windows service
| [T1574](https://attack.mitre.org/techniques/T1574/) | Hijack Execution Flow | Defense Evasion, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Installation
+
+
+
+
+
+
+NIST
+ +
+
+* PR.IP
+* PR.PT
+* PR.AC
+* PR.AT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -61,10 +121,10 @@ The search looks for reg.exe modifying registry keys that define Windows service
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `reg_exe_manipulating_windows_services_registry_keys_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **reg_exe_manipulating_windows_services_registry_keys_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -88,9 +148,6 @@ It is unusual for a service to be created or modified by directly manipulating t
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Installation
-
#### RBA
@@ -100,13 +157,11 @@ It is unusual for a service to be created or modified by directly manipulating t
| 45.0 | 75 | 60 | A reg.exe process $process_name$ with commandline $process$ in host $dest$ |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-12-07-schtasks_used_for_forcing_a_reboot.md b/docs/_posts/2020-12-07-schtasks_used_for_forcing_a_reboot.md
index 6c60273063..28e8dc1375 100644
--- a/docs/_posts/2020-12-07-schtasks_used_for_forcing_a_reboot.md
+++ b/docs/_posts/2020-12-07-schtasks_used_for_forcing_a_reboot.md
@@ -31,16 +31,21 @@ tags:
This search looks for flags passed to schtasks.exe on the command-line that indicate that a forced reboot of system is scheduled.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2020-12-07
- **Author**: Bhavin Patel, Splunk
- **ID**: 1297fb80-f42a-4b4a-9c8a-88c066437cf6
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -48,6 +53,55 @@ This search looks for flags passed to schtasks.exe on the command-line that indi
| [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.IP
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+
+
+
+
+
+
+
#### Search
```
@@ -61,10 +115,10 @@ This search looks for flags passed to schtasks.exe on the command-line that indi
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `schtasks_used_for_forcing_a_reboot_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **schtasks_used_for_forcing_a_reboot_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -86,9 +140,6 @@ Administrators may create jobs on systems forcing reboots to perform updates, ma
* [Ransomware](/stories/ransomware)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -98,13 +149,11 @@ Administrators may create jobs on systems forcing reboots to perform updates, ma
| 56.0 | 70 | 80 | A schedule task process $process_name$ with force reboot commandline $process$ in host $dest$ |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-12-08-shim_database_file_creation.md b/docs/_posts/2020-12-08-shim_database_file_creation.md
index 42aaca586d..ad652b1afd 100644
--- a/docs/_posts/2020-12-08-shim_database_file_creation.md
+++ b/docs/_posts/2020-12-08-shim_database_file_creation.md
@@ -28,16 +28,21 @@ tags:
This search looks for shim database files being written to default directories. The sdbinst.exe application is used to install shim database files (.sdb). According to Microsoft, a shim is a small library that transparently intercepts an API, changes the parameters passed, handles the operation itself, or redirects the operation elsewhere.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-12-08
- **Author**: David Dorsey, Splunk
- **ID**: 6e4c4588-ba2f-42fa-97e6-9f6f548eaa33
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -45,6 +50,55 @@ This search looks for shim database files being written to default directories.
| [T1546](https://attack.mitre.org/techniques/T1546/) | Event Triggered Execution | Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -58,10 +112,10 @@ This search looks for shim database files being written to default directories.
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `shim_database_file_creation_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **shim_database_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -81,9 +135,6 @@ Because legitimate shim files are created and used all the time, this event, in
* [Windows Persistence Techniques](/stories/windows_persistence_techniques)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -93,13 +144,11 @@ Because legitimate shim files are created and used all the time, this event, in
| 56.0 | 70 | 80 | A process that possibly write shim database in $file_path$ in host $dest$ |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-12-08-single_letter_process_on_endpoint.md b/docs/_posts/2020-12-08-single_letter_process_on_endpoint.md
index c0a50a59f6..b5ea8e9863 100644
--- a/docs/_posts/2020-12-08-single_letter_process_on_endpoint.md
+++ b/docs/_posts/2020-12-08-single_letter_process_on_endpoint.md
@@ -27,16 +27,21 @@ tags:
This search looks for process names that consist only of a single letter.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2020-12-08
- **Author**: David Dorsey, Splunk
- **ID**: a4214f0b-e01c-41bc-8cc4-d2b71e3056b4
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,56 @@ This search looks for process names that consist only of a single letter.
| [T1204.002](https://attack.mitre.org/techniques/T1204/002/) | Malicious File | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* ID.AM
+* PR.DS
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 2
+
+
+
+
+
+
+
#### Search
```
@@ -60,10 +115,10 @@ This search looks for process names that consist only of a single letter.
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `single_letter_process_on_endpoint_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **single_letter_process_on_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -83,9 +138,6 @@ Single-letter executables are not always malicious. Investigate this activity wi
* [DHS Report TA18-074A](/stories/dhs_report_ta18-074a)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -95,13 +147,11 @@ Single-letter executables are not always malicious. Investigate this activity wi
| 63.0 | 70 | 90 | A suspicious process $process_name$ with single letter in host $dest$ |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md b/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md
index 35d3282a0d..c66624c3ed 100644
--- a/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md
+++ b/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md
@@ -29,16 +29,21 @@ This search looks for system processes that typically execute from `C:\Windows\S
This detection utilizes a lookup that is deduped `system32` and `syswow64` directories from Server 2016 and Windows 10.\
During triage, review the parallel processes - what process moved the native Windows binary? identify any artifacts on disk and review. If a remote destination is contacted, what is the reputation?
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2020-12-08
- **Author**: David Dorsey, Michael Haag, Splunk
- **ID**: a34aae96-ccf8-4aef-952c-3ea21444444d
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,56 @@ During triage, review the parallel processes - what process moved the native Win
| [T1036.003](https://attack.mitre.org/techniques/T1036/003/) | Rename System Utilities | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -60,11 +115,11 @@ During triage, review the parallel processes - what process moved the native Win
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [is_windows_system_file](https://github.com/splunk/security_content/blob/develop/macros/is_windows_system_file.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `system_processes_run_from_unexpected_locations_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **system_processes_run_from_unexpected_locations_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -90,9 +145,6 @@ This detection may require tuning based on third party applications utilizing na
* [Masquerading - Rename System Utilities](/stories/masquerading_-_rename_system_utilities)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -102,8 +154,6 @@ This detection may require tuning based on third party applications utilizing na
| 49.0 | 70 | 70 | System process running from unexpected location on $dest$ |
-
-
#### Reference
* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml)
@@ -112,7 +162,7 @@ This detection may require tuning based on third party applications utilizing na
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-12-08-unusually_long_command_line.md b/docs/_posts/2020-12-08-unusually_long_command_line.md
index 043ed8eb39..fb85f45b4f 100644
--- a/docs/_posts/2020-12-08-unusually_long_command_line.md
+++ b/docs/_posts/2020-12-08-unusually_long_command_line.md
@@ -22,14 +22,71 @@ We have not been able to test, simulate, or build datasets for this object. Use
Command lines that are extremely long may be indicative of malicious activity on your hosts.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-12-08
- **Author**: David Dorsey, Splunk
- **ID**: c77162d3-f93c-45cc-80c8-22f6a4264e7f
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -48,10 +105,10 @@ Command lines that are extremely long may be indicative of malicious activity on
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `unusually_long_command_line_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **unusually_long_command_line_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -74,9 +131,6 @@ Some legitimate applications start with long command lines.
* [Ransomware](/stories/ransomware)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -86,13 +140,11 @@ Some legitimate applications start with long command lines.
| 42.0 | 70 | 60 | Unusually long command line $Processes.process_name$ on $dest$ |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-12-08-wmi_permanent_event_subscription_-_sysmon.md b/docs/_posts/2020-12-08-wmi_permanent_event_subscription_-_sysmon.md
index c9dfd7f685..7d6bea5162 100644
--- a/docs/_posts/2020-12-08-wmi_permanent_event_subscription_-_sysmon.md
+++ b/docs/_posts/2020-12-08-wmi_permanent_event_subscription_-_sysmon.md
@@ -33,16 +33,21 @@ All event subscriptions have three components \
1. Binding - Registers a filter to a consumer. EventID = 21 \
Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToConsumerBinding. It may be pertinent to review all 3 to identify the flow of execution. In addition, EventCode 4104 may assist with any other PowerShell script usage that registered the subscription.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-12-08
- **Author**: Rico Valdez, Michael Haag, Splunk
- **ID**: ad05aae6-3b2a-4f73-af97-57bd26cee3b9
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -50,6 +55,59 @@ Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToCons
| [T1546](https://attack.mitre.org/techniques/T1546/) | Event Triggered Execution | Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* PR.AT
+* PR.AC
+* PR.IP
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+
+
+
+
+
+
+
#### Search
```
@@ -63,7 +121,7 @@ Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToCons
The SPL above uses the following Macros:
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
-Note that `wmi_permanent_event_subscription_-_sysmon_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **wmi_permanent_event_subscription_-_sysmon_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -87,9 +145,6 @@ Although unlikely, administrators may use event subscriptions for legitimate pur
* [Suspicious WMI Use](/stories/suspicious_wmi_use)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -99,8 +154,6 @@ Although unlikely, administrators may use event subscriptions for legitimate pur
| 30.0 | 30 | 100 | User $user$ on $host$ executed the following suspicious WMI query: $Query$. Filter: $filter$. Consumer: $Consumer$. EventCode: $EventCode$ |
-
-
#### Reference
* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.003/T1546.003.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.003/T1546.003.md)
@@ -111,7 +164,7 @@ Although unlikely, administrators may use event subscriptions for legitimate pur
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md b/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md
index 4bc37c2866..0aa0abaa98 100644
--- a/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md
+++ b/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md
@@ -25,21 +25,76 @@ We have not been able to test, simulate, or build datasets for this object. Use
The malware sunburst will load the malicious dll by SolarWinds.BusinessLayerHost.exe. After a period of 12-14 days, the malware will attempt to resolve a subdomain of avsvmcloud.com. This detections will correlate both events.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-12-14
- **Author**: Patrick Bareiss, Splunk
- **ID**: 701a8740-e8db-40df-9190-5516d3819787
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1203](https://attack.mitre.org/techniques/T1203/) | Exploitation for Client Execution | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 6
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -55,10 +110,10 @@ The malware sunburst will load the malicious dll by SolarWinds.BusinessLayerHost
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `sunburst_correlation_dll_and_network_event_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **sunburst_correlation_dll_and_network_event_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -77,9 +132,6 @@ unknown
* [NOBELIUM Group](/stories/nobelium_group)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -89,8 +141,6 @@ unknown
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
* [https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html](https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html)
@@ -98,7 +148,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-12-15-o365_suspicious_rights_delegation.md b/docs/_posts/2020-12-15-o365_suspicious_rights_delegation.md
index f93b834795..fc881e7ca1 100644
--- a/docs/_posts/2020-12-15-o365_suspicious_rights_delegation.md
+++ b/docs/_posts/2020-12-15-o365_suspicious_rights_delegation.md
@@ -26,16 +26,21 @@ tags:
This search detects the assignment of rights to accesss content from another mailbox. This is usually only assigned to a service account.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-12-15
- **Author**: Patrick Bareiss, Splunk
- **ID**: b25d2973-303e-47c8-bacd-52b61604c6a7
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,56 @@ This search detects the assignment of rights to accesss content from another mai
| [T1114](https://attack.mitre.org/techniques/T1114/) | Email Collection | Collection |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.DP
+* DE.AE
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -58,10 +113,10 @@ This search detects the assignment of rights to accesss content from another mai
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `o365_suspicious_rights_delegation_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **o365_suspicious_rights_delegation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -79,9 +134,6 @@ Service Accounts
* [Office 365 Detections](/stories/office_365_detections)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -91,13 +143,11 @@ Service Accounts
| 48.0 | 80 | 60 | User $user$ has delegated suspicious rights $AccessRights$ to user $dest_user$ that allow access to sensitive |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-12-16-high_number_of_login_failures_from_a_single_source.md b/docs/_posts/2020-12-16-high_number_of_login_failures_from_a_single_source.md
index f5b6b4eba8..6695f32192 100644
--- a/docs/_posts/2020-12-16-high_number_of_login_failures_from_a_single_source.md
+++ b/docs/_posts/2020-12-16-high_number_of_login_failures_from_a_single_source.md
@@ -28,16 +28,21 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search will detect more than 5 login failures in Office365 Azure Active Directory from a single source IP address. Please adjust the threshold value of 5 as suited for your environment.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-12-16
- **Author**: Bhavin Patel, Splunk
- **ID**: 7f398cfb-918d-41f4-8db8-2e2474e02222
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -45,6 +50,56 @@ This search will detect more than 5 login failures in Office365 Azure Active Dir
| [T1110](https://attack.mitre.org/techniques/T1110/) | Brute Force | Credential Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.DP
+* DE.AE
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -58,7 +113,7 @@ This search will detect more than 5 login failures in Office365 Azure Active Dir
The SPL above uses the following Macros:
* [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml)
-Note that `high_number_of_login_failures_from_a_single_source_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **high_number_of_login_failures_from_a_single_source_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +139,6 @@ unknown
* [Office 365 Detections](/stories/office_365_detections)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -96,13 +148,11 @@ unknown
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-12-16-o365_pst_export_alert.md b/docs/_posts/2020-12-16-o365_pst_export_alert.md
index 96c454b844..a7bc06c011 100644
--- a/docs/_posts/2020-12-16-o365_pst_export_alert.md
+++ b/docs/_posts/2020-12-16-o365_pst_export_alert.md
@@ -23,21 +23,71 @@ tags:
This search detects when a user has performed an Ediscovery search or exported a PST file from the search. This PST file usually has sensitive information including email body content
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-12-16
- **Author**: Rod Soto, Splunk
- **ID**: 5f694cc4-a678-4a60-9410-bffca1b647dc
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1114](https://attack.mitre.org/techniques/T1114/) | Email Collection | Collection |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -50,10 +100,10 @@ This search detects when a user has performed an Ediscovery search or exported a
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `o365_pst_export_alert_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **o365_pst_export_alert_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -76,9 +126,6 @@ PST export can be done for legitimate purposes but due to the sensitive nature o
* [Data Exfiltration](/stories/data_exfiltration)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -88,8 +135,6 @@ PST export can be done for legitimate purposes but due to the sensitive nature o
| 48.0 | 80 | 60 | User $Source$ has exported a PST file from the search using this operation- $Operation$ with a severity of $Severity$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1114/](https://attack.mitre.org/techniques/T1114/)
@@ -97,7 +142,7 @@ PST export can be done for legitimate purposes but due to the sensitive nature o
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-12-16-o365_suspicious_admin_email_forwarding.md b/docs/_posts/2020-12-16-o365_suspicious_admin_email_forwarding.md
index 3a8dcf21c7..b3a5e29bb6 100644
--- a/docs/_posts/2020-12-16-o365_suspicious_admin_email_forwarding.md
+++ b/docs/_posts/2020-12-16-o365_suspicious_admin_email_forwarding.md
@@ -26,16 +26,21 @@ tags:
This search detects when an admin configured a forwarding rule for multiple mailboxes to the same destination.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-12-16
- **Author**: Patrick Bareiss, Splunk
- **ID**: 7f398cfb-918d-41f4-8db8-2e2474e02c28
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,56 @@ This search detects when an admin configured a forwarding rule for multiple mail
| [T1114](https://attack.mitre.org/techniques/T1114/) | Email Collection | Collection |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.DP
+* DE.AE
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -59,10 +114,10 @@ This search detects when an admin configured a forwarding rule for multiple mail
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `o365_suspicious_admin_email_forwarding_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **o365_suspicious_admin_email_forwarding_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -81,9 +136,6 @@ unknown
* [Data Exfiltration](/stories/data_exfiltration)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -93,13 +145,11 @@ unknown
| 48.0 | 80 | 60 | User $user$ has configured a forwarding rule for multiple mailboxes to the same destination $ForwardingAddress$ |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-12-16-o365_suspicious_user_email_forwarding.md b/docs/_posts/2020-12-16-o365_suspicious_user_email_forwarding.md
index d6c7d58a8e..86a3931e47 100644
--- a/docs/_posts/2020-12-16-o365_suspicious_user_email_forwarding.md
+++ b/docs/_posts/2020-12-16-o365_suspicious_user_email_forwarding.md
@@ -26,16 +26,21 @@ tags:
This search detects when multiple user configured a forwarding rule to the same destination.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2020-12-16
- **Author**: Patrick Bareiss, Splunk
- **ID**: f8dfe015-dbb3-4569-ba75-b13787e06aa4
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,56 @@ This search detects when multiple user configured a forwarding rule to the same
| [T1114](https://attack.mitre.org/techniques/T1114/) | Email Collection | Collection |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.DP
+* DE.AE
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -59,10 +114,10 @@ This search detects when multiple user configured a forwarding rule to the same
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `o365_suspicious_user_email_forwarding_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **o365_suspicious_user_email_forwarding_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -81,9 +136,6 @@ unknown
* [Data Exfiltration](/stories/data_exfiltration)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -93,13 +145,11 @@ unknown
| 48.0 | 80 | 60 | User $user$ configured multiple users $src_user$ with a count of $count_src_user$, a forwarding rule to same destination $ForwardingSmtpAddress$ |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2020-12-21-bcdedit_failure_recovery_modification.md b/docs/_posts/2020-12-21-bcdedit_failure_recovery_modification.md
index 34be73c04b..447549f4e1 100644
--- a/docs/_posts/2020-12-21-bcdedit_failure_recovery_modification.md
+++ b/docs/_posts/2020-12-21-bcdedit_failure_recovery_modification.md
@@ -24,21 +24,75 @@ tags:
This search looks for flags passed to bcdedit.exe modifications to the built-in Windows error recovery boot configurations. This is typically used by ransomware to prevent recovery.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2020-12-21
- **Author**: Michael Haag, Splunk
- **ID**: 809b31d2-5462-11eb-ae93-0242ac130002
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1490](https://attack.mitre.org/techniques/T1490/) | Inhibit System Recovery | Impact |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.IP
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +106,10 @@ This search looks for flags passed to bcdedit.exe modifications to the built-in
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `bcdedit_failure_recovery_modification_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **bcdedit_failure_recovery_modification_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -77,9 +131,6 @@ Administrators may modify the boot configuration.
* [Ransomware](/stories/ransomware)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -89,8 +140,6 @@ Administrators may modify the boot configuration.
| 80.0 | 100 | 80 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting disable the ability to recover the endpoint. |
-
-
#### Reference
* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-4---windows---disable-windows-recovery-console-repair](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-4---windows---disable-windows-recovery-console-repair)
@@ -98,7 +147,7 @@ Administrators may modify the boot configuration.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-01-06-supernova_webshell.md b/docs/_posts/2021-01-06-supernova_webshell.md
index fa160d0d34..3b00b01d2b 100644
--- a/docs/_posts/2021-01-06-supernova_webshell.md
+++ b/docs/_posts/2021-01-06-supernova_webshell.md
@@ -26,21 +26,81 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search aims to detect the Supernova webshell used in the SUNBURST attack.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Web](https://docs.splunk.com/Documentation/CIM/latest/User/Web)
-
- **Last Updated**: 2021-01-06
- **Author**: John Stoner, Splunk
- **ID**: 2ec08a09-9ff1-4dac-b59f-1efd57972ec1
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1505.003](https://attack.mitre.org/techniques/T1505/003/) | Web Shell | Persistence |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* PR.DS
+* ID.RA
+* PR.PT
+* PR.IP
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 4
+* CIS 13
+* CIS 18
+
+
+
+
+
+
+
#### Search
```
@@ -53,7 +113,7 @@ This search aims to detect the Supernova webshell used in the SUNBURST attack.
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `supernova_webshell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **supernova_webshell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -75,9 +135,6 @@ There might be false positives associted with this detection since items like ar
* [NOBELIUM Group](/stories/nobelium_group)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -87,8 +144,6 @@ There might be false positives associted with this detection since items like ar
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
* [https://www.splunk.com/en_us/blog/security/detecting-supernova-malware-solarwinds-continued.html](https://www.splunk.com/en_us/blog/security/detecting-supernova-malware-solarwinds-continued.html)
@@ -97,7 +152,7 @@ There might be false positives associted with this detection since items like ar
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-01-11-aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.md b/docs/_posts/2021-01-11-aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.md
index 91768c6df4..32c4fc9331 100644
--- a/docs/_posts/2021-01-11-aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.md
+++ b/docs/_posts/2021-01-11-aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.md
@@ -23,21 +23,71 @@ tags:
This search provides detection of KMS keys where action kms:Encrypt is accessible for everyone (also outside of your organization). This is an indicator that your account is compromised and the attacker uses the encryption key to compromise another company.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-01-11
- **Author**: Rod Soto, Patrick Bareiss Splunk
- **ID**: c79c164f-4b21-4847-98f9-cf6a9f49179e
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1486](https://attack.mitre.org/techniques/T1486/) | Data Encrypted for Impact | Impact |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +107,10 @@ This search provides detection of KMS keys where action kms:Encrypt is accessibl
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `aws_detect_users_creating_keys_with_encrypt_policy_without_mfa_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **aws_detect_users_creating_keys_with_encrypt_policy_without_mfa_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -82,9 +132,6 @@ unknown
* [Ransomware Cloud](/stories/ransomware_cloud)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -94,8 +141,6 @@ unknown
| 25.0 | 50 | 50 | AWS account is potentially compromised and user $userIdentity.principalId$ is trying to compromise other accounts. |
-
-
#### Reference
* [https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/](https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/)
@@ -105,7 +150,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-01-11-aws_detect_users_with_kms_keys_performing_encryption_s3.md b/docs/_posts/2021-01-11-aws_detect_users_with_kms_keys_performing_encryption_s3.md
index b380812b43..aa8a2bf23f 100644
--- a/docs/_posts/2021-01-11-aws_detect_users_with_kms_keys_performing_encryption_s3.md
+++ b/docs/_posts/2021-01-11-aws_detect_users_with_kms_keys_performing_encryption_s3.md
@@ -23,21 +23,71 @@ tags:
This search provides detection of users with KMS keys performing encryption specifically against S3 buckets.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-01-11
- **Author**: Rod Soto, Patrick Bareiss Splunk
- **ID**: 884a5f59-eec7-4f4a-948b-dbde18225fdc
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1486](https://attack.mitre.org/techniques/T1486/) | Data Encrypted for Impact | Impact |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -51,10 +101,10 @@ This search provides detection of users with KMS keys performing encryption spec
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `aws_detect_users_with_kms_keys_performing_encryption_s3_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **aws_detect_users_with_kms_keys_performing_encryption_s3_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -77,9 +127,6 @@ bucket with S3 encryption
* [Ransomware Cloud](/stories/ransomware_cloud)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -89,8 +136,6 @@ bucket with S3 encryption
| 15.0 | 30 | 50 | User $user$ with KMS keys is performing encryption, against S3 buckets on these files $dest_file$ |
-
-
#### Reference
* [https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/](https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/)
@@ -100,7 +145,7 @@ bucket with S3 encryption
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-01-11-aws_network_access_control_list_created_with_all_open_ports.md b/docs/_posts/2021-01-11-aws_network_access_control_list_created_with_all_open_ports.md
index fd761f577b..c3854cdbd8 100644
--- a/docs/_posts/2021-01-11-aws_network_access_control_list_created_with_all_open_ports.md
+++ b/docs/_posts/2021-01-11-aws_network_access_control_list_created_with_all_open_ports.md
@@ -26,16 +26,21 @@ tags:
The search looks for AWS CloudTrail events to detect if any network ACLs were created with all the ports open to a specified CIDR.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-01-11
- **Author**: Bhavin Patel, Patrick Bareiss, Splunk
- **ID**: ada0f478-84a8-4641-a3f1-d82362d6bd75
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,56 @@ The search looks for AWS CloudTrail events to detect if any network ACLs were cr
| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.DP
+* DE.AE
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 11
+
+
+
+
+
+
+
#### Search
```
@@ -59,10 +114,10 @@ The search looks for AWS CloudTrail events to detect if any network ACLs were cr
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `aws_network_access_control_list_created_with_all_open_ports_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **aws_network_access_control_list_created_with_all_open_ports_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -88,9 +143,6 @@ It's possible that an admin has created this ACL with all ports open for some le
* [AWS Network ACL Activity](/stories/aws_network_acl_activity)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -100,13 +152,11 @@ It's possible that an admin has created this ACL with all ports open for some le
| 48.0 | 60 | 80 | User $user_arn$ has created network ACLs with all the ports open to a specified CIDR $requestParameters.cidrBlock$ |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-01-12-aws_network_access_control_list_deleted.md b/docs/_posts/2021-01-12-aws_network_access_control_list_deleted.md
index 9c0b070eaf..6a01a575a2 100644
--- a/docs/_posts/2021-01-12-aws_network_access_control_list_deleted.md
+++ b/docs/_posts/2021-01-12-aws_network_access_control_list_deleted.md
@@ -26,16 +26,21 @@ tags:
Enforcing network-access controls is one of the defensive mechanisms used by cloud administrators to restrict access to a cloud instance. After the attacker has gained control of the AWS console by compromising an admin account, they can delete a network ACL and gain access to the instance from anywhere. This search will query the AWS CloudTrail logs to detect users deleting network ACLs.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-01-12
- **Author**: Bhavin Patel, Patrick Bareiss, Splunk
- **ID**: ada0f478-84a8-4641-a3f1-d82362d6fd75
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,56 @@ Enforcing network-access controls is one of the defensive mechanisms used by clo
| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.DP
+* DE.AE
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 11
+
+
+
+
+
+
+
#### Search
```
@@ -56,10 +111,10 @@ Enforcing network-access controls is one of the defensive mechanisms used by clo
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `aws_network_access_control_list_deleted_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **aws_network_access_control_list_deleted_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -81,9 +136,6 @@ It's possible that a user has legitimately deleted a network ACL.
* [AWS Network ACL Activity](/stories/aws_network_acl_activity)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -93,13 +145,11 @@ It's possible that a user has legitimately deleted a network ACL.
| 5.0 | 10 | 50 | User $user_arn$ from $src$ has sucessfully deleted network ACLs entry (eventName= $eventName$), such that the instance is accessible from anywhere |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md b/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md
index 6b68c6b38f..4f82c754df 100644
--- a/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md
+++ b/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md
@@ -24,21 +24,76 @@ tags:
The following analytic identifies microsoft.workflow.compiler.exe usage. microsoft.workflow.compiler.exe is natively found in C:\Windows\Microsoft.NET\Framework64\v4.0.30319 and is rarely utilized. When investigating, identify the executed code on disk and review. It is not a commonly used process by many applications.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-01-12
- **Author**: Michael Haag, Splunk
- **ID**: 9bbc62e8-55d8-11eb-ae93-0242ac130002
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1127](https://attack.mitre.org/techniques/T1127/) | Trusted Developer Utilities Proxy Execution | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -52,11 +107,11 @@ The following analytic identifies microsoft.workflow.compiler.exe usage. microso
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_microsoftworkflowcompiler](https://github.com/splunk/security_content/blob/develop/macros/process_microsoftworkflowcompiler.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `suspicious_microsoft_workflow_compiler_usage_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **suspicious_microsoft_workflow_compiler_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +139,6 @@ Although unlikely, limited instances have been identified coming from native Mic
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -96,8 +148,6 @@ Although unlikely, limited instances have been identified coming from native Mic
| 35.0 | 70 | 50 | Suspicious microsoft.workflow.compiler.exe process ran on $dest$ by $user$ |
-
-
#### Reference
* [https://lolbas-project.github.io/lolbas/Binaries/Msbuild/](https://lolbas-project.github.io/lolbas/Binaries/Msbuild/)
@@ -106,7 +156,7 @@ Although unlikely, limited instances have been identified coming from native Mic
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-01-12-suspicious_msbuild_rename.md b/docs/_posts/2021-01-12-suspicious_msbuild_rename.md
index 715ca58c96..d8e42916be 100644
--- a/docs/_posts/2021-01-12-suspicious_msbuild_rename.md
+++ b/docs/_posts/2021-01-12-suspicious_msbuild_rename.md
@@ -33,16 +33,21 @@ tags:
The following analytic identifies renamed instances of msbuild.exe executing. Msbuild.exe is natively found in C:\Windows\Microsoft.NET\Framework\v4.0.30319 and C:\Windows\Microsoft.NET\Framework64\v4.0.30319. During investigation, identify the code executed and what is executing a renamed instance of MSBuild.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-01-12
- **Author**: Michael Haag, Splunk
- **ID**: 4006adac-5937-11eb-ae93-0242ac130002
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -54,6 +59,56 @@ The following analytic identifies renamed instances of msbuild.exe executing. Ms
| [T1127.001](https://attack.mitre.org/techniques/T1127/001/) | MSBuild | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -67,11 +122,11 @@ The following analytic identifies renamed instances of msbuild.exe executing. Ms
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `suspicious_msbuild_rename_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **suspicious_msbuild_rename_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -101,9 +156,6 @@ Although unlikely, some legitimate applications may use a moved copy of msbuild,
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -113,8 +165,6 @@ Although unlikely, some legitimate applications may use a moved copy of msbuild,
| 63.0 | 70 | 90 | Suspicious renamed msbuild.exe binary ran on $dest$ by $user$ |
-
-
#### Reference
* [https://lolbas-project.github.io/lolbas/Binaries/Msbuild/](https://lolbas-project.github.io/lolbas/Binaries/Msbuild/)
@@ -124,7 +174,7 @@ Although unlikely, some legitimate applications may use a moved copy of msbuild,
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md b/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md
index 13416dc6ad..dee294e18d 100644
--- a/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md
+++ b/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md
@@ -27,16 +27,21 @@ tags:
The following analytic identifies wmiprvse.exe spawning msbuild.exe. This behavior is indicative of a COM object being utilized to spawn msbuild from wmiprvse.exe. It is common for MSBuild.exe to be spawned from devenv.exe while using Visual Studio. In this instance, there will be command line arguments and file paths. In a malicious instance, MSBuild.exe will spawn from non-standard processes and have no command line arguments. For example, MSBuild.exe spawning from explorer.exe, powershell.exe is far less common and should be investigated.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-01-12
- **Author**: Michael Haag, Splunk
- **ID**: a115fba6-5514-11eb-ae93-0242ac130002
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,56 @@ The following analytic identifies wmiprvse.exe spawning msbuild.exe. This behavi
| [T1127.001](https://attack.mitre.org/techniques/T1127/001/) | MSBuild | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -57,11 +112,11 @@ The following analytic identifies wmiprvse.exe spawning msbuild.exe. This behavi
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `suspicious_msbuild_spawn_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **suspicious_msbuild_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -89,9 +144,6 @@ Although unlikely, some legitimate applications may exhibit this behavior, trigg
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -101,8 +153,6 @@ Although unlikely, some legitimate applications may exhibit this behavior, trigg
| 42.0 | 70 | 60 | Suspicious msbuild.exe process executed on $dest$ by $user$ |
-
-
#### Reference
* [https://lolbas-project.github.io/lolbas/Binaries/Msbuild/](https://lolbas-project.github.io/lolbas/Binaries/Msbuild/)
@@ -111,7 +161,7 @@ Although unlikely, some legitimate applications may exhibit this behavior, trigg
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-01-12-suspicious_mshta_child_process.md b/docs/_posts/2021-01-12-suspicious_mshta_child_process.md
index efeeecba3a..b9fcb706d2 100644
--- a/docs/_posts/2021-01-12-suspicious_mshta_child_process.md
+++ b/docs/_posts/2021-01-12-suspicious_mshta_child_process.md
@@ -27,16 +27,21 @@ tags:
The following analytic identifies child processes spawning from "mshta.exe". The search will return the first time and last time these command-line arguments were used for these executions, as well as the target system, the user, parent process "mshta.exe" and its child process.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-01-12
- **Author**: Michael Haag, Splunk
- **ID**: 60023bb6-5500-11eb-ae93-0242ac130002
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,56 @@ The following analytic identifies child processes spawning from "mshta.exe". Th
| [T1218.005](https://attack.mitre.org/techniques/T1218/005/) | Mshta | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +112,10 @@ The following analytic identifies child processes spawning from "mshta.exe". Th
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `suspicious_mshta_child_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **suspicious_mshta_child_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -83,9 +138,6 @@ Although unlikely, some legitimate applications may exhibit this behavior, trigg
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -95,8 +147,6 @@ Although unlikely, some legitimate applications may exhibit this behavior, trigg
| 40.0 | 50 | 80 | suspicious mshta child process detected on host $dest$ by user $user$. |
-
-
#### Reference
* [https://github.com/redcanaryco/AtomicTestHarnesses](https://github.com/redcanaryco/AtomicTestHarnesses)
@@ -105,7 +155,7 @@ Although unlikely, some legitimate applications may exhibit this behavior, trigg
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md b/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md
index 5f42bf0874..a10e6b0b72 100644
--- a/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md
+++ b/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md
@@ -24,21 +24,81 @@ tags:
Malicious actors often abuse legitimate Dynamic DNS services to host malicious payloads or interactive command and control nodes. Attackers will automate domain resolution changes by routing dynamic domains to countless IP addresses to circumvent firewall blocks, block lists as well as frustrate a network defenders analytic and investigative processes. This search will look for DNS queries made from within your infrastructure to suspicious dynamic domains.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Network_Resolution](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkResolution)
-
- **Last Updated**: 2021-01-14
- **Author**: Bhavin Patel, Splunk
- **ID**: a1e761ac-1344-4dbd-88b2-3f34c912d359
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1189](https://attack.mitre.org/techniques/T1189/) | Drive-by Compromise | Initial Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Command & Control
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.DS
+* PR.PT
+* DE.AE
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+* CIS 12
+* CIS 13
+
+
+
+
+
+
+
#### Search
```
@@ -52,11 +112,11 @@ Malicious actors often abuse legitimate Dynamic DNS services to host malicious p
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [dynamic_dns_providers](https://github.com/splunk/security_content/blob/develop/macros/dynamic_dns_providers.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_hosts_connecting_to_dynamic_domain_providers_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_hosts_connecting_to_dynamic_domain_providers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -86,10 +146,6 @@ Some users and applications may leverage Dynamic DNS to reach out to some domain
* [Command and Control](/stories/command_and_control)
-#### Kill Chain Phase
-* Command & Control
-* Actions on Objectives
-
#### RBA
@@ -99,13 +155,11 @@ Some users and applications may leverage Dynamic DNS to reach out to some domain
| 56.0 | 70 | 80 | A dns query $query$ from your infra connecting to suspicious domain in host $host$ |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md b/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md
index a27d1e4130..68b79bc194 100644
--- a/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md
+++ b/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md
@@ -27,16 +27,21 @@ tags:
This search looks for PowerShell processes launched with arguments that have characters indicative of obfuscation on the command-line.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-01-19
- **Author**: David Dorsey, Splunk
- **ID**: cde75cf6-3c7a-4dd6-af01-27cdb4511fd4
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,60 @@ This search looks for PowerShell processes launched with arguments that have cha
| [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Command & Control
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+* PR.IP
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 7
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -59,11 +118,11 @@ This search looks for PowerShell processes launched with arguments that have cha
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `malicious_powershell_process_with_obfuscation_techniques_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **malicious_powershell_process_with_obfuscation_techniques_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -90,10 +149,6 @@ These characters might be legitimately on the command-line, but it is not common
* [Malicious PowerShell](/stories/malicious_powershell)
-#### Kill Chain Phase
-* Command & Control
-* Actions on Objectives
-
#### RBA
@@ -103,13 +158,11 @@ These characters might be legitimately on the command-line, but it is not common
| 42.0 | 70 | 60 | Powershell.exe running with potential obfuscated arguments on $dest$ |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-01-19-suspicious_powershell_command-line_arguments.md b/docs/_posts/2021-01-19-suspicious_powershell_command-line_arguments.md
index c79890e600..572f984ae5 100644
--- a/docs/_posts/2021-01-19-suspicious_powershell_command-line_arguments.md
+++ b/docs/_posts/2021-01-19-suspicious_powershell_command-line_arguments.md
@@ -24,21 +24,80 @@ tags:
This search looks for PowerShell processes started with a base64 encoded command-line passed to it, with parameters to modify the execution policy for the process, and those that prevent the display of an interactive prompt to the user. This combination of command-line options is suspicious because it overrides the default PowerShell execution policy, attempts to hide itself from the user, and passes an encoded script to be run on the command-line. Deprecated because almost the same as Malicious PowerShell Process - Encoded Command
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-01-19
- **Author**: David Dorsey, Splunk
- **ID**: 2cdb91d2-542c-497f-b252-be495e71f38c
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Command & Control
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+* PR.IP
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 7
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -53,10 +112,10 @@ This search looks for PowerShell processes started with a base64 encoded command
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `suspicious_powershell_command-line_arguments_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **suspicious_powershell_command-line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -72,10 +131,6 @@ Legitimate process can have this combination of command-line options, but it's n
* [Malicious PowerShell](/stories/malicious_powershell)
-#### Kill Chain Phase
-* Command & Control
-* Actions on Objectives
-
#### RBA
@@ -85,13 +140,11 @@ Legitimate process can have this combination of command-line options, but it's n
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md b/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md
index 73d11e1fae..e62daac2cd 100644
--- a/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md
+++ b/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md
@@ -27,16 +27,21 @@ tags:
The following analytic identifies "rundll32.exe" execution with inline protocol handlers. "JavaScript", "VBScript", and "About" are the only supported options when invoking HTA content directly on the command-line. This type of behavior is commonly observed with fileless malware or application whitelisting bypass techniques. The search will return the first time and last time these command-line arguments were used for these executions, as well as the target system, the user, process "rundll32.exe" and its parent process.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-01-20
- **Author**: Michael Haag, Splunk
- **ID**: 91c79f14-5b41-11eb-ae93-0242ac130002
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,56 @@ The following analytic identifies "rundll32.exe" execution with inline protocol
| [T1218.005](https://attack.mitre.org/techniques/T1218/005/) | Mshta | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -57,11 +112,11 @@ The following analytic identifies "rundll32.exe" execution with inline protocol
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_rundll32_inline_hta_execution_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_rundll32_inline_hta_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -90,9 +145,6 @@ Although unlikely, some legitimate applications may exhibit this behavior, trigg
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -102,8 +154,6 @@ Although unlikely, some legitimate applications may exhibit this behavior, trigg
| 56.0 | 70 | 80 | Suspicious rundll32.exe inline HTA execution on $dest$ |
-
-
#### Reference
* [https://github.com/redcanaryco/AtomicTestHarnesses](https://github.com/redcanaryco/AtomicTestHarnesses)
@@ -113,7 +163,7 @@ Although unlikely, some legitimate applications may exhibit this behavior, trigg
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-01-20-suspicious_mshta_spawn.md b/docs/_posts/2021-01-20-suspicious_mshta_spawn.md
index 51ad8a7696..ac404e307b 100644
--- a/docs/_posts/2021-01-20-suspicious_mshta_spawn.md
+++ b/docs/_posts/2021-01-20-suspicious_mshta_spawn.md
@@ -27,16 +27,21 @@ tags:
The following analytic identifies wmiprvse.exe spawning mshta.exe. This behavior is indicative of a DCOM object being utilized to spawn mshta from wmiprvse.exe or svchost.exe. In this instance, adversaries may use LethalHTA that will spawn mshta.exe from svchost.exe.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-01-20
- **Author**: Michael Haag, Splunk
- **ID**: 4d33a488-5b5f-11eb-ae93-0242ac130002
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,56 @@ The following analytic identifies wmiprvse.exe spawning mshta.exe. This behavior
| [T1218.005](https://attack.mitre.org/techniques/T1218/005/) | Mshta | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -57,11 +112,11 @@ The following analytic identifies wmiprvse.exe spawning mshta.exe. This behavior
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `suspicious_mshta_spawn_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **suspicious_mshta_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -89,9 +144,6 @@ Although unlikely, some legitimate applications may exhibit this behavior, trigg
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -101,8 +153,6 @@ Although unlikely, some legitimate applications may exhibit this behavior, trigg
| 42.0 | 70 | 60 | mshta.exe spawned by wmiprvse.exe on $dest$ |
-
-
#### Reference
* [https://codewhitesec.blogspot.com/2018/07/lethalhta.html](https://codewhitesec.blogspot.com/2018/07/lethalhta.html)
@@ -112,7 +162,7 @@ Although unlikely, some legitimate applications may exhibit this behavior, trigg
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-01-22-wbadmin_delete_system_backups.md b/docs/_posts/2021-01-22-wbadmin_delete_system_backups.md
index 54f0b2be26..cc81f64a4c 100644
--- a/docs/_posts/2021-01-22-wbadmin_delete_system_backups.md
+++ b/docs/_posts/2021-01-22-wbadmin_delete_system_backups.md
@@ -24,21 +24,75 @@ tags:
This search looks for flags passed to wbadmin.exe (Windows Backup Administrator Tool) that delete backup files. This is typically used by ransomware to prevent recovery.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-01-22
- **Author**: Michael Haag, Splunk
- **ID**: cd5aed7e-5cea-11eb-ae93-0242ac130002
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1490](https://attack.mitre.org/techniques/T1490/) | Inhibit System Recovery | Impact |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.IP
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +106,10 @@ This search looks for flags passed to wbadmin.exe (Windows Backup Administrator
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `wbadmin_delete_system_backups_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **wbadmin_delete_system_backups_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -77,9 +131,6 @@ Administrators may modify the boot configuration.
* [Ransomware](/stories/ransomware)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -89,8 +140,6 @@ Administrators may modify the boot configuration.
| 15.0 | 30 | 50 | System backups deletion on $dest$ |
-
-
#### Reference
* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md)
@@ -101,7 +150,7 @@ Administrators may modify the boot configuration.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-01-25-nltest_domain_trust_discovery.md b/docs/_posts/2021-01-25-nltest_domain_trust_discovery.md
index 9aa33b9703..946445f63d 100644
--- a/docs/_posts/2021-01-25-nltest_domain_trust_discovery.md
+++ b/docs/_posts/2021-01-25-nltest_domain_trust_discovery.md
@@ -24,21 +24,76 @@ tags:
This search looks for the execution of `nltest.exe` with command-line arguments utilized to query for Domain Trust information. Two arguments `/domain trusts`, returns a list of trusted domains, and `/all_trusts`, returns all trusted domains. Red Teams and adversaries alike use NLTest.exe to enumerate the current domain to assist with further understanding where to pivot next.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-01-25
- **Author**: Michael Haag, Splunk
- **ID**: c3e05466-5f22-11eb-ae93-0242ac130002
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1482](https://attack.mitre.org/techniques/T1482/) | Domain Trust Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +107,10 @@ This search looks for the execution of `nltest.exe` with command-line arguments
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `nltest_domain_trust_discovery_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **nltest_domain_trust_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -81,9 +136,6 @@ Administrators may use nltest for troubleshooting purposes, otherwise, rarely us
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -93,8 +145,6 @@ Administrators may use nltest for troubleshooting purposes, otherwise, rarely us
| 15.0 | 30 | 50 | Domain trust discovery execution on $dest$ |
-
-
#### Reference
* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1482/T1482.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1482/T1482.md)
@@ -108,7 +158,7 @@ Administrators may use nltest for troubleshooting purposes, otherwise, rarely us
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-01-26-aws_saml_access_by_provider_user_and_principal.md b/docs/_posts/2021-01-26-aws_saml_access_by_provider_user_and_principal.md
index bf8c785791..c659f13c37 100644
--- a/docs/_posts/2021-01-26-aws_saml_access_by_provider_user_and_principal.md
+++ b/docs/_posts/2021-01-26-aws_saml_access_by_provider_user_and_principal.md
@@ -26,21 +26,71 @@ tags:
This search provides specific SAML access from specific Service Provider, user and targeted principal at AWS. This search provides specific information to detect abnormal access or potential credential hijack or forgery, specially in federated environments using SAML protocol inside the perimeter or cloud provider.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-01-26
- **Author**: Rod Soto, Splunk
- **ID**: bbe23980-6019-11eb-ae93-0242ac130002
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -53,10 +103,10 @@ This search provides specific SAML access from specific Service Provider, user a
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `aws_saml_access_by_provider_user_and_principal_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **aws_saml_access_by_provider_user_and_principal_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -80,9 +130,6 @@ Attacks using a Golden SAML or SAML assertion hijacks or forgeries are very diff
* [Cloud Federated Credential Abuse](/stories/cloud_federated_credential_abuse)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -92,8 +139,6 @@ Attacks using a Golden SAML or SAML assertion hijacks or forgeries are very diff
| 64.0 | 80 | 80 | From IP address $sourceIPAddress$, user agent $userAgent$ has trigged an event $eventName$ for account ID $recipientAccountId$ |
-
-
#### Reference
* [https://us-cert.cisa.gov/ncas/alerts/aa21-008a](https://us-cert.cisa.gov/ncas/alerts/aa21-008a)
@@ -104,7 +149,7 @@ Attacks using a Golden SAML or SAML assertion hijacks or forgeries are very diff
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-01-26-aws_saml_update_identity_provider.md b/docs/_posts/2021-01-26-aws_saml_update_identity_provider.md
index 599a2a3fc4..a8e75ff12f 100644
--- a/docs/_posts/2021-01-26-aws_saml_update_identity_provider.md
+++ b/docs/_posts/2021-01-26-aws_saml_update_identity_provider.md
@@ -26,21 +26,71 @@ tags:
This search provides detection of updates to SAML provider in AWS. Updates to SAML provider need to be monitored closely as they may indicate possible perimeter compromise of federated credentials, or backdoor access from another cloud provider set by attacker.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-01-26
- **Author**: Rod Soto, Splunk
- **ID**: 2f0604c6-6030-11eb-ae93-0242ac130002
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -53,10 +103,10 @@ This search provides detection of updates to SAML provider in AWS. Updates to SA
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `aws_saml_update_identity_provider_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **aws_saml_update_identity_provider_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -79,9 +129,6 @@ Updating a SAML provider or creating a new one may not necessarily be malicious
* [Cloud Federated Credential Abuse](/stories/cloud_federated_credential_abuse)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -91,8 +138,6 @@ Updating a SAML provider or creating a new one may not necessarily be malicious
| 64.0 | 80 | 80 | User $userIdentity.principalId$ from IP address $sourceIPAddress$ has trigged an event $eventName$ to update the SAML provider to $requestParameters.sAMLProviderArn$ |
-
-
#### Reference
* [https://us-cert.cisa.gov/ncas/alerts/aa21-008a](https://us-cert.cisa.gov/ncas/alerts/aa21-008a)
@@ -103,7 +148,7 @@ Updating a SAML provider or creating a new one may not necessarily be malicious
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-01-26-certutil_exe_certificate_extraction.md b/docs/_posts/2021-01-26-certutil_exe_certificate_extraction.md
index 3dc7597328..36145ee1f4 100644
--- a/docs/_posts/2021-01-26-certutil_exe_certificate_extraction.md
+++ b/docs/_posts/2021-01-26-certutil_exe_certificate_extraction.md
@@ -21,14 +21,66 @@ tags:
This search looks for arguments to certutil.exe indicating the manipulation or extraction of Certificate. This certificate can then be used to sign new authentication tokens specially inside Federated environments such as Windows ADFS.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-01-26
- **Author**: Rod Soto, Splunk
- **ID**: 337a46be-600f-11eb-ae93-0242ac130002
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Installation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -41,10 +93,10 @@ This search looks for arguments to certutil.exe indicating the manipulation or e
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `certutil_exe_certificate_extraction_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **certutil_exe_certificate_extraction_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -73,9 +125,6 @@ Unless there are specific use cases, manipulating or exporting certificates usin
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Installation
-
#### RBA
@@ -85,13 +134,11 @@ Unless there are specific use cases, manipulating or exporting certificates usin
| 63.0 | 90 | 70 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting export a certificate. |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_ec2_instance.md b/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_ec2_instance.md
index ade5bd0bb8..ae1faef83a 100644
--- a/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_ec2_instance.md
+++ b/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_ec2_instance.md
@@ -20,14 +20,70 @@ tags:
This search looks for a spike in number of of AWS security Hub alerts for an EC2 instance in 4 hours intervals
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-01-26
- **Author**: Bhavin Patel, Splunk
- **ID**: 2a9b80d3-6340-4345-b5ad-290bf5d0d222
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.DP
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 13
+
+
+
+
+
+
+
#### Search
```
@@ -46,7 +102,7 @@ This search looks for a spike in number of of AWS security Hub alerts for an EC2
The SPL above uses the following Macros:
* [aws_securityhub_finding](https://github.com/splunk/security_content/blob/develop/macros/aws_securityhub_finding.yml)
-Note that `detect_spike_in_aws_security_hub_alerts_for_ec2_instance_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_spike_in_aws_security_hub_alerts_for_ec2_instance_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -69,9 +125,6 @@ None
* [AWS Security Hub Alerts](/stories/aws_security_hub_alerts)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -81,13 +134,11 @@ None
| 15.0 | 30 | 50 | Spike in AWS security Hub alerts with title $Title$ for EC2 instance $dest$ |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md b/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md
index c6d3c34e9a..d1721aae97 100644
--- a/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md
+++ b/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md
@@ -22,14 +22,71 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search looks for a spike in number of of AWS security Hub alerts for an AWS IAM User in 4 hours intervals.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-01-26
- **Author**: Bhavin Patel, Splunk
- **ID**: 2a9b80d3-6220-4345-b5ad-290bf5d0d222
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.DP
+* DE.AE
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 13
+
+
+
+
+
+
+
#### Search
```
@@ -49,7 +106,7 @@ This search looks for a spike in number of of AWS security Hub alerts for an AWS
The SPL above uses the following Macros:
* [aws_securityhub_finding](https://github.com/splunk/security_content/blob/develop/macros/aws_securityhub_finding.yml)
-Note that `detect_spike_in_aws_security_hub_alerts_for_user_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_spike_in_aws_security_hub_alerts_for_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -68,9 +125,6 @@ None
* [AWS Security Hub Alerts](/stories/aws_security_hub_alerts)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -80,13 +134,11 @@ None
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-01-26-o365_add_app_role_assignment_grant_user.md b/docs/_posts/2021-01-26-o365_add_app_role_assignment_grant_user.md
index 453bf44f58..ecf695a712 100644
--- a/docs/_posts/2021-01-26-o365_add_app_role_assignment_grant_user.md
+++ b/docs/_posts/2021-01-26-o365_add_app_role_assignment_grant_user.md
@@ -26,16 +26,21 @@ tags:
This search detects the creation of a new Federation setting by alerting about an specific event related to its creation.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-01-26
- **Author**: Rod Soto, Splunk
- **ID**: b2c81cc6-6040-11eb-ae93-0242ac130002
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,51 @@ This search detects the creation of a new Federation setting by alerting about a
| [T1136](https://attack.mitre.org/techniques/T1136/) | Create Account | Persistence |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -55,10 +105,10 @@ This search detects the creation of a new Federation setting by alerting about a
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `o365_add_app_role_assignment_grant_user_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **o365_add_app_role_assignment_grant_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -82,9 +132,6 @@ The creation of a new Federation is not necessarily malicious, however this even
* [Cloud Federated Credential Abuse](/stories/cloud_federated_credential_abuse)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -94,8 +141,6 @@ The creation of a new Federation is not necessarily malicious, however this even
| 18.0 | 30 | 60 | User $Actor.ID$ has created a new federation setting on $dest$ from IP Address $ActorIpAddress$ |
-
-
#### Reference
* [https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf](https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf)
@@ -104,7 +149,7 @@ The creation of a new Federation is not necessarily malicious, however this even
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-01-26-o365_excessive_sso_logon_errors.md b/docs/_posts/2021-01-26-o365_excessive_sso_logon_errors.md
index 6babcd7589..a225ee8e1e 100644
--- a/docs/_posts/2021-01-26-o365_excessive_sso_logon_errors.md
+++ b/docs/_posts/2021-01-26-o365_excessive_sso_logon_errors.md
@@ -25,21 +25,71 @@ tags:
This search detects accounts with high number of Single Sign ON (SSO) logon errors. Excessive logon errors may indicate attempts to bruteforce of password or single sign on token hijack or reuse.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-01-26
- **Author**: Rod Soto, Splunk
- **ID**: 8158ccc4-6038-11eb-ae93-0242ac130002
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1556](https://attack.mitre.org/techniques/T1556/) | Modify Authentication Process | Credential Access, Defense Evasion, Persistence |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -53,10 +103,10 @@ This search detects accounts with high number of Single Sign ON (SSO) logon erro
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `o365_excessive_sso_logon_errors_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **o365_excessive_sso_logon_errors_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -78,9 +128,6 @@ Logon errors may not be malicious in nature however it may indicate attempts to
* [Cloud Federated Credential Abuse](/stories/cloud_federated_credential_abuse)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -90,8 +137,6 @@ Logon errors may not be malicious in nature however it may indicate attempts to
| 64.0 | 80 | 80 | User $UserId$ has caused excessive number of SSO logon errors from $ActorIpAddress$ using UserAgent $UserAgent$. |
-
-
#### Reference
* [https://stealthbits.com/blog/bypassing-mfa-with-pass-the-cookie/](https://stealthbits.com/blog/bypassing-mfa-with-pass-the-cookie/)
@@ -99,7 +144,7 @@ Logon errors may not be malicious in nature however it may indicate attempts to
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-01-26-o365_new_federated_domain_added.md b/docs/_posts/2021-01-26-o365_new_federated_domain_added.md
index b7c1ce76e8..8dd8f7ba2b 100644
--- a/docs/_posts/2021-01-26-o365_new_federated_domain_added.md
+++ b/docs/_posts/2021-01-26-o365_new_federated_domain_added.md
@@ -26,16 +26,21 @@ tags:
This search detects the addition of a new Federated domain.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-01-26
- **Author**: Rod Soto, Splunk
- **ID**: e155876a-6048-11eb-ae93-0242ac130002
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,51 @@ This search detects the addition of a new Federated domain.
| [T1136](https://attack.mitre.org/techniques/T1136/) | Create Account | Persistence |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -55,10 +105,10 @@ This search detects the addition of a new Federated domain.
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `o365_new_federated_domain_added_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **o365_new_federated_domain_added_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -83,9 +133,6 @@ The creation of a new Federated domain is not necessarily malicious, however the
* [Cloud Federated Credential Abuse](/stories/cloud_federated_credential_abuse)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -95,8 +142,6 @@ The creation of a new Federated domain is not necessarily malicious, however the
| 64.0 | 80 | 80 | User $UserId$ has added a new federated domaain $Parameters.Value$ for $OrganizationName$ |
-
-
#### Reference
* [https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf](https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf)
@@ -108,7 +153,7 @@ The creation of a new Federated domain is not necessarily malicious, however the
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-01-26-revil_registry_entry.md b/docs/_posts/2021-01-26-revil_registry_entry.md
index 1ea719d826..374282cda4 100644
--- a/docs/_posts/2021-01-26-revil_registry_entry.md
+++ b/docs/_posts/2021-01-26-revil_registry_entry.md
@@ -24,21 +24,71 @@ tags:
This analytic identifies suspicious modification in registry entry to keep some malware data during its infection. This technique seen in several apt implant, malware and ransomware like REVIL where it keep some information like the random generated file extension it uses for all the encrypted files and ransomware notes file name in the compromised host.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-01-26
- **Author**: Teoderick Contreras, Splunk
- **ID**: e3d3f57a-c381-11eb-9e35-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -59,7 +109,7 @@ This analytic identifies suspicious modification in registry entry to keep some
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `revil_registry_entry_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **revil_registry_entry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -82,9 +132,6 @@ unknown
* [Windows Registry Abuse](/stories/windows_registry_abuse)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -94,8 +141,6 @@ unknown
| 60.0 | 60 | 100 | A registry entry $registry_path$ with registry value $registry_value_name$ and $registry_value_name$ related to revil ransomware in host $dest$ |
-
-
#### Reference
* [https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/](https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/)
@@ -104,7 +149,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md b/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md
index 678ed078d5..60717f1851 100644
--- a/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md
+++ b/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md
@@ -26,21 +26,81 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search detects the heap-based buffer overflow of sudoedit
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-01-27
- **Author**: Shannon Davis, Splunk
- **ID**: 93fbec4e-0375-440c-8db3-4508eca470c4
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1068](https://attack.mitre.org/techniques/T1068/) | Exploitation for Privilege Escalation | Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+* CIS 12
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -53,7 +113,7 @@ This search detects the heap-based buffer overflow of sudoedit
The SPL above uses the following Macros:
* [linux_hosts](https://github.com/splunk/security_content/blob/develop/macros/linux_hosts.yml)
-Note that `detect_baron_samedit_cve-2021-3156_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_baron_samedit_cve-2021-3156_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -69,9 +129,6 @@ unknown
* [Baron Samedit CVE-2021-3156](/stories/baron_samedit_cve-2021-3156)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -81,19 +138,11 @@ unknown
| 25.0 | 50 | 50 | tbd |
-#### CVE
-
-| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
-| ----------- | ----------- | -------------- |
-| [CVE-2021-3156](https://nvd.nist.gov/vuln/detail/CVE-2021-3156) | Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character. | 7.2 |
-
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md b/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md
index cdb221c44b..66b6df2011 100644
--- a/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md
+++ b/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md
@@ -26,21 +26,81 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search detects the heap-based buffer overflow of sudoedit
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-01-28
- **Author**: Shannon Davis, Splunk
- **ID**: 1de31d5d-8fa6-4ee0-af89-17069134118a
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
+| ----------- | ----------- | -------------- |
+| [CVE-2021-3156](https://nvd.nist.gov/vuln/detail/CVE-2021-3156) | Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character. | 7.2 |
+
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1068](https://attack.mitre.org/techniques/T1068/) | Exploitation for Privilege Escalation | Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+* CIS 12
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -53,7 +113,7 @@ This search detects the heap-based buffer overflow of sudoedit
The SPL above uses the following Macros:
* [osquery_process](https://github.com/splunk/security_content/blob/develop/macros/osquery_process.yml)
-Note that `detect_baron_samedit_cve-2021-3156_via_osquery_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_baron_samedit_cve-2021-3156_via_osquery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -70,9 +130,6 @@ unknown
* [Baron Samedit CVE-2021-3156](/stories/baron_samedit_cve-2021-3156)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -82,19 +139,11 @@ unknown
| 25.0 | 50 | 50 | tbd |
-#### CVE
-
-| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
-| ----------- | ----------- | -------------- |
-| [CVE-2021-3156](https://nvd.nist.gov/vuln/detail/CVE-2021-3156) | Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character. | 7.2 |
-
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md b/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md
index 05f1ae4628..eef8f09ac5 100644
--- a/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md
+++ b/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md
@@ -28,16 +28,21 @@ tags:
Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe is also a Microsoft signed binary.This variation of the technique is often referred to as a "Squiblydoo" attack. \
Upon investigating, look for network connections to remote destinations (internal or external). Be cautious to modify the query to look for "scrobj.dll", the ".dll" is not required to load scrobj. "scrobj.dll" will be loaded by "regsvr32.exe" upon execution.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-01-28
- **Author**: Michael Haag, Splunk
- **ID**: 070e9b80-6252-11eb-ae93-0242ac130002
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
+| ----------- | ----------- | -------------- |
+| [CVE-2021-3156](https://nvd.nist.gov/vuln/detail/CVE-2021-3156) | Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character. | 7.2 |
+
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -45,6 +50,56 @@ Upon investigating, look for network connections to remote destinations (interna
| [T1218.010](https://attack.mitre.org/techniques/T1218/010/) | Regsvr32 | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -58,11 +113,11 @@ Upon investigating, look for network connections to remote destinations (interna
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_regsvr32_application_control_bypass_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_regsvr32_application_control_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -91,9 +146,6 @@ Limited false positives related to third party software registering .DLL's.
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -103,8 +155,6 @@ Limited false positives related to third party software registering .DLL's.
| 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ in an attempt to bypass detection and preventative controls was identified on endpoint $dest$ by user $user$. |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1218/010/](https://attack.mitre.org/techniques/T1218/010/)
@@ -115,7 +165,7 @@ Limited false positives related to third party software registering .DLL's.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-01-28-ntdsutil_export_ntds.md b/docs/_posts/2021-01-28-ntdsutil_export_ntds.md
index 23c55b3ae5..c6f240a0d1 100644
--- a/docs/_posts/2021-01-28-ntdsutil_export_ntds.md
+++ b/docs/_posts/2021-01-28-ntdsutil_export_ntds.md
@@ -29,16 +29,21 @@ Monitor for signs that Ntdsutil is being used to Extract Active Directory databa
ntdsutil "ac i ntds" "ifm" "create full C:\Temp" q q \
This technique uses "Install from Media" (IFM), which will extract a copy of the Active Directory database. A successful export of the Active Directory database will yield a file modification named ntds.dit to the destination.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-01-28
- **Author**: Michael Haag, Patrick Bareiss, Splunk
- **ID**: da63bc76-61ae-11eb-ae93-0242ac130002
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,56 @@ This technique uses "Install from Media" (IFM), which will extract a copy of the
| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -59,10 +114,10 @@ This technique uses "Install from Media" (IFM), which will extract a copy of the
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `ntdsutil_export_ntds_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **ntdsutil_export_ntds_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -87,9 +142,6 @@ Highly possible Server Administrators will troubleshoot with ntdsutil.exe, gener
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -99,8 +151,6 @@ Highly possible Server Administrators will troubleshoot with ntdsutil.exe, gener
| 50.0 | 100 | 50 | Active Directory NTDS export on $dest$ |
-
-
#### Reference
* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.003/T1003.003.md#atomic-test-3---dump-active-directory-database-with-ntdsutil](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.003/T1003.003.md#atomic-test-3---dump-active-directory-database-with-ntdsutil)
@@ -111,7 +161,7 @@ Highly possible Server Administrators will troubleshoot with ntdsutil.exe, gener
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md b/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md
index b8fa30a703..e764f38121 100644
--- a/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md
+++ b/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md
@@ -27,16 +27,21 @@ tags:
Adversaries may abuse Regsvr32.exe to proxy execution of malicious code by using non-standard file extensions to load malciious DLLs. Upon investigating, look for network connections to remote destinations (internal or external). Review additional parrallel processes and child processes for additional activity.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-01-28
- **Author**: Michael Haag, Splunk
- **ID**: 62732736-6250-11eb-ae93-0242ac130002
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,56 @@ Adversaries may abuse Regsvr32.exe to proxy execution of malicious code by using
| [T1218.010](https://attack.mitre.org/techniques/T1218/010/) | Regsvr32 | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -57,11 +112,11 @@ Adversaries may abuse Regsvr32.exe to proxy execution of malicious code by using
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `suspicious_regsvr32_register_suspicious_path_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **suspicious_regsvr32_register_suspicious_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -90,9 +145,6 @@ Limited false positives with the query restricted to specified paths. Add more w
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -102,8 +154,6 @@ Limited false positives with the query restricted to specified paths. Add more w
| 35.0 | 70 | 50 | Suspicious $Processes.process_path.file_path$ process potentially loading malicious code |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1218/010/](https://attack.mitre.org/techniques/T1218/010/)
@@ -115,7 +165,7 @@ Limited false positives with the query restricted to specified paths. Add more w
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md b/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md
index 5cb883a4cf..758d09be03 100644
--- a/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md
+++ b/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md
@@ -26,21 +26,81 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search detects the heap-based buffer overflow of sudoedit
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-01-29
- **Author**: Shannon Davis, Splunk
- **ID**: 10f2bae0-bbe6-4984-808c-37dc1c67980d
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1068](https://attack.mitre.org/techniques/T1068/) | Exploitation for Privilege Escalation | Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+* CIS 12
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -55,7 +115,7 @@ This search detects the heap-based buffer overflow of sudoedit
The SPL above uses the following Macros:
* [linux_hosts](https://github.com/splunk/security_content/blob/develop/macros/linux_hosts.yml)
-Note that `detect_baron_samedit_cve-2021-3156_segfault_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_baron_samedit_cve-2021-3156_segfault_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -72,9 +132,6 @@ If sudoedit is throwing segfaults for other reasons this will pick those up too.
* [Baron Samedit CVE-2021-3156](/stories/baron_samedit_cve-2021-3156)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -84,19 +141,11 @@ If sudoedit is throwing segfaults for other reasons this will pick those up too.
| 25.0 | 50 | 50 | tbd |
-#### CVE
-
-| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
-| ----------- | ----------- | -------------- |
-| [CVE-2021-3156](https://nvd.nist.gov/vuln/detail/CVE-2021-3156) | Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character. | 7.2 |
-
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-02-01-dump_lsass_via_procdump_rename.md b/docs/_posts/2021-02-01-dump_lsass_via_procdump_rename.md
index db5c7ce67e..b199cbcbe9 100644
--- a/docs/_posts/2021-02-01-dump_lsass_via_procdump_rename.md
+++ b/docs/_posts/2021-02-01-dump_lsass_via_procdump_rename.md
@@ -24,21 +24,77 @@ tags:
Detect a renamed instance of procdump.exe dumping the lsass process. This query looks for both -mm and -ma usage. -mm will produce a mini dump file and -ma will write a dump file with all process memory. Both are highly suspect and should be reviewed. Modify the query as needed.\
During triage, confirm this is procdump.exe executing. If it is the first time a Sysinternals utility has been ran, it is possible there will be a -accepteula on the command line. Review other endpoint data sources for cross process (injection) into lsass.exe.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-02-01
- **Author**: Michael Haag, Splunk
- **ID**: 21276daa-663d-11eb-ae93-0242ac130002
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
+| ----------- | ----------- | -------------- |
+| [CVE-2021-3156](https://nvd.nist.gov/vuln/detail/CVE-2021-3156) | Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character. | 7.2 |
+
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1003.001](https://attack.mitre.org/techniques/T1003/001/) | LSASS Memory | Credential Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +108,10 @@ During triage, confirm this is procdump.exe executing. If it is the first time a
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `dump_lsass_via_procdump_rename_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **dump_lsass_via_procdump_rename_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -78,9 +134,6 @@ None identified.
* [HAFNIUM Group](/stories/hafnium_group)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -90,8 +143,6 @@ None identified.
| 80.0 | 80 | 100 | The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$, attempting to dump lsass.exe. |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1003/001/](https://attack.mitre.org/techniques/T1003/001/)
@@ -101,7 +152,7 @@ None identified.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md
index 2cb7a44a47..741234e4b5 100644
--- a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md
+++ b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md
@@ -27,16 +27,21 @@ tags:
The following analytic identifies rundll32.exe loading advpack.dll and ieadvpack.dll by calling the LaunchINFSection function on the command line. This particular technique will load script code from a file. Upon a successful execution, the following module loads may occur - clr.dll, jscript.dll and scrobj.dll. During investigation, identify script content origination. Generally, a child process will spawn from rundll32.exe, but that may be bypassed based on script code contents. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. During investigation, review any network connections and obtain the script content executed. It's possible other files are on disk.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-02-04
- **Author**: Michael Haag, Splunk
- **ID**: 4aefadfe-9abd-4bf8-b3fd-867e9ef95bf8
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,56 @@ The following analytic identifies rundll32.exe loading advpack.dll and ieadvpack
| [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -57,11 +112,11 @@ The following analytic identifies rundll32.exe loading advpack.dll and ieadvpack
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_rundll32_application_control_bypass_-_advpack_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_rundll32_application_control_bypass_-_advpack_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -89,9 +144,6 @@ Although unlikely, some legitimate applications may use advpack.dll or ieadvpack
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -101,8 +153,6 @@ Although unlikely, some legitimate applications may use advpack.dll or ieadvpack
| 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ loading advpack.dll and ieadvpack.dll by calling the LaunchINFSection function on the command line was identified on endpoint $dest$ by user $user$. |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1218/011/](https://attack.mitre.org/techniques/T1218/011/)
@@ -114,7 +164,7 @@ Although unlikely, some legitimate applications may use advpack.dll or ieadvpack
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md
index 15e02c6b28..9ed7164403 100644
--- a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md
+++ b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md
@@ -27,16 +27,21 @@ tags:
The following analytic identifies rundll32.exe loading setupapi.dll and iesetupapi.dll by calling the LaunchINFSection function on the command line. This particular technique will load script code from a file. Upon a successful execution, the following module loads may occur - clr.dll, jscript.dll and scrobj.dll. During investigation, identify script content origination. Generally, a child process will spawn from rundll32.exe, but that may be bypassed based on script code contents. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. During investigation, review any network connections and obtain the script content executed. It's possible other files are on disk.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-02-04
- **Author**: Michael Haag, Splunk
- **ID**: 61e7b44a-6088-4f26-b788-9a96ba13b37a
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,56 @@ The following analytic identifies rundll32.exe loading setupapi.dll and iesetupa
| [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -57,11 +112,11 @@ The following analytic identifies rundll32.exe loading setupapi.dll and iesetupa
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_rundll32_application_control_bypass_-_setupapi_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_rundll32_application_control_bypass_-_setupapi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -89,9 +144,6 @@ Although unlikely, some legitimate applications may use setupapi triggering a fa
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -101,8 +153,6 @@ Although unlikely, some legitimate applications may use setupapi triggering a fa
| 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ loading setupapi.dll and iesetupapi.dll by calling the LaunchINFSection function on the command line was identified on endpoint $dest$ by user $user$. |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1218/011/](https://attack.mitre.org/techniques/T1218/011/)
@@ -114,7 +164,7 @@ Although unlikely, some legitimate applications may use setupapi triggering a fa
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md
index 8ff42ed7a9..499d28c51f 100644
--- a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md
+++ b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md
@@ -27,16 +27,21 @@ tags:
The following analytic identifies rundll32.exe loading syssetup.dll by calling the LaunchINFSection function on the command line. This particular technique will load script code from a file. Upon a successful execution, the following module loads may occur - clr.dll, jscript.dll and scrobj.dll. During investigation, identify script content origination. Generally, a child process will spawn from rundll32.exe, but that may be bypassed based on script code contents. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. During investigation, review any network connections and obtain the script content executed. It's possible other files are on disk.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-02-04
- **Author**: Michael Haag, Splunk
- **ID**: 71b9bf37-cde1-45fb-b899-1b0aa6fa1183
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,56 @@ The following analytic identifies rundll32.exe loading syssetup.dll by calling t
| [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -57,11 +112,11 @@ The following analytic identifies rundll32.exe loading syssetup.dll by calling t
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_rundll32_application_control_bypass_-_syssetup_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_rundll32_application_control_bypass_-_syssetup_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -89,9 +144,6 @@ Although unlikely, some legitimate applications may use syssetup.dll, triggering
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -101,8 +153,6 @@ Although unlikely, some legitimate applications may use syssetup.dll, triggering
| 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ loading syssetup.dll by calling the LaunchINFSection function on the command line was identified on endpoint $dest$ by user $user$. |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1218/011/](https://attack.mitre.org/techniques/T1218/011/)
@@ -114,7 +164,7 @@ Although unlikely, some legitimate applications may use syssetup.dll, triggering
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-02-04-suspicious_rundll32_startw.md b/docs/_posts/2021-02-04-suspicious_rundll32_startw.md
index 42e4af46e2..38f657eacc 100644
--- a/docs/_posts/2021-02-04-suspicious_rundll32_startw.md
+++ b/docs/_posts/2021-02-04-suspicious_rundll32_startw.md
@@ -27,16 +27,21 @@ tags:
The following analytic identifies rundll32.exe executing a DLL function name, Start and StartW, on the command line that is commonly observed with Cobalt Strike x86 and x64 DLL payloads. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. Typically, the DLL will be written and loaded from a world writeable path or user location. In most instances it will not have a valid certificate (Unsigned). During investigation, review the parent process and other parallel application execution. Capture and triage the DLL in question. In the instance of Cobalt Strike, rundll32.exe is the default process it opens and injects shellcode into. This default process can be changed, but typically is not.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-02-04
- **Author**: Michael Haag, Splunk
- **ID**: 9319dda5-73f2-4d43-a85a-67ce961bddb7
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,56 @@ The following analytic identifies rundll32.exe executing a DLL function name, St
| [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -57,11 +112,11 @@ The following analytic identifies rundll32.exe executing a DLL function name, St
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `suspicious_rundll32_startw_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **suspicious_rundll32_startw_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -90,9 +145,6 @@ Although unlikely, some legitimate applications may use Start as a function and
* [Trickbot](/stories/trickbot)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -102,8 +154,6 @@ Although unlikely, some legitimate applications may use Start as a function and
| 35.0 | 70 | 50 | rundll32.exe running with suspicious parameters on $dest$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1218/011/](https://attack.mitre.org/techniques/T1218/011/)
@@ -115,7 +165,7 @@ Although unlikely, some legitimate applications may use Start as a function and
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md b/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md
index 15bc30aafd..022359a98f 100644
--- a/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md
+++ b/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md
@@ -27,16 +27,21 @@ tags:
The following analytic identifies rundll32.exe using dllregisterserver on the command line to load a DLL. When a DLL is registered, the DllRegisterServer method entry point in the DLL is invoked. This is typically seen when a DLL is being registered on the system. Not every instance is considered malicious, but it will capture malicious use of it. During investigation, review the parent process and parrellel processes executing. Capture the DLL being loaded and inspect further. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-02-09
- **Author**: Michael Haag, Splunk
- **ID**: 8c00a385-9b86-4ac0-8932-c9ec3713b159
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,56 @@ The following analytic identifies rundll32.exe using dllregisterserver on the co
| [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -57,11 +112,11 @@ The following analytic identifies rundll32.exe using dllregisterserver on the co
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `suspicious_rundll32_dllregisterserver_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **suspicious_rundll32_dllregisterserver_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -89,9 +144,6 @@ This is likely to produce false positives and will require some filtering. Tune
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -101,8 +153,6 @@ This is likely to produce false positives and will require some filtering. Tune
| 35.0 | 70 | 50 | $Processes.process_path.file_path$ process potentially loading malicious code |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1218/011/](https://attack.mitre.org/techniques/T1218/011/)
@@ -116,7 +166,7 @@ This is likely to produce false positives and will require some filtering. Tune
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-02-11-detect_html_help_spawn_child_process.md b/docs/_posts/2021-02-11-detect_html_help_spawn_child_process.md
index a73dbe1d88..7389ff250a 100644
--- a/docs/_posts/2021-02-11-detect_html_help_spawn_child_process.md
+++ b/docs/_posts/2021-02-11-detect_html_help_spawn_child_process.md
@@ -27,16 +27,21 @@ tags:
The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTML Help (CHM) that spawns a child process. This particular technique will load Windows script code from a compiled help file. CHM files may contain nearly any file type embedded, but only execute html/htm. Upon a successful execution, the following script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe upon execution. The "htm" and "html" file extensions were the only extensions observed to be supported for the execution of Shortcut commands or WSH script code. During investigation, identify script content origination. Review child process events and investigate further. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-02-11
- **Author**: Michael Haag, Splunk
- **ID**: 723716de-ee55-4cd4-9759-c44e7e55ba4b
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,56 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM
| [T1218.001](https://attack.mitre.org/techniques/T1218/001/) | Compiled HTML File | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +112,10 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_html_help_spawn_child_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_html_help_spawn_child_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -88,9 +143,6 @@ Although unlikely, some legitimate applications (ex. web browsers) may spawn a c
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -100,8 +152,6 @@ Although unlikely, some legitimate applications (ex. web browsers) may spawn a c
| 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ spawning a child process, typically not normal behavior. |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1218/001/](https://attack.mitre.org/techniques/T1218/001/)
@@ -113,7 +163,7 @@ Although unlikely, some legitimate applications (ex. web browsers) may spawn a c
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-02-12-detect_regasm_spawning_a_process.md b/docs/_posts/2021-02-12-detect_regasm_spawning_a_process.md
index 8cfbd98344..0ed0bf6012 100644
--- a/docs/_posts/2021-02-12-detect_regasm_spawning_a_process.md
+++ b/docs/_posts/2021-02-12-detect_regasm_spawning_a_process.md
@@ -27,16 +27,21 @@ tags:
The following analytic identifies regasm.exe spawning a process. This particular technique has been used in the wild to bypass application control products. Regasm.exe and Regsvcs.exe are signed by Microsoft. Spawning of a child process is rare from either process and should be investigated further. During investigation, identify and retrieve the content being loaded. Review parallel processes for additional suspicious behavior. Gather any other file modifications and review accordingly. regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-02-12
- **Author**: Michael Haag, Splunk
- **ID**: 72170ec5-f7d2-42f5-aefb-2b8be6aad15f
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,56 @@ The following analytic identifies regasm.exe spawning a process. This particular
| [T1218.009](https://attack.mitre.org/techniques/T1218/009/) | Regsvcs/Regasm | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +112,10 @@ The following analytic identifies regasm.exe spawning a process. This particular
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_regasm_spawning_a_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_regasm_spawning_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +139,6 @@ Although unlikely, limited instances of regasm.exe or regsvcs.exe may cause a fa
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -96,8 +148,6 @@ Although unlikely, limited instances of regasm.exe or regsvcs.exe may cause a fa
| 64.0 | 80 | 80 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ spawning a child process, typically not normal behavior for $parent_process_name$. |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1218/009/](https://attack.mitre.org/techniques/T1218/009/)
@@ -108,7 +158,7 @@ Although unlikely, limited instances of regasm.exe or regsvcs.exe may cause a fa
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-02-12-detect_regsvcs_spawning_a_process.md b/docs/_posts/2021-02-12-detect_regsvcs_spawning_a_process.md
index 0493e2c8a9..b21be132e1 100644
--- a/docs/_posts/2021-02-12-detect_regsvcs_spawning_a_process.md
+++ b/docs/_posts/2021-02-12-detect_regsvcs_spawning_a_process.md
@@ -27,16 +27,21 @@ tags:
The following analytic identifies regsvcs.exe spawning a process. This particular technique has been used in the wild to bypass application control products. Regasm.exe and Regsvcs.exe are signed by Microsoft. Spawning of a child process is rare from either process and should be investigated further. During investigation, identify and retrieve the content being loaded. Review parallel processes for additional suspicious behavior. Gather any other file modifications and review accordingly. regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-02-12
- **Author**: Michael Haag, Splunk
- **ID**: bc477b57-5c21-4ab6-9c33-668772e7f114
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,56 @@ The following analytic identifies regsvcs.exe spawning a process. This particula
| [T1218.009](https://attack.mitre.org/techniques/T1218/009/) | Regsvcs/Regasm | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +112,10 @@ The following analytic identifies regsvcs.exe spawning a process. This particula
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_regsvcs_spawning_a_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_regsvcs_spawning_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -85,9 +140,6 @@ Although unlikely, limited instances of regasm.exe or regsvcs.exe may cause a fa
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -97,8 +149,6 @@ Although unlikely, limited instances of regasm.exe or regsvcs.exe may cause a fa
| 64.0 | 80 | 80 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ typically not normal for this process. |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1218/009/](https://attack.mitre.org/techniques/T1218/009/)
@@ -108,7 +158,7 @@ Although unlikely, limited instances of regasm.exe or regsvcs.exe may cause a fa
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-02-22-aws_create_policy_version_to_allow_all_resources.md b/docs/_posts/2021-02-22-aws_create_policy_version_to_allow_all_resources.md
index 7c62d7469d..f2b5767364 100644
--- a/docs/_posts/2021-02-22-aws_create_policy_version_to_allow_all_resources.md
+++ b/docs/_posts/2021-02-22-aws_create_policy_version_to_allow_all_resources.md
@@ -32,16 +32,21 @@ tags:
This search looks for AWS CloudTrail events where a user created a policy version that allows them to access any resource in their account
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-02-22
- **Author**: Bhavin Patel, Splunk
- **ID**: 2a9b80d3-6340-4345-b5ad-212bf3d0dac4
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -49,6 +54,57 @@ This search looks for AWS CloudTrail events where a user created a policy versio
| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.DS
+* PR.AC
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 13
+
+
+
+
+
+
+
#### Search
```
@@ -65,10 +121,10 @@ This search looks for AWS CloudTrail events where a user created a policy versio
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `aws_create_policy_version_to_allow_all_resources_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **aws_create_policy_version_to_allow_all_resources_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -88,9 +144,6 @@ While this search has no known false positives, it is possible that an AWS admin
* [AWS IAM Privilege Escalation](/stories/aws_iam_privilege_escalation)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -100,8 +153,6 @@ While this search has no known false positives, it is possible that an AWS admin
| 49.0 | 70 | 70 | User $user$ created a policy version that allows them to access any resource in their account |
-
-
#### Reference
* [https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws](https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws)
@@ -110,7 +161,7 @@ While this search has no known false positives, it is possible that an AWS admin
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-02-22-cobalt_strike_named_pipes.md b/docs/_posts/2021-02-22-cobalt_strike_named_pipes.md
index e8985ca025..71a536bbeb 100644
--- a/docs/_posts/2021-02-22-cobalt_strike_named_pipes.md
+++ b/docs/_posts/2021-02-22-cobalt_strike_named_pipes.md
@@ -25,21 +25,76 @@ tags:
The following analytic identifies the use of default or publicly known named pipes used with Cobalt Strike. A named pipe is a named, one-way or duplex pipe for communication between the pipe server and one or more pipe clients. Cobalt Strike uses named pipes in many ways and has default values used with the Artifact Kit and Malleable C2 Profiles. The following query assists with identifying these default named pipes. Each EDR product presents named pipes a little different. Consider taking the values and generating a query based on the product of choice. \
Upon triage, review the process performing the named pipe. If it is explorer.exe, It is possible it was injected into by another process. Review recent parallel processes to identify suspicious patterns or behaviors. A parallel process may have a network connection, review and follow the connection back to identify any file modifications.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-02-22
- **Author**: Michael Haag, Splunk
- **ID**: 5876d429-0240-4709-8b93-ea8330b411b5
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -53,10 +108,10 @@ Upon triage, review the process performing the named pipe. If it is explorer.exe
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `cobalt_strike_named_pipes_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **cobalt_strike_named_pipes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -80,9 +135,6 @@ The idea of using named pipes with Cobalt Strike is to blend in. Therefore, some
* [DarkSide Ransomware](/stories/darkside_ransomware)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -92,8 +144,6 @@ The idea of using named pipes with Cobalt Strike is to blend in. Therefore, some
| 72.0 | 80 | 90 | An instance of $process_name$ was identified on endpoint $Computer$ by user $user$ accessing known suspicious named pipes related to Cobalt Strike. |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1218/009/](https://attack.mitre.org/techniques/T1218/009/)
@@ -106,7 +156,7 @@ The idea of using named pipes with Cobalt Strike is to blend in. Therefore, some
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-02-22-suspicious_curl_network_connection.md b/docs/_posts/2021-02-22-suspicious_curl_network_connection.md
index cd0e397e73..51d6763076 100644
--- a/docs/_posts/2021-02-22-suspicious_curl_network_connection.md
+++ b/docs/_posts/2021-02-22-suspicious_curl_network_connection.md
@@ -26,21 +26,71 @@ We have not been able to test, simulate, or build datasets for this object. Use
The following analytic identifies the use of a curl contacting suspicious remote domains to checkin to command and control servers or download further implants. In the context of Silver Sparrow, curl is identified contacting s3.amazonaws.com. This particular behavior is common with MacOS adware-malicious software.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-02-22
- **Author**: Michael Haag, Splunk
- **ID**: 3f613dc0-21f2-4063-93b1-5d3c15eef22f
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1105](https://attack.mitre.org/techniques/T1105/) | Ingress Tool Transfer | Command And Control |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -54,10 +104,10 @@ The following analytic identifies the use of a curl contacting suspicious remote
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `suspicious_curl_network_connection_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **suspicious_curl_network_connection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -81,9 +131,6 @@ Unknown. Filter as needed.
* [Ingress Tool Transfer](/stories/ingress_tool_transfer)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -93,8 +140,6 @@ Unknown. Filter as needed.
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
* [https://redcanary.com/blog/clipping-silver-sparrows-wings/](https://redcanary.com/blog/clipping-silver-sparrows-wings/)
@@ -103,7 +148,7 @@ Unknown. Filter as needed.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md
index ba3fa96d95..3a1aa8c4af 100644
--- a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md
+++ b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md
@@ -38,16 +38,21 @@ The following analytic identifies the use of a native MacOS utility, PlistBuddy,
- PlistBuddy -c "Add :ProgramArguments:1 string -c" ~/Library/Launchagents/init_verx.plist \
Upon triage, capture the property list file being written to disk and review for further indicators. Contain the endpoint and triage further.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-02-22
- **Author**: Michael Haag, Splunk
- **ID**: c3194009-e0eb-4f84-87a9-4070f8688f00
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -55,6 +60,51 @@ Upon triage, capture the property list file being written to disk and review for
| [T1543](https://attack.mitre.org/techniques/T1543/) | Create or Modify System Process | Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -68,10 +118,10 @@ Upon triage, capture the property list file being written to disk and review for
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `suspicious_plistbuddy_usage_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **suspicious_plistbuddy_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -94,9 +144,6 @@ Some legitimate applications may use PlistBuddy to create or modify property lis
* [Silver Sparrow](/stories/silver_sparrow)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -106,8 +153,6 @@ Some legitimate applications may use PlistBuddy to create or modify property lis
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
* [https://marcosantadev.com/manage-plist-files-plistbuddy/](https://marcosantadev.com/manage-plist-files-plistbuddy/)
@@ -115,7 +160,7 @@ Some legitimate applications may use PlistBuddy to create or modify property lis
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage_via_osquery.md b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage_via_osquery.md
index 20e9befde4..6684c596ef 100644
--- a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage_via_osquery.md
+++ b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage_via_osquery.md
@@ -37,16 +37,21 @@ The following analytic identifies the use of a native MacOS utility, PlistBuddy,
- PlistBuddy -c "Add :ProgramArguments:1 string -c" ~/Library/Launchagents/init_verx.plist \
Upon triage, capture the property list file being written to disk and review for further indicators. Contain the endpoint and triage further.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-02-22
- **Author**: Michael Haag, Splunk
- **ID**: 20ba6c32-c733-4a32-b64e-2688cf231399
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -54,6 +59,51 @@ Upon triage, capture the property list file being written to disk and review for
| [T1543](https://attack.mitre.org/techniques/T1543/) | Create or Modify System Process | Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -65,7 +115,7 @@ Upon triage, capture the property list file being written to disk and review for
The SPL above uses the following Macros:
* [osquery_process](https://github.com/splunk/security_content/blob/develop/macros/osquery_process.yml)
-Note that `suspicious_plistbuddy_usage_via_osquery_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **suspicious_plistbuddy_usage_via_osquery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -82,9 +132,6 @@ Some legitimate applications may use PlistBuddy to create or modify property lis
* [Silver Sparrow](/stories/silver_sparrow)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -94,8 +141,6 @@ Some legitimate applications may use PlistBuddy to create or modify property lis
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
* [https://marcosantadev.com/manage-plist-files-plistbuddy/](https://marcosantadev.com/manage-plist-files-plistbuddy/)
@@ -103,7 +148,7 @@ Some legitimate applications may use PlistBuddy to create or modify property lis
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md b/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md
index a316984b17..b5069a51cb 100644
--- a/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md
+++ b/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md
@@ -26,21 +26,71 @@ We have not been able to test, simulate, or build datasets for this object. Use
The following analytic identifies the use of a SQLite3 querying the MacOS preferences to identify the original URL the pkg was downloaded from. This particular behavior is common with MacOS adware-malicious software. Upon triage, review other processes in parallel for suspicious activity. Identify any recent package installations.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-02-22
- **Author**: Michael Haag, Splunk
- **ID**: e1997b2e-655f-4561-82fd-aeba8e1c1a86
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1074](https://attack.mitre.org/techniques/T1074/) | Data Staged | Collection |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -54,10 +104,10 @@ The following analytic identifies the use of a SQLite3 querying the MacOS prefer
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `suspicious_sqlite3_lsquarantine_behavior_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **suspicious_sqlite3_lsquarantine_behavior_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -80,9 +130,6 @@ Unknown.
* [Silver Sparrow](/stories/silver_sparrow)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -92,8 +139,6 @@ Unknown.
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
* [https://redcanary.com/blog/clipping-silver-sparrows-wings/](https://redcanary.com/blog/clipping-silver-sparrows-wings/)
@@ -102,7 +147,7 @@ Unknown.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-03-01-any_powershell_downloadfile.md b/docs/_posts/2021-03-01-any_powershell_downloadfile.md
index 6f5bcfdfe7..536c2b4d4f 100644
--- a/docs/_posts/2021-03-01-any_powershell_downloadfile.md
+++ b/docs/_posts/2021-03-01-any_powershell_downloadfile.md
@@ -28,16 +28,21 @@ tags:
The following analytic identifies the use of PowerShell downloading a file using `DownloadFile` method. This particular method is utilized in many different PowerShell frameworks to download files and output to disk. Identify the source (IP/domain) and destination file and triage appropriately. If AMSI logging or PowerShell transaction logs are available, review for further details of the implant.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-03-01
- **Author**: Michael Haag, Splunk
- **ID**: 1a93b7ea-7af7-11eb-adb5-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -45,6 +50,55 @@ The following analytic identifies the use of PowerShell downloading a file using
| [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -58,11 +112,11 @@ The following analytic identifies the use of PowerShell downloading a file using
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `any_powershell_downloadfile_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **any_powershell_downloadfile_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -91,9 +145,6 @@ False positives may be present and filtering will need to occur by parent proces
* [Log4Shell CVE-2021-44228](/stories/log4shell_cve-2021-44228)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -103,14 +154,6 @@ False positives may be present and filtering will need to occur by parent proces
| 56.0 | 80 | 70 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadFile within PowerShell. |
-#### CVE
-
-| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
-| ----------- | ----------- | -------------- |
-| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 |
-
-
-
#### Reference
* [https://docs.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadfile?view=net-5.0](https://docs.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadfile?view=net-5.0)
@@ -120,7 +163,7 @@ False positives may be present and filtering will need to occur by parent proces
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-03-01-any_powershell_downloadstring.md b/docs/_posts/2021-03-01-any_powershell_downloadstring.md
index 5367e88176..df910f01da 100644
--- a/docs/_posts/2021-03-01-any_powershell_downloadstring.md
+++ b/docs/_posts/2021-03-01-any_powershell_downloadstring.md
@@ -27,16 +27,21 @@ tags:
The following analytic identifies the use of PowerShell downloading a file using `DownloadString` method. This particular method is utilized in many different PowerShell frameworks to download files and output to disk. Identify the source (IP/domain) and destination file and triage appropriately. If AMSI logging or PowerShell transaction logs are available, review for further details of the implant.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-03-01
- **Author**: Michael Haag, Splunk
- **ID**: 4d015ef2-7adf-11eb-95da-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
+| ----------- | ----------- | -------------- |
+| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 |
+
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ The following analytic identifies the use of PowerShell downloading a file using
| [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,11 +107,11 @@ The following analytic identifies the use of PowerShell downloading a file using
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `any_powershell_downloadstring_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **any_powershell_downloadstring_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -90,9 +140,6 @@ False positives may be present and filtering will need to occur by parent proces
* [Ingress Tool Transfer](/stories/ingress_tool_transfer)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -102,8 +149,6 @@ False positives may be present and filtering will need to occur by parent proces
| 56.0 | 80 | 70 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadString within PowerShell. |
-
-
#### Reference
* [https://docs.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadstring?view=net-5.0](https://docs.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadstring?view=net-5.0)
@@ -113,7 +158,7 @@ False positives may be present and filtering will need to occur by parent proces
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-03-01-fodhelper_uac_bypass.md b/docs/_posts/2021-03-01-fodhelper_uac_bypass.md
index fb58a0306c..337c7b7e45 100644
--- a/docs/_posts/2021-03-01-fodhelper_uac_bypass.md
+++ b/docs/_posts/2021-03-01-fodhelper_uac_bypass.md
@@ -36,16 +36,21 @@ Fodhelper.exe has a known UAC bypass as it attempts to look for specific registr
1. `HKCU:\Software\Classes\ms-settings\shell\open\command\(default)`\
Upon triage, fodhelper.exe will have a child process and read access will occur on the registry keys. Isolate the endpoint and review parallel processes for additional behavior.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-03-01
- **Author**: Michael Haag, Splunk
- **ID**: 909f8fd8-7ac8-11eb-a1f3-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -55,6 +60,51 @@ Upon triage, fodhelper.exe will have a child process and read access will occur
| [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -68,10 +118,10 @@ Upon triage, fodhelper.exe will have a child process and read access will occur
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `fodhelper_uac_bypass_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **fodhelper_uac_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -96,9 +146,6 @@ Limited to no false positives are expected.
* [IcedID](/stories/icedid)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -108,8 +155,6 @@ Limited to no false positives are expected.
| 81.0 | 90 | 90 | Suspcious registy keys added by process fodhelper.exe (process_id- $process_id), with a parent_process of $parent_process_name$ that has been executed on $dest$ by $user$. |
-
-
#### Reference
* [https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/](https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/)
@@ -120,7 +165,7 @@ Limited to no false positives are expected.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-03-01-ryuk_wake_on_lan_command.md b/docs/_posts/2021-03-01-ryuk_wake_on_lan_command.md
index 2c47a8618a..ad6d500487 100644
--- a/docs/_posts/2021-03-01-ryuk_wake_on_lan_command.md
+++ b/docs/_posts/2021-03-01-ryuk_wake_on_lan_command.md
@@ -27,16 +27,21 @@ tags:
This Splunk query identifies the use of Wake-on-LAN utilized by Ryuk ransomware. The Ryuk Ransomware uses the Wake-on-Lan feature to turn on powered off devices on a compromised network to have greater success encrypting them. This is a high fidelity indicator of Ryuk ransomware executing on an endpoint. Upon triage, isolate the endpoint. Additional file modification events will be within the users profile (\appdata\roaming) and in public directories (users\public\). Review all Scheduled Tasks on the isolated endpoint and across the fleet. Suspicious Scheduled Tasks will include a path to a unknown binary and those endpoints should be isolated until triaged.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-03-01
- **Author**: Michael Haag, Splunk
- **ID**: 538d0152-7aaa-11eb-beaa-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This Splunk query identifies the use of Wake-on-LAN utilized by Ryuk ransomware.
| [T1059.003](https://attack.mitre.org/techniques/T1059/003/) | Windows Command Shell | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +107,10 @@ This Splunk query identifies the use of Wake-on-LAN utilized by Ryuk ransomware.
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `ryuk_wake_on_lan_command_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **ryuk_wake_on_lan_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +134,6 @@ Limited to no known false positives.
* [Ryuk Ransomware](/stories/ryuk_ransomware)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -96,8 +143,6 @@ Limited to no known false positives.
| 63.0 | 70 | 90 | A process $process_name$ with wake on LAN commandline $process$ in host $dest$ |
-
-
#### Reference
* [https://www.bleepingcomputer.com/news/security/ryuk-ransomware-uses-wake-on-lan-to-encrypt-offline-devices/](https://www.bleepingcomputer.com/news/security/ryuk-ransomware-uses-wake-on-lan-to-encrypt-offline-devices/)
@@ -107,7 +152,7 @@ Limited to no known false positives.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-03-01-suspicious_scheduled_task_from_public_directory.md b/docs/_posts/2021-03-01-suspicious_scheduled_task_from_public_directory.md
index f29aa141cc..58ebb99a88 100644
--- a/docs/_posts/2021-03-01-suspicious_scheduled_task_from_public_directory.md
+++ b/docs/_posts/2021-03-01-suspicious_scheduled_task_from_public_directory.md
@@ -31,16 +31,21 @@ tags:
The following detection identifies Scheduled Tasks registering (creating a new task) a binary or script to run from a public directory which includes users\public, \programdata\ and \windows\temp. Upon triage, review the binary or script in the command line for legitimacy, whether an approved binary/script or not. In addition, capture the binary or script in question and analyze for further behaviors. Identify the source and contain the endpoint.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-03-01
- **Author**: Michael Haag, Splunk
- **ID**: 7feb7972-7ac3-11eb-bac8-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -48,6 +53,51 @@ The following detection identifies Scheduled Tasks registering (creating a new t
| [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -61,10 +111,10 @@ The following detection identifies Scheduled Tasks registering (creating a new t
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `suspicious_scheduled_task_from_public_directory_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **suspicious_scheduled_task_from_public_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -91,9 +141,6 @@ Limited false positives may be present. Filter as needed by parent process or co
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -103,8 +150,6 @@ Limited false positives may be present. Filter as needed by parent process or co
| 35.0 | 70 | 50 | Suspicious scheduled task registered on $dest$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1053/005/](https://attack.mitre.org/techniques/T1053/005/)
@@ -112,7 +157,7 @@ Limited false positives may be present. Filter as needed by parent process or co
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-03-02-aws_setdefaultpolicyversion.md b/docs/_posts/2021-03-02-aws_setdefaultpolicyversion.md
index 868ce25108..e3c4503e8c 100644
--- a/docs/_posts/2021-03-02-aws_setdefaultpolicyversion.md
+++ b/docs/_posts/2021-03-02-aws_setdefaultpolicyversion.md
@@ -32,16 +32,21 @@ tags:
This search looks for AWS CloudTrail events where a user has set a default policy versions. Attackers have been know to use this technique for Privilege Escalation in case the previous versions of the policy had permissions to access more resources than the current version of the policy
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-03-02
- **Author**: Bhavin Patel, Splunk
- **ID**: 2a9b80d3-6340-4345-11ad-212bf3d0dac4
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -49,6 +54,57 @@ This search looks for AWS CloudTrail events where a user has set a default polic
| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.DS
+* PR.AC
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 13
+
+
+
+
+
+
+
#### Search
```
@@ -61,10 +117,10 @@ This search looks for AWS CloudTrail events where a user has set a default polic
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `aws_setdefaultpolicyversion_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **aws_setdefaultpolicyversion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -85,9 +141,6 @@ While this search has no known false positives, it is possible that an AWS admin
* [AWS IAM Privilege Escalation](/stories/aws_iam_privilege_escalation)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -97,8 +150,6 @@ While this search has no known false positives, it is possible that an AWS admin
| 30.0 | 50 | 60 | From IP address $sourceIPAddress$, user agent $userAgent$ has trigged an event $eventName$ for updating the the default policy version |
-
-
#### Reference
* [https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws](https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws)
@@ -107,7 +158,7 @@ While this search has no known false positives, it is possible that an AWS admin
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-03-02-unified_messaging_service_spawning_a_process.md b/docs/_posts/2021-03-02-unified_messaging_service_spawning_a_process.md
index 990621fbe9..0528d9497c 100644
--- a/docs/_posts/2021-03-02-unified_messaging_service_spawning_a_process.md
+++ b/docs/_posts/2021-03-02-unified_messaging_service_spawning_a_process.md
@@ -25,21 +25,75 @@ tags:
This detection identifies Microsoft Exchange Server's Unified Messaging services, umworkerprocess.exe and umservice.exe, spawning a child process, indicating possible exploitation of CVE-2021-26857 vulnerability. The query filters out werfault.exe and wermgr.exe mostly due to potential false positives, however, if there is an excessive amount of "wermgr.exe" or "WerFault.exe" failures, it may be due to the active exploitation. During triage, identify any additional suspicious parallel processes. Identify any recent out of place file modifications. Review Exchange logs following Microsofts guide. To contain, perform egress filtering or restrict public access to Exchange. In final, patch the vulnerablity and monitor.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-03-02
- **Author**: Michael Haag, Splunk
- **ID**: f1126df0-7bd5-11eb-988f-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1190](https://attack.mitre.org/techniques/T1190/) | Exploit Public-Facing Application | Initial Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -53,10 +107,10 @@ This detection identifies Microsoft Exchange Server's Unified Messaging services
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `unified_messaging_service_spawning_a_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **unified_messaging_service_spawning_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -79,9 +133,6 @@ Unknown. Tune out child processes as needed to limit volume of false positives.
* [HAFNIUM Group](/stories/hafnium_group)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -91,14 +142,6 @@ Unknown. Tune out child processes as needed to limit volume of false positives.
| 56.0 | 70 | 80 | Possible CVE-2021-26857 exploitation on $dest$ |
-#### CVE
-
-| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
-| ----------- | ----------- | -------------- |
-| [CVE-2021-26857](https://nvd.nist.gov/vuln/detail/CVE-2021-26857) | Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-26412, CVE-2021-26854, CVE-2021-26855, CVE-2021-26858, CVE-2021-27065, CVE-2021-27078. | 6.8 |
-
-
-
#### Reference
* [https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/](https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/)
@@ -108,7 +151,7 @@ Unknown. Tune out child processes as needed to limit volume of false positives.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-03-02-windows_disableantispyware_registry.md b/docs/_posts/2021-03-02-windows_disableantispyware_registry.md
index 809bfe6306..5305e0d427 100644
--- a/docs/_posts/2021-03-02-windows_disableantispyware_registry.md
+++ b/docs/_posts/2021-03-02-windows_disableantispyware_registry.md
@@ -27,16 +27,21 @@ tags:
The search looks for the Registry Key DisableAntiSpyware set to disable. This is consistent with Ryuk infections across a fleet of endpoints. This particular behavior is typically executed when an ransomware actor gains access to an endpoint and beings to perform execution. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-03-02
- **Author**: Rod Soto, Jose Hernandez, Michael Haag, Splunk
- **ID**: 23150a40-9301-4195-b802-5bb4f43067fb
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
+| ----------- | ----------- | -------------- |
+| [CVE-2021-26857](https://nvd.nist.gov/vuln/detail/CVE-2021-26857) | Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-26412, CVE-2021-26854, CVE-2021-26855, CVE-2021-26858, CVE-2021-27065, CVE-2021-27078. | 6.8 |
+
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,56 @@ The search looks for the Registry Key DisableAntiSpyware set to disable. This is
| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Delivery
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +112,10 @@ The search looks for the Registry Key DisableAntiSpyware set to disable. This is
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `windows_disableantispyware_registry_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **windows_disableantispyware_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -83,9 +138,6 @@ It is unusual to turn this feature off a Windows system since it is a default se
* [Windows Registry Abuse](/stories/windows_registry_abuse)
-#### Kill Chain Phase
-* Delivery
-
#### RBA
@@ -95,8 +147,6 @@ It is unusual to turn this feature off a Windows system since it is a default se
| 24.0 | 30 | 80 | Windows DisableAntiSpyware registry key set to 'disabled' on $dest$ |
-
-
#### Reference
* [https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/](https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/)
@@ -104,7 +154,7 @@ It is unusual to turn this feature off a Windows system since it is a default se
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-03-03-nishang_powershelltcponeline.md b/docs/_posts/2021-03-03-nishang_powershelltcponeline.md
index fc59df8862..2069f8b673 100644
--- a/docs/_posts/2021-03-03-nishang_powershelltcponeline.md
+++ b/docs/_posts/2021-03-03-nishang_powershelltcponeline.md
@@ -27,16 +27,21 @@ tags:
This query detects the Nishang Invoke-PowerShellTCPOneLine utility that spawns a call back to a remote command and control server. This is a powershell oneliner. In addition, this will capture on the command-line additional utilities used by Nishang. Triage the endpoint and identify any parallel processes that look suspicious. Review the reputation of the remote IP or domain contacted by the powershell process.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-03-03
- **Author**: Michael Haag, Splunk
- **ID**: 1a382c6c-7c2e-11eb-ac69-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This query detects the Nishang Invoke-PowerShellTCPOneLine utility that spawns a
| [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,11 +107,11 @@ This query detects the Nishang Invoke-PowerShellTCPOneLine utility that spawns a
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `nishang_powershelltcponeline_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **nishang_powershelltcponeline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -88,9 +138,6 @@ Limited false positives may be present. Filter as needed based on initial analys
* [HAFNIUM Group](/stories/hafnium_group)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -100,8 +147,6 @@ Limited false positives may be present. Filter as needed based on initial analys
| 42.0 | 70 | 60 | Possible Nishang Invoke-PowerShellTCPOneLine behavior on $dest$ |
-
-
#### Reference
* [https://github.com/samratashok/nishang/blob/master/Shells/Invoke-PowerShellTcpOneLine.ps1](https://github.com/samratashok/nishang/blob/master/Shells/Invoke-PowerShellTcpOneLine.ps1)
@@ -112,7 +157,7 @@ Limited false positives may be present. Filter as needed based on initial analys
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-03-03-w3wp_spawning_shell.md b/docs/_posts/2021-03-03-w3wp_spawning_shell.md
index 6f5cb321c0..97538a40fe 100644
--- a/docs/_posts/2021-03-03-w3wp_spawning_shell.md
+++ b/docs/_posts/2021-03-03-w3wp_spawning_shell.md
@@ -30,16 +30,21 @@ tags:
This query identifies a shell, PowerShell.exe or Cmd.exe, spawning from W3WP.exe, or IIS. In addition to IIS logs, this behavior with an EDR product will capture potential webshell activity, similar to the HAFNIUM Group abusing CVEs, on publicly available Exchange mail servers. During triage, review the parent process and child process of the shell being spawned. Review the command-line arguments and any file modifications that may occur. Identify additional parallel process, child processes, that may highlight further commands executed. After triaging, work to contain the threat and patch the system that is vulnerable.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-03-03
- **Author**: Michael Haag, Splunk
- **ID**: 0f03423c-7c6a-11eb-bc47-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -47,6 +52,57 @@ This query identifies a shell, PowerShell.exe or Cmd.exe, spawning from W3WP.exe
| [T1505.003](https://attack.mitre.org/techniques/T1505/003/) | Web Shell | Persistence |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -60,12 +116,12 @@ This query identifies a shell, PowerShell.exe or Cmd.exe, spawning from W3WP.exe
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
-Note that `w3wp_spawning_shell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **w3wp_spawning_shell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -93,9 +149,6 @@ Baseline your environment before production. It is possible build systems using
* [ProxyShell](/stories/proxyshell)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -105,16 +158,6 @@ Baseline your environment before production. It is possible build systems using
| 56.0 | 70 | 80 | Possible Web Shell execution on $dest$ |
-#### CVE
-
-| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
-| ----------- | ----------- | -------------- |
-| [CVE-2021-34473](https://nvd.nist.gov/vuln/detail/CVE-2021-34473) | Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-31196, CVE-2021-31206. | 10.0 |
-| [CVE-2021-34523](https://nvd.nist.gov/vuln/detail/CVE-2021-34523) | Microsoft Exchange Server Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-33768, CVE-2021-34470. | 7.5 |
-| [CVE-2021-31207](https://nvd.nist.gov/vuln/detail/CVE-2021-31207) | Microsoft Exchange Server Security Feature Bypass Vulnerability | 6.5 |
-
-
-
#### Reference
* [https://www.microsoft.com/security/blog/2020/02/04/ghost-in-the-shell-investigating-web-shell-attacks/](https://www.microsoft.com/security/blog/2020/02/04/ghost-in-the-shell-investigating-web-shell-attacks/)
@@ -125,7 +168,7 @@ Baseline your environment before production. It is possible build systems using
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md b/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md
index 9c3ee9d414..d459b46915 100644
--- a/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md
+++ b/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md
@@ -24,21 +24,71 @@ tags:
The following analytics identifies a big number of instance of ransomware notes (filetype e.g .txt, .html, .hta) file creation to the infected machine. This behavior is a good sensor if the ransomware note filename is quite new for security industry or the ransomware note filename is not in your ransomware lookup table list for monitoring.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-03-12
- **Author**: Teoderick Contreras
- **ID**: eff7919a-8330-11eb-83f8-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
+| ----------- | ----------- | -------------- |
+| [CVE-2021-34473](https://nvd.nist.gov/vuln/detail/CVE-2021-34473) | Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-31196, CVE-2021-31206. | 10.0 |
+| [CVE-2021-34523](https://nvd.nist.gov/vuln/detail/CVE-2021-34523) | Microsoft Exchange Server Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-33768, CVE-2021-34470. | 7.5 |
+| [CVE-2021-31207](https://nvd.nist.gov/vuln/detail/CVE-2021-31207) | Microsoft Exchange Server Security Feature Bypass Vulnerability | 6.5 |
+
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1486](https://attack.mitre.org/techniques/T1486/) | Data Encrypted for Impact | Impact |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -53,10 +103,10 @@ The following analytics identifies a big number of instance of ransomware notes
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `ransomware_notes_bulk_creation_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **ransomware_notes_bulk_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* EventCode
@@ -80,9 +130,6 @@ unknown
* [BlackMatter Ransomware](/stories/blackmatter_ransomware)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -92,8 +139,6 @@ unknown
| 81.0 | 90 | 90 | A high frequency file creation of $file_name$ in different file path in host $Computer$ |
-
-
#### Reference
* [https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html](https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html)
@@ -102,7 +147,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-03-12-resize_shadowstorage_volume.md b/docs/_posts/2021-03-12-resize_shadowstorage_volume.md
index 51e6f95da6..188fc9f4a8 100644
--- a/docs/_posts/2021-03-12-resize_shadowstorage_volume.md
+++ b/docs/_posts/2021-03-12-resize_shadowstorage_volume.md
@@ -24,21 +24,71 @@ tags:
The following analytics identifies the resizing of shadowstorage by ransomware malware to avoid the shadow volumes being made again. this technique is an alternative by ransomware attacker than deleting the shadowstorage which is known alert in defensive team. one example of ransomware that use this technique is CLOP ransomware where it drops a .bat file that will resize the shadowstorage to minimum size as much as possible
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-03-12
- **Author**: Teoderick Contreras
- **ID**: bc760ca6-8336-11eb-bcbb-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1490](https://attack.mitre.org/techniques/T1490/) | Inhibit System Recovery | Impact |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +102,10 @@ The following analytics identifies the resizing of shadowstorage by ransomware m
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `resize_shadowstorage_volume_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **resize_shadowstorage_volume_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* Processes.process
@@ -77,9 +127,6 @@ network admin can resize the shadowstorage for valid purposes.
* [Clop Ransomware](/stories/clop_ransomware)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -89,8 +136,6 @@ network admin can resize the shadowstorage for valid purposes.
| 72.0 | 80 | 90 | A process $parent_process_name$ attempt to resize shadow copy with commandline $process$ in host $dest$ |
-
-
#### Reference
* [https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html](https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html)
@@ -102,7 +147,7 @@ network admin can resize the shadowstorage for valid purposes.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-03-16-high_process_termination_frequency.md b/docs/_posts/2021-03-16-high_process_termination_frequency.md
index 1d460d0ba7..e9a10ed2b3 100644
--- a/docs/_posts/2021-03-16-high_process_termination_frequency.md
+++ b/docs/_posts/2021-03-16-high_process_termination_frequency.md
@@ -24,21 +24,71 @@ tags:
This analytics are designed to indentify a high frequency of process termination on a machine which is a common behavior of ransomware malware before encrypting files. This technique is designed to avoid an exception error while accessing (docs, images, database and etc..) in the infected machine for encryption.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-03-16
- **Author**: Teoderick Contreras
- **ID**: 17cd75b2-8666-11eb-9ab4-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1486](https://attack.mitre.org/techniques/T1486/) | Data Encrypted for Impact | Impact |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -53,10 +103,10 @@ This analytics are designed to indentify a high frequency of process termination
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `high_process_termination_frequency_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **high_process_termination_frequency_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* EventCode
@@ -76,9 +126,6 @@ admin or user tool that can terminate multiple process.
* [Clop Ransomware](/stories/clop_ransomware)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -88,8 +135,6 @@ admin or user tool that can terminate multiple process.
| 72.0 | 90 | 80 | High frequency process termination (more than 15 processes within 3s) detected on host $Computer$ |
-
-
#### Reference
* [https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html](https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html)
@@ -98,7 +143,7 @@ admin or user tool that can terminate multiple process.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-03-16-windows_high_file_deletion_frequency.md b/docs/_posts/2021-03-16-windows_high_file_deletion_frequency.md
index 585aeea63b..5a565e980e 100644
--- a/docs/_posts/2021-03-16-windows_high_file_deletion_frequency.md
+++ b/docs/_posts/2021-03-16-windows_high_file_deletion_frequency.md
@@ -24,21 +24,71 @@ tags:
This search looks for high frequency of file deletion relative to process name and process id. These events usually happen when the ransomware tries to encrypt the files with the ransomware file extensions and sysmon treat the original files to be deleted as soon it was replace as encrypted data.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-03-16
- **Author**: Teoderick Contreras
- **ID**: 45b125c4-866f-11eb-a95a-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1485](https://attack.mitre.org/techniques/T1485/) | Data Destruction | Impact |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +102,10 @@ This search looks for high frequency of file deletion relative to process name a
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `windows_high_file_deletion_frequency_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **windows_high_file_deletion_frequency_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* EventCode
@@ -78,9 +128,6 @@ user may delete bunch of pictures or files in a folder.
* [WhisperGate](/stories/whispergate)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -90,8 +137,6 @@ user may delete bunch of pictures or files in a folder.
| 72.0 | 90 | 80 | High frequency file deletion activity detected on host $Computer$ |
-
-
#### Reference
* [https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html](https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html)
@@ -101,7 +146,7 @@ user may delete bunch of pictures or files in a folder.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-03-17-clop_common_exec_parameter.md b/docs/_posts/2021-03-17-clop_common_exec_parameter.md
index a3d5ce5217..dc7696c984 100644
--- a/docs/_posts/2021-03-17-clop_common_exec_parameter.md
+++ b/docs/_posts/2021-03-17-clop_common_exec_parameter.md
@@ -24,21 +24,71 @@ tags:
The following analytics are designed to identifies some CLOP ransomware variant that using arguments to execute its main code or feature of its code. In this variant if the parameter is "runrun", CLOP ransomware will try to encrypt files in network shares and if it is "temp.dat", it will try to read from some stream pipe or file start encrypting files within the infected local machines. This technique can be also identified as an anti-sandbox technique to make its code non-responsive since it is waiting for some parameter to execute properly.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-03-17
- **Author**: Teoderick Contreras, Splunk
- **ID**: 5a8a2a72-8322-11eb-9ee9-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1204](https://attack.mitre.org/techniques/T1204/) | User Execution | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +102,10 @@ The following analytics are designed to identifies some CLOP ransomware variant
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `clop_common_exec_parameter_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **clop_common_exec_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -82,9 +132,6 @@ Operators can execute third party tools using these parameters.
* [Clop Ransomware](/stories/clop_ransomware)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -94,8 +141,6 @@ Operators can execute third party tools using these parameters.
| 100.0 | 100 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting using arguments to execute its main code or feature of its code related to Clop ransomware. |
-
-
#### Reference
* [https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html](https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html)
@@ -104,7 +149,7 @@ Operators can execute third party tools using these parameters.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md b/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md
index d82cc90cb6..8b7470b10f 100644
--- a/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md
+++ b/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md
@@ -25,21 +25,71 @@ tags:
This detection is to identify the common service name created by the CLOP ransomware as part of its persistence and high privilege code execution in the infected machine. Ussually CLOP ransomware use StartServiceCtrlDispatcherW API in creating this service entry.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-03-17
- **Author**: Teoderick Contreras
- **ID**: 07e08a12-870c-11eb-b5f9-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1543](https://attack.mitre.org/techniques/T1543/) | Create or Modify System Process | Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +102,10 @@ This detection is to identify the common service name created by the CLOP ransom
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `clop_ransomware_known_service_name_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **clop_ransomware_known_service_name_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* EventCode
@@ -77,9 +127,6 @@ unknown
* [Clop Ransomware](/stories/clop_ransomware)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -89,8 +136,6 @@ unknown
| 100.0 | 100 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ executing known Clop Ransomware service names. |
-
-
#### Reference
* [https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html](https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html)
@@ -99,7 +144,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-03-23-certutil_with_decode_argument.md b/docs/_posts/2021-03-23-certutil_with_decode_argument.md
index 9eb31d8b67..536095696c 100644
--- a/docs/_posts/2021-03-23-certutil_with_decode_argument.md
+++ b/docs/_posts/2021-03-23-certutil_with_decode_argument.md
@@ -24,21 +24,71 @@ tags:
CertUtil.exe may be used to `encode` and `decode` a file, including PE and script code. Encoding will convert a file to base64 with `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----` tags. Malicious usage will include decoding a encoded file that was downloaded. Once decoded, it will be loaded by a parallel process. Note that there are two additional command switches that may be used - `encodehex` and `decodehex`. Similarly, the file will be encoded in HEX and later decoded for further execution. During triage, identify the source of the file being decoded. Review its contents or execution behavior for further analysis.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-03-23
- **Author**: Michael Haag, Splunk
- **ID**: bfe94226-8c10-11eb-a4b3-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1140](https://attack.mitre.org/techniques/T1140/) | Deobfuscate/Decode Files or Information | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,11 +102,11 @@ CertUtil.exe may be used to `encode` and `decode` a file, including PE and scrip
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `certutil_with_decode_argument_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **certutil_with_decode_argument_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +134,6 @@ Typically seen used to `encode` files, but it is possible to see legitimate use
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -96,8 +143,6 @@ Typically seen used to `encode` files, but it is possible to see legitimate use
| 40.0 | 50 | 80 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to decode a file. |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1140/](https://attack.mitre.org/techniques/T1140/)
@@ -108,7 +153,7 @@ Typically seen used to `encode` files, but it is possible to see legitimate use
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-03-29-powershell_start-bitstransfer.md b/docs/_posts/2021-03-29-powershell_start-bitstransfer.md
index cf21775d4c..a6616c6bc8 100644
--- a/docs/_posts/2021-03-29-powershell_start-bitstransfer.md
+++ b/docs/_posts/2021-03-29-powershell_start-bitstransfer.md
@@ -25,21 +25,71 @@ tags:
Start-BitsTransfer is the PowerShell "version" of BitsAdmin.exe. Similar functionality is present. This technique variation is not as commonly used by adversaries, but has been abused in the past. Lesser known uses include the ability to set the `-TransferType` to `Upload` for exfiltration of files. In an instance where `Upload` is used, it is highly possible files will be archived. During triage, review parallel processes and process lineage. Capture any files on disk and review. For the remote domain or IP, what is the reputation?
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-03-29
- **Author**: Michael Haag, Splunk
- **ID**: 39e2605a-90d8-11eb-899e-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1197](https://attack.mitre.org/techniques/T1197/) | BITS Jobs | Defense Evasion, Persistence |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -53,11 +103,11 @@ Start-BitsTransfer is the PowerShell "version" of BitsAdmin.exe. Similar functio
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `powershell_start-bitstransfer_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **powershell_start-bitstransfer_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +134,6 @@ Limited false positives. It is possible administrators will utilize Start-BitsTr
* [BITS Jobs](/stories/bits_jobs)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -96,8 +143,6 @@ Limited false positives. It is possible administrators will utilize Start-BitsTr
| 56.0 | 70 | 80 | A suspicious process $process_name$ with commandline $process$ that are related to bittransfer functionality in host $dest$ |
-
-
#### Reference
* [https://isc.sans.edu/diary/Investigating+Microsoft+BITS+Activity/23281](https://isc.sans.edu/diary/Investigating+Microsoft+BITS+Activity/23281)
@@ -106,7 +151,7 @@ Limited false positives. It is possible administrators will utilize Start-BitsTr
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-03-31-aws_iam_successful_group_deletion.md b/docs/_posts/2021-03-31-aws_iam_successful_group_deletion.md
index 6857fc608d..255d9f47a4 100644
--- a/docs/_posts/2021-03-31-aws_iam_successful_group_deletion.md
+++ b/docs/_posts/2021-03-31-aws_iam_successful_group_deletion.md
@@ -29,16 +29,21 @@ tags:
The following query uses IAM events to track the success of a group being deleted on AWS. This is typically not indicative of malicious behavior, but a precurser to additional events thay may unfold. Review parallel IAM events - recently added users, new groups and so forth. Inversely, review failed attempts in a similar manner.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-03-31
- **Author**: Michael Haag, Splunk
- **ID**: e776d06c-9267-11eb-819b-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -48,6 +53,51 @@ The following query uses IAM events to track the success of a group being delete
| [T1069](https://attack.mitre.org/techniques/T1069/) | Permission Groups Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -60,10 +110,10 @@ The following query uses IAM events to track the success of a group being delete
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `aws_iam_successful_group_deletion_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **aws_iam_successful_group_deletion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -83,9 +133,6 @@ This detection will require tuning to provide high fidelity detection capabiltie
* [AWS IAM Privilege Escalation](/stories/aws_iam_privilege_escalation)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -95,8 +142,6 @@ This detection will require tuning to provide high fidelity detection capabiltie
| 5.0 | 10 | 50 | User $user_arn$ has sucessfully deleted mulitple groups $group_deleted$ from $src$ |
-
-
#### Reference
* [https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/delete-group.html](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/delete-group.html)
@@ -105,7 +150,7 @@ This detection will require tuning to provide high fidelity detection capabiltie
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md b/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md
index a46dffcf35..e68bcc78f8 100644
--- a/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md
+++ b/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md
@@ -27,16 +27,21 @@ tags:
This search is to identifies suspicious firewall disabling using netsh application. this technique is commonly seen in malware that tries to communicate or download its component or other payload to its C2 server.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-03-31
- **Author**: Teoderick Contreras, Splunk
- **ID**: 6860a62c-9203-11eb-9e05-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This search is to identifies suspicious firewall disabling using netsh applicati
| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,11 +107,11 @@ This search is to identifies suspicious firewall disabling using netsh applicati
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `disabling_firewall_with_netsh_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **disabling_firewall_with_netsh_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -88,9 +138,6 @@ admin may disable firewall during testing or fixing network problem.
* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -100,8 +147,6 @@ admin may disable firewall during testing or fixing network problem.
| 25.0 | 50 | 50 | The Windows Firewall was disabled on $dest$ by $user$. |
-
-
#### Reference
* [https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.htm](https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.htm)
@@ -109,7 +154,7 @@ admin may disable firewall during testing or fixing network problem.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-03-31-dsquery_domain_discovery.md b/docs/_posts/2021-03-31-dsquery_domain_discovery.md
index 53c1a92939..206d347377 100644
--- a/docs/_posts/2021-03-31-dsquery_domain_discovery.md
+++ b/docs/_posts/2021-03-31-dsquery_domain_discovery.md
@@ -29,21 +29,71 @@ DSQuery.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`
The following DLL(s) are loaded when DSQuery.exe is launched `dsquery.dll`. If found loaded by another process, it is possible dsquery is running within that process context in memory.\
In addition to trust discovery, review parallel processes for additional behaviors performed. Identify the parent process and capture any files (batch files, for example) being used.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-03-31
- **Author**: Michael Haag, Splunk
- **ID**: cc316032-924a-11eb-91a2-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1482](https://attack.mitre.org/techniques/T1482/) | Domain Trust Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +107,10 @@ In addition to trust discovery, review parallel processes for additional behavio
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `dsquery_domain_discovery_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **dsquery_domain_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +134,6 @@ Limited false positives. If there is a true false positive, filter based on comm
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -96,8 +143,6 @@ Limited false positives. If there is a true false positive, filter based on comm
| 72.0 | 80 | 90 | An instance of $parent_process_name$ spawning $process_name$ was identified performing domain discovery on endpoint $dest$ by user $user$. |
-
-
#### Reference
* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1482/T1482.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1482/T1482.md)
@@ -108,7 +153,7 @@ Limited false positives. If there is a true false positive, filter based on comm
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-04-01-aws_iam_assume_role_policy_brute_force.md b/docs/_posts/2021-04-01-aws_iam_assume_role_policy_brute_force.md
index 854b6cc753..45408a589f 100644
--- a/docs/_posts/2021-04-01-aws_iam_assume_role_policy_brute_force.md
+++ b/docs/_posts/2021-04-01-aws_iam_assume_role_policy_brute_force.md
@@ -26,16 +26,21 @@ tags:
The following detection identifies any malformed policy document exceptions with a status of `failure`. A malformed policy document exception occurs in instances where roles are attempted to be assumed, or brute forced. In a brute force attempt, using a tool like CloudSploit or Pacu, an attempt will look like `arn:aws:iam::111111111111:role/aws-service-role/rds.amazonaws.com/AWSServiceRoleForRDS`. Meaning, when an adversary is attempting to identify a role name, multiple failures will occur. This detection focuses on the errors of a remote attempt that is failing.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-04-01
- **Author**: Michael Haag, Splunk
- **ID**: f19e09b0-9308-11eb-b7ec-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,51 @@ The following detection identifies any malformed policy document exceptions with
| [T1110](https://attack.mitre.org/techniques/T1110/) | Brute Force | Credential Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -56,10 +106,10 @@ The following detection identifies any malformed policy document exceptions with
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `aws_iam_assume_role_policy_brute_force_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **aws_iam_assume_role_policy_brute_force_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -79,9 +129,6 @@ This detection will require tuning to provide high fidelity detection capabiltie
* [AWS IAM Privilege Escalation](/stories/aws_iam_privilege_escalation)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -91,8 +138,6 @@ This detection will require tuning to provide high fidelity detection capabiltie
| 28.0 | 40 | 70 | User $user_arn$ has caused multiple failures with errorCode $errorCode$, which potentially means adversary is attempting to identify a role name. |
-
-
#### Reference
* [https://www.praetorian.com/blog/aws-iam-assume-role-vulnerabilities](https://www.praetorian.com/blog/aws-iam-assume-role-vulnerabilities)
@@ -102,7 +147,7 @@ This detection will require tuning to provide high fidelity detection capabiltie
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-04-01-aws_iam_delete_policy.md b/docs/_posts/2021-04-01-aws_iam_delete_policy.md
index 9c820182c8..e3d7e22345 100644
--- a/docs/_posts/2021-04-01-aws_iam_delete_policy.md
+++ b/docs/_posts/2021-04-01-aws_iam_delete_policy.md
@@ -23,21 +23,71 @@ tags:
The following detection identifes when a policy is deleted on AWS. This does not identify whether successful or failed, but the error messages tell a story of suspicious attempts. There is a specific process to follow when deleting a policy. First, detach the policy from all users, groups, and roles that the policy is attached to, using DetachUserPolicy , DetachGroupPolicy , or DetachRolePolicy.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-04-01
- **Author**: Michael Haag, Splunk
- **ID**: ec3a9362-92fe-11eb-99d0-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1098](https://attack.mitre.org/techniques/T1098/) | Account Manipulation | Persistence |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -50,10 +100,10 @@ The following detection identifes when a policy is deleted on AWS. This does not
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `aws_iam_delete_policy_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **aws_iam_delete_policy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -73,9 +123,6 @@ This detection will require tuning to provide high fidelity detection capabiltie
* [AWS IAM Privilege Escalation](/stories/aws_iam_privilege_escalation)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -85,8 +132,6 @@ This detection will require tuning to provide high fidelity detection capabiltie
| 10.0 | 20 | 50 | User $user_arn$ has deleted AWS Policies from IP address $src$ by executing the following command $eventName$ |
-
-
#### Reference
* [https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeletePolicy.html](https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeletePolicy.html)
@@ -95,7 +140,7 @@ This detection will require tuning to provide high fidelity detection capabiltie
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-04-01-aws_iam_failure_group_deletion.md b/docs/_posts/2021-04-01-aws_iam_failure_group_deletion.md
index 22f95f2252..00e4683600 100644
--- a/docs/_posts/2021-04-01-aws_iam_failure_group_deletion.md
+++ b/docs/_posts/2021-04-01-aws_iam_failure_group_deletion.md
@@ -23,21 +23,71 @@ tags:
This detection identifies failure attempts to delete groups. We want to identify when a group is attempting to be deleted, but either access is denied, there is a conflict or there is no group. This is indicative of administrators performing an action, but also could be suspicious behavior occurring. Review parallel IAM events - recently added users, new groups and so forth.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-04-01
- **Author**: Michael Haag, Splunk
- **ID**: 723b861a-92eb-11eb-93b8-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1098](https://attack.mitre.org/techniques/T1098/) | Account Manipulation | Persistence |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -50,10 +100,10 @@ This detection identifies failure attempts to delete groups. We want to identify
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `aws_iam_failure_group_deletion_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **aws_iam_failure_group_deletion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -73,9 +123,6 @@ This detection will require tuning to provide high fidelity detection capabiltie
* [AWS IAM Privilege Escalation](/stories/aws_iam_privilege_escalation)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -85,8 +132,6 @@ This detection will require tuning to provide high fidelity detection capabiltie
| 5.0 | 10 | 50 | User $user_arn$ has had mulitple failures while attempting to delete groups from $src$ |
-
-
#### Reference
* [https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/delete-group.html](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/delete-group.html)
@@ -95,7 +140,7 @@ This detection will require tuning to provide high fidelity detection capabiltie
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md b/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md
index 0cd8cb6116..ff16833ce2 100644
--- a/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md
+++ b/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md
@@ -27,16 +27,21 @@ tags:
This detection is to identify the abuse the Windows SC.exe to execute malicious commands or payloads via PowerShell.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-04-07
- **Author**: Ryan Becwar
- **ID**: 8e204dfd-cae0-4ea8-a61d-e972a1ff2ff8
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This detection is to identify the abuse the Windows SC.exe to execute malicious
| [T1569.002](https://attack.mitre.org/techniques/T1569/002/) | Service Execution | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -65,10 +115,10 @@ This detection is to identify the abuse the Windows SC.exe to execute malicious
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `malicious_powershell_executed_as_a_service_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **malicious_powershell_executed_as_a_service_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* EventCode
@@ -91,9 +141,6 @@ Creating a hidden powershell service is rare and could key off of those instance
* [Malicious Powershell](/stories/malicious_powershell)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -103,8 +150,6 @@ Creating a hidden powershell service is rare and could key off of those instance
| 72.0 | 90 | 80 | Identifies the abuse the Windows SC.exe to execute malicious powerShell as a service $Service_File_Name$ by $user$ on $dest$ |
-
-
#### Reference
* [https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/dosfuscation-report.pdf](https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/dosfuscation-report.pdf)
@@ -114,7 +159,7 @@ Creating a hidden powershell service is rare and could key off of those instance
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-04-08-multiple_users_failing_to_authenticate_from_host_using_kerberos.md b/docs/_posts/2021-04-08-multiple_users_failing_to_authenticate_from_host_using_kerberos.md
index 2d5be3420c..e3ae03f1b1 100644
--- a/docs/_posts/2021-04-08-multiple_users_failing_to_authenticate_from_host_using_kerberos.md
+++ b/docs/_posts/2021-04-08-multiple_users_failing_to_authenticate_from_host_using_kerberos.md
@@ -29,16 +29,21 @@ The detection calculates the standard deviation for each host and leverages the
This detection will only trigger on domain controllers, not on member servers or workstations.\
The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-04-08
- **Author**: Mauricio Velazco, Splunk
- **ID**: 3a91a212-98a9-11eb-b86a-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,51 @@ The analytics returned fields allow analysts to investigate the event further by
| [T1110](https://attack.mitre.org/techniques/T1110/) | Brute Force | Credential Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -63,7 +113,7 @@ The analytics returned fields allow analysts to investigate the event further by
The SPL above uses the following Macros:
* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
-Note that `multiple_users_failing_to_authenticate_from_host_using_kerberos_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **multiple_users_failing_to_authenticate_from_host_using_kerberos_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +134,6 @@ A host failing to authenticate with multiple valid domain users is not a common
* [Active Directory Kerberos Attacks](/stories/active_directory_kerberos_attacks)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -96,8 +143,6 @@ A host failing to authenticate with multiple valid domain users is not a common
| 49.0 | 70 | 70 | Potential Kerberos based password spraying attack from $Client_Address$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1110/003/](https://attack.mitre.org/techniques/T1110/003/)
@@ -107,7 +152,7 @@ A host failing to authenticate with multiple valid domain users is not a common
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md b/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md
index 0c88449bc1..4c59958230 100644
--- a/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md
+++ b/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md
@@ -34,16 +34,21 @@ schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64
The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. If found loaded by another process, it is possible a scheduled task is being registered within that process context in memory.\
Upon triage, identify the task scheduled source. Was it schtasks.exe or was it via TaskService. Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-04-08
- **Author**: Michael Haag, Splunk
- **ID**: 5d9c6eee-988c-11eb-8253-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -51,6 +56,51 @@ Upon triage, identify the task scheduled source. Was it schtasks.exe or was it v
| [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -65,10 +115,10 @@ Upon triage, identify the task scheduled source. Was it schtasks.exe or was it v
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `winevent_scheduled_task_created_within_public_path_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **winevent_scheduled_task_created_within_public_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -92,9 +142,6 @@ False positives are possible if legitimate applications are allowed to register
* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -104,8 +151,6 @@ False positives are possible if legitimate applications are allowed to register
| 70.0 | 70 | 100 | A windows scheduled task was created (task name=$Task_Name$) on $dest$ by the following command: $Command$ |
-
-
#### Reference
* [https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/](https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/)
@@ -117,7 +162,7 @@ False positives are possible if legitimate applications are allowed to register
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-04-12-excel_spawning_powershell.md b/docs/_posts/2021-04-12-excel_spawning_powershell.md
index 70f609465f..6eac61e2c2 100644
--- a/docs/_posts/2021-04-12-excel_spawning_powershell.md
+++ b/docs/_posts/2021-04-12-excel_spawning_powershell.md
@@ -27,16 +27,21 @@ tags:
The following detection identifies Microsoft Excel spawning PowerShell. Typically, this is not common behavior and not default with Excel.exe. Excel.exe will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16` (version will vary). PowerShell spawning from Excel.exe is common for a spearphishing attachment and is actively used. Albeit, the command executed will most likely be encoded and captured via another detection. During triage, review parallel processes and identify any files that may have been written.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-04-12
- **Author**: Michael Haag, Splunk
- **ID**: 42d40a22-9be3-11eb-8f08-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ The following detection identifies Microsoft Excel spawning PowerShell. Typicall
| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,11 +107,11 @@ The following detection identifies Microsoft Excel spawning PowerShell. Typicall
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `excel_spawning_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **excel_spawning_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* Processes.dest
@@ -87,9 +137,6 @@ False positives should be limited, but if any are present, filter as needed.
* [Spearphishing Attachments](/stories/spearphishing_attachments)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -99,8 +146,6 @@ False positives should be limited, but if any are present, filter as needed.
| 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$, indicating potential suspicious macro execution. |
-
-
#### Reference
* [https://redcanary.com/threat-detection-report/techniques/powershell/](https://redcanary.com/threat-detection-report/techniques/powershell/)
@@ -109,7 +154,7 @@ False positives should be limited, but if any are present, filter as needed.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-04-12-excel_spawning_windows_script_host.md b/docs/_posts/2021-04-12-excel_spawning_windows_script_host.md
index e4c73d9f42..7ad41cf22b 100644
--- a/docs/_posts/2021-04-12-excel_spawning_windows_script_host.md
+++ b/docs/_posts/2021-04-12-excel_spawning_windows_script_host.md
@@ -27,16 +27,21 @@ tags:
The following detection identifies Microsoft Excel spawning Windows Script Host - `cscript.exe` or `wscript.exe`. Typically, this is not common behavior and not default with Excel.exe. Excel.exe will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16` (version will vary). `cscript.exe` or `wscript.exe` default location is `c:\windows\system32\` or c:windows\syswow64`. `cscript.exe` or `wscript.exe` spawning from Excel.exe is common for a spearphishing attachment and is actively used. Albeit, the command-line executed will most likely be obfuscated and captured via another detection. During triage, review parallel processes and identify any files that may have been written. Review the reputation of the remote destination and block accordingly.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-04-12
- **Author**: Michael Haag, Splunk
- **ID**: 57fe880a-9be3-11eb-9bf3-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ The following detection identifies Microsoft Excel spawning Windows Script Host
| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +107,10 @@ The following detection identifies Microsoft Excel spawning Windows Script Host
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `excel_spawning_windows_script_host_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **excel_spawning_windows_script_host_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -82,9 +132,6 @@ False positives should be limited, but if any are present, filter as needed. In
* [Spearphishing Attachments](/stories/spearphishing_attachments)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -94,8 +141,6 @@ False positives should be limited, but if any are present, filter as needed. In
| 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$, indicating potential suspicious macro execution. |
-
-
#### Reference
* [https://app.any.run/tasks/8ecfbc29-03d0-421c-a5bf-3905d29192a2/](https://app.any.run/tasks/8ecfbc29-03d0-421c-a5bf-3905d29192a2/)
@@ -104,7 +149,7 @@ False positives should be limited, but if any are present, filter as needed. In
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md b/docs/_posts/2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md
index 067c99144f..2e40959111 100644
--- a/docs/_posts/2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md
+++ b/docs/_posts/2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md
@@ -34,16 +34,21 @@ schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64
The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. If found loaded by another process, it is possible a scheduled task is being registered within that process context in memory.\
Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-04-12
- **Author**: Michael Haag, Splunk
- **ID**: 203ef0ea-9bd8-11eb-8201-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -51,6 +56,51 @@ Upon triage, identify the task scheduled source. Was it schtasks.exe or via Task
| [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -65,10 +115,10 @@ Upon triage, identify the task scheduled source. Was it schtasks.exe or via Task
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `winevent_scheduled_task_created_to_spawn_shell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **winevent_scheduled_task_created_to_spawn_shell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -90,9 +140,6 @@ False positives are possible if legitimate applications are allowed to register
* [Ryuk Ransomware](/stories/ryuk_ransomware)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -102,8 +149,6 @@ False positives are possible if legitimate applications are allowed to register
| 70.0 | 70 | 100 | A windows scheduled task was created (task name=$Task_Name$) on $dest$ by the following command: $Command$ |
-
-
#### Reference
* [https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/](https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/)
@@ -114,7 +159,7 @@ False positives are possible if legitimate applications are allowed to register
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-04-12-winword_spawning_powershell.md b/docs/_posts/2021-04-12-winword_spawning_powershell.md
index 1d94508cf5..8854125ea7 100644
--- a/docs/_posts/2021-04-12-winword_spawning_powershell.md
+++ b/docs/_posts/2021-04-12-winword_spawning_powershell.md
@@ -27,16 +27,21 @@ tags:
The following detection identifies Microsoft Word spawning PowerShell. Typically, this is not common behavior and not default with winword.exe. Winword.exe will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16` (version will vary). PowerShell spawning from winword.exe is common for a spearphishing attachment and is actively used. Albeit, the command executed will most likely be encoded and captured via another detection. During triage, review parallel processes and identify any files that may have been written.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-04-12
- **Author**: Michael Haag, Splunk
- **ID**: b2c950b8-9be2-11eb-8658-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ The following detection identifies Microsoft Word spawning PowerShell. Typically
| [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,11 +107,11 @@ The following detection identifies Microsoft Word spawning PowerShell. Typically
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `winword_spawning_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **winword_spawning_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -88,9 +138,6 @@ False positives should be limited, but if any are present, filter as needed.
* [Spearphishing Attachments](/stories/spearphishing_attachments)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -100,8 +147,6 @@ False positives should be limited, but if any are present, filter as needed.
| 70.0 | 70 | 100 | $parent_process_name$ on $dest$ by $user$ launched the following powershell process: $process_name$ which is very common in spearphishing attacks |
-
-
#### Reference
* [https://redcanary.com/threat-detection-report/techniques/powershell/](https://redcanary.com/threat-detection-report/techniques/powershell/)
@@ -112,7 +157,7 @@ False positives should be limited, but if any are present, filter as needed.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md b/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md
index ac857ccb47..f1f4f8875e 100644
--- a/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md
+++ b/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md
@@ -27,16 +27,21 @@ tags:
The following detection identifies Microsoft Winword.exe spawning Windows Script Host - `cscript.exe` or `wscript.exe`. Typically, this is not common behavior and not default with Winword.exe. Winword.exe will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16` (version will vary). `cscript.exe` or `wscript.exe` default location is `c:\windows\system32\` or c:windows\syswow64\`. `cscript.exe` or `wscript.exe` spawning from Winword.exe is common for a spearphishing attachment and is actively used. Albeit, the command-line executed will most likely be obfuscated and captured via another detection. During triage, review parallel processes and identify any files that may have been written. Review the reputation of the remote destination and block accordingly.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-04-12
- **Author**: Michael Haag, Splunk
- **ID**: 637e1b5c-9be1-11eb-9c32-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ The following detection identifies Microsoft Winword.exe spawning Windows Script
| [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +107,10 @@ The following detection identifies Microsoft Winword.exe spawning Windows Script
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `winword_spawning_windows_script_host_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **winword_spawning_windows_script_host_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -82,9 +132,6 @@ There will be limited false positives and it will be different for every environ
* [Spearphishing Attachment](/stories/spearphishing_attachment)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -94,8 +141,6 @@ There will be limited false positives and it will be different for every environ
| 70.0 | 70 | 100 | User $user$ on $dest$ spawned Windows Script Host from Winword.exe |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1566/001/](https://attack.mitre.org/techniques/T1566/001/)
@@ -103,7 +148,7 @@ There will be limited false positives and it will be different for every environ
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-04-13-aws_excessive_security_scanning.md b/docs/_posts/2021-04-13-aws_excessive_security_scanning.md
index da247bc3e4..f2c20b14e6 100644
--- a/docs/_posts/2021-04-13-aws_excessive_security_scanning.md
+++ b/docs/_posts/2021-04-13-aws_excessive_security_scanning.md
@@ -23,21 +23,77 @@ tags:
This search looks for AWS CloudTrail events and analyse the amount of eventNames which starts with Describe by a single user. This indicates that this user scans the configuration of your AWS cloud environment.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-04-13
- **Author**: Patrick Bareiss, Splunk
- **ID**: 1fdd164a-def8-4762-83a9-9ffe24e74d5a
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1526](https://attack.mitre.org/techniques/T1526/) | Cloud Service Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.DS
+* PR.AC
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 13
+
+
+
+
+
+
+
#### Search
```
@@ -51,10 +107,10 @@ This search looks for AWS CloudTrail events and analyse the amount of eventNames
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `aws_excessive_security_scanning_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **aws_excessive_security_scanning_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -75,9 +131,6 @@ While this search has no known false positives.
* [AWS User Monitoring](/stories/aws_user_monitoring)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -87,8 +140,6 @@ While this search has no known false positives.
| 18.0 | 30 | 60 | user $user$ has excessive number of api calls $dc_events$ from these IP addresses $src$, violating the threshold of 50, using the following commands $command$. |
-
-
#### Reference
* [https://github.com/aquasecurity/cloudsploit](https://github.com/aquasecurity/cloudsploit)
@@ -96,7 +147,7 @@ While this search has no known false positives.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_host_using_ntlm.md b/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_host_using_ntlm.md
index 71ad03136e..8637512555 100644
--- a/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_host_using_ntlm.md
+++ b/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_host_using_ntlm.md
@@ -29,16 +29,21 @@ The detection calculates the standard deviation for each host and leverages the
This detection will only trigger on domain controllers, not on member servers or workstations.\
The analytics returned fields allow analysts to investigate the event further by providing fields like source workstation name and attempted user accounts.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-04-13
- **Author**: Mauricio Velazco, Splunk
- **ID**: 7ed272a4-9c77-11eb-af22-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,51 @@ The analytics returned fields allow analysts to investigate the event further by
| [T1110](https://attack.mitre.org/techniques/T1110/) | Brute Force | Credential Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -63,7 +113,7 @@ The analytics returned fields allow analysts to investigate the event further by
The SPL above uses the following Macros:
* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
-Note that `multiple_users_failing_to_authenticate_from_host_using_ntlm_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **multiple_users_failing_to_authenticate_from_host_using_ntlm_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -83,9 +133,6 @@ A host failing to authenticate with multiple valid domain users is not a common
* [Active Directory Password Spraying](/stories/active_directory_password_spraying)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -95,8 +142,6 @@ A host failing to authenticate with multiple valid domain users is not a common
| 49.0 | 70 | 70 | Potential NTLM based password spraying attack from $Source_Workstation$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1110/003/](https://attack.mitre.org/techniques/T1110/003/)
@@ -106,7 +151,7 @@ A host failing to authenticate with multiple valid domain users is not a common
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_process.md b/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_process.md
index a86733a4da..6999e763dd 100644
--- a/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_process.md
+++ b/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_process.md
@@ -29,16 +29,21 @@ The detection calculates the standard deviation for each host and leverages the
This detection will trigger on the potenfially malicious host, perhaps controlled via a trojan or operated by an insider threat, from where a password spraying attack is being executed. This could be a domain controller as well as a member server or workstation.\
The analytics returned fields allow analysts to investigate the event further by providing fields like source process name, source account and attempted user accounts.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-04-13
- **Author**: Mauricio Velazco, Splunk
- **ID**: 9015385a-9c84-11eb-bef2-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,51 @@ The analytics returned fields allow analysts to investigate the event further by
| [T1110](https://attack.mitre.org/techniques/T1110/) | Brute Force | Credential Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -65,7 +115,7 @@ The analytics returned fields allow analysts to investigate the event further by
The SPL above uses the following Macros:
* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
-Note that `multiple_users_failing_to_authenticate_from_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **multiple_users_failing_to_authenticate_from_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -87,9 +137,6 @@ A process failing to authenticate with multiple users is not a common behavior f
* [Active Directory Password Spraying](/stories/active_directory_password_spraying)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -99,8 +146,6 @@ A process failing to authenticate with multiple users is not a common behavior f
| 49.0 | 70 | 70 | Potential password spraying attack from $ComputerName$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1110/003/](https://attack.mitre.org/techniques/T1110/003/)
@@ -111,7 +156,7 @@ A process failing to authenticate with multiple users is not a common behavior f
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-04-13-multiple_users_remotely_failing_to_authenticate_from_host.md b/docs/_posts/2021-04-13-multiple_users_remotely_failing_to_authenticate_from_host.md
index 06c9952116..fbe1690b51 100644
--- a/docs/_posts/2021-04-13-multiple_users_remotely_failing_to_authenticate_from_host.md
+++ b/docs/_posts/2021-04-13-multiple_users_remotely_failing_to_authenticate_from_host.md
@@ -29,16 +29,21 @@ The detection calculates the standard deviation for each host and leverages the
This detection will trigger on the host that is the target of the password spraying attack. This could be a domain controller as well as a member server or workstation.\
The analytics returned fields allow analysts to investigate the event further by providing fields like source process name, source account and attempted user accounts.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-04-13
- **Author**: Mauricio Velazco, Splunk
- **ID**: 80f9d53e-9ca1-11eb-b0d6-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,51 @@ The analytics returned fields allow analysts to investigate the event further by
| [T1110](https://attack.mitre.org/techniques/T1110/) | Brute Force | Credential Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -64,7 +114,7 @@ The analytics returned fields allow analysts to investigate the event further by
The SPL above uses the following Macros:
* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
-Note that `multiple_users_remotely_failing_to_authenticate_from_host_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **multiple_users_remotely_failing_to_authenticate_from_host_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -86,9 +136,6 @@ A host failing to authenticate with multiple valid users against a remote host i
* [Active Directory Password Spraying](/stories/active_directory_password_spraying)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -98,8 +145,6 @@ A host failing to authenticate with multiple valid users against a remote host i
| 49.0 | 70 | 70 | Potential password spraying attack on $ComputerName$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1110/003/](https://attack.mitre.org/techniques/T1110/003/)
@@ -110,7 +155,7 @@ A host failing to authenticate with multiple valid users against a remote host i
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md b/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md
index 8fb90c5f0d..9fe96c948b 100644
--- a/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md
+++ b/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md
@@ -27,16 +27,21 @@ tags:
this detection was designed to identifies suspicious spawned process of known MS office application due to macro or malicious code. this technique can be seen in so many malware like trickbot that used MS office as its weapon or attack vector to initially infect the machines.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-04-13
- **Author**: Teoderick Contreras, Splunk
- **ID**: 958751e4-9c5f-11eb-b103-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ this detection was designed to identifies suspicious spawned process of known MS
| [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,11 +107,11 @@ this detection was designed to identifies suspicious spawned process of known MS
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `office_application_spawn_rundll32_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **office_application_spawn_rundll32_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* Processes.dest
@@ -89,9 +139,6 @@ unknown
* [IcedID](/stories/icedid)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -101,8 +148,6 @@ unknown
| 63.0 | 70 | 90 | Office application spawning rundll32.exe on $dest$ |
-
-
#### Reference
* [https://any.run/malware-trends/trickbot](https://any.run/malware-trends/trickbot)
@@ -111,7 +156,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-04-13-windows_users_authenticate_using_explicit_credentials.md b/docs/_posts/2021-04-13-windows_users_authenticate_using_explicit_credentials.md
index 9de72f5c47..52c3907f07 100644
--- a/docs/_posts/2021-04-13-windows_users_authenticate_using_explicit_credentials.md
+++ b/docs/_posts/2021-04-13-windows_users_authenticate_using_explicit_credentials.md
@@ -29,16 +29,21 @@ The detection calculates the standard deviation for each host and leverages the
This detection will trigger on the potenfially malicious host, perhaps controlled via a trojan or operated by an insider threat, from where a password spraying attack is being executed.\
The analytics returned fields allow analysts to investigate the event further by providing fields like source account, attempted user accounts and the endpoint were the behavior was identified.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-04-13
- **Author**: Mauricio Velazco, Splunk
- **ID**: e61918fa-9ca4-11eb-836c-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,51 @@ The analytics returned fields allow analysts to investigate the event further by
| [T1110](https://attack.mitre.org/techniques/T1110/) | Brute Force | Credential Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -66,7 +116,7 @@ The analytics returned fields allow analysts to investigate the event further by
The SPL above uses the following Macros:
* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
-Note that `windows_users_authenticate_using_explicit_credentials_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **windows_users_authenticate_using_explicit_credentials_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -86,9 +136,6 @@ A source user failing attempting to authenticate multiple users on a host is not
* [Active Directory Password Spraying](/stories/active_directory_password_spraying)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -98,8 +145,6 @@ A source user failing attempting to authenticate multiple users on a host is not
| 49.0 | 70 | 70 | Potential password spraying attack from $ComputerName$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1110/003/](https://attack.mitre.org/techniques/T1110/003/)
@@ -109,7 +154,7 @@ A source user failing attempting to authenticate multiple users on a host is not
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-04-14-office_document_creating_schedule_task.md b/docs/_posts/2021-04-14-office_document_creating_schedule_task.md
index a32de9c91b..e1df7ecf2f 100644
--- a/docs/_posts/2021-04-14-office_document_creating_schedule_task.md
+++ b/docs/_posts/2021-04-14-office_document_creating_schedule_task.md
@@ -27,16 +27,21 @@ tags:
this search detects a potential malicious office document that create schedule task entry through macro VBA api or through loading taskschd.dll. This technique was seen in so many malicious macro malware that create persistence , beaconing using task schedule malware entry The search will return the first time and last time the task was registered, as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether it is `Hidden` or not. schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`. The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. If found loaded by another process, it's possible a scheduled task is being registered within that process context in memory. Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.'
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-04-14
- **Author**: Teoderick Contreras, Splunk
- **ID**: cc8b7b74-9d0f-11eb-8342-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ this search detects a potential malicious office document that create schedule t
| [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -56,10 +106,10 @@ this search detects a potential malicious office document that create schedule t
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `office_document_creating_schedule_task_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **office_document_creating_schedule_task_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* ImageLoaded
@@ -83,9 +133,6 @@ unknown
* [Spearphishing Attachments](/stories/spearphishing_attachments)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -95,8 +142,6 @@ unknown
| 49.0 | 70 | 70 | Office document creating a schedule task on $dest$ |
-
-
#### Reference
* [https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/](https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/)
@@ -105,7 +150,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-04-14-office_document_executing_macro_code.md b/docs/_posts/2021-04-14-office_document_executing_macro_code.md
index 3075c5889f..712dd21be0 100644
--- a/docs/_posts/2021-04-14-office_document_executing_macro_code.md
+++ b/docs/_posts/2021-04-14-office_document_executing_macro_code.md
@@ -27,16 +27,21 @@ tags:
this detection was designed to identifies suspicious office documents that using macro code. Macro code is known to be one of the prevalent weaponization or attack vector of threat actor. This malicious macro code is embed to a office document as an attachment that may execute malicious payload, download malware payload or other malware component. It is really good practice to disable macro by default to avoid automatically execute macro code while opening or closing a office document files.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-04-14
- **Author**: Teoderick Contreras, Splunk
- **ID**: b12c89bc-9d06-11eb-a592-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ this detection was designed to identifies suspicious office documents that using
| [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -56,10 +106,10 @@ this detection was designed to identifies suspicious office documents that using
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `office_document_executing_macro_code_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **office_document_executing_macro_code_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* ImageLoaded
@@ -85,9 +135,6 @@ Normal Office Document macro use for automation
* [IcedID](/stories/icedid)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -97,8 +144,6 @@ Normal Office Document macro use for automation
| 35.0 | 70 | 50 | Office document executing a macro on $dest$ |
-
-
#### Reference
* [https://www.joesandbox.com/analysis/386500/0/html](https://www.joesandbox.com/analysis/386500/0/html)
@@ -106,7 +151,7 @@ Normal Office Document macro use for automation
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-04-14-windows_disabled_users_failing_to_authenticate_kerberos.md b/docs/_posts/2021-04-14-windows_disabled_users_failing_to_authenticate_kerberos.md
index 2782c9fcfd..753a1faabf 100644
--- a/docs/_posts/2021-04-14-windows_disabled_users_failing_to_authenticate_kerberos.md
+++ b/docs/_posts/2021-04-14-windows_disabled_users_failing_to_authenticate_kerberos.md
@@ -29,16 +29,21 @@ The detection calculates the standard deviation for each host and leverages the
This detection will only trigger on domain controllers, not on member servers or workstations.\
The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-04-14
- **Author**: Mauricio Velazco, Splunk
- **ID**: 98f22d82-9d62-11eb-9fcf-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,51 @@ The analytics returned fields allow analysts to investigate the event further by
| [T1110](https://attack.mitre.org/techniques/T1110/) | Brute Force | Credential Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -63,7 +113,7 @@ The analytics returned fields allow analysts to investigate the event further by
The SPL above uses the following Macros:
* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
-Note that `windows_disabled_users_failing_to_authenticate_kerberos_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **windows_disabled_users_failing_to_authenticate_kerberos_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +134,6 @@ A host failing to authenticate with multiple disabled domain users is not a comm
* [Active Directory Kerberos Attacks](/stories/active_directory_kerberos_attacks)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -96,8 +143,6 @@ A host failing to authenticate with multiple disabled domain users is not a comm
| 49.0 | 70 | 70 | Potential Kerberos based password spraying attack from $Client_Address$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1110/003/](https://attack.mitre.org/techniques/T1110/003/)
@@ -105,7 +150,7 @@ A host failing to authenticate with multiple disabled domain users is not a comm
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-04-14-windows_invalid_users_failed_authentication_via_kerberos.md b/docs/_posts/2021-04-14-windows_invalid_users_failed_authentication_via_kerberos.md
index 4518283d10..07181f8a47 100644
--- a/docs/_posts/2021-04-14-windows_invalid_users_failed_authentication_via_kerberos.md
+++ b/docs/_posts/2021-04-14-windows_invalid_users_failed_authentication_via_kerberos.md
@@ -29,16 +29,21 @@ The detection calculates the standard deviation for each host and leverages the
This detection will only trigger on domain controllers, not on member servers or workstations.\
The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-04-14
- **Author**: Mauricio Velazco, Splunk
- **ID**: 001266a6-9d5b-11eb-829b-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,51 @@ The analytics returned fields allow analysts to investigate the event further by
| [T1110](https://attack.mitre.org/techniques/T1110/) | Brute Force | Credential Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -63,7 +113,7 @@ The analytics returned fields allow analysts to investigate the event further by
The SPL above uses the following Macros:
* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
-Note that `windows_invalid_users_failed_authentication_via_kerberos_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **windows_invalid_users_failed_authentication_via_kerberos_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +134,6 @@ A host failing to authenticate with multiple invalid domain users is not a commo
* [Active Directory Kerberos Attacks](/stories/active_directory_kerberos_attacks)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -96,8 +143,6 @@ A host failing to authenticate with multiple invalid domain users is not a commo
| 49.0 | 70 | 70 | Potential Kerberos based password spraying attack from $Client_Address$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1110/003/](https://attack.mitre.org/techniques/T1110/003/)
@@ -105,7 +150,7 @@ A host failing to authenticate with multiple invalid domain users is not a commo
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-04-15-dns_exfiltration_using_nslookup_app.md b/docs/_posts/2021-04-15-dns_exfiltration_using_nslookup_app.md
index 5d176a10b9..ed23e6ccca 100644
--- a/docs/_posts/2021-04-15-dns_exfiltration_using_nslookup_app.md
+++ b/docs/_posts/2021-04-15-dns_exfiltration_using_nslookup_app.md
@@ -24,21 +24,71 @@ tags:
this search is to detect potential DNS exfiltration using nslookup application. This technique are seen in couple of malware and APT group to exfiltrated collected data in a infected machine or infected network. This detection is looking for unique use of nslookup where it tries to use specific record type, TXT, A, AAAA, that are commonly used by attacker and also the retry parameter which is designed to query C2 DNS multiple tries.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-04-15
- **Author**: Teoderick Contreras, Splunk
- **ID**: 2452e632-9e0d-11eb-bacd-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1048](https://attack.mitre.org/techniques/T1048/) | Exfiltration Over Alternative Protocol | Exfiltration |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +102,10 @@ this search is to detect potential DNS exfiltration using nslookup application.
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `dns_exfiltration_using_nslookup_app_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **dns_exfiltration_using_nslookup_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -85,9 +135,6 @@ admin nslookup usage
* [Command and Control](/stories/command_and_control)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -97,8 +144,6 @@ admin nslookup usage
| 72.0 | 90 | 80 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ performing activity related to DNS exfiltration. |
-
-
#### Reference
* [https://www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html](https://www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html)
@@ -108,7 +153,7 @@ admin nslookup usage
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-04-15-multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.md b/docs/_posts/2021-04-15-multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.md
index bc2054edbd..3254d7e5dc 100644
--- a/docs/_posts/2021-04-15-multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.md
+++ b/docs/_posts/2021-04-15-multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.md
@@ -29,16 +29,21 @@ The detection calculates the standard deviation for each host and leverages the
This detection will only trigger on domain controllers, not on member servers or workstations.\
The analytics returned fields allow analysts to investigate the event further by providing fields like source workstation name and attempted user accounts.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-04-15
- **Author**: Mauricio Velazco, Splunk
- **ID**: 57ad5a64-9df7-11eb-a290-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,51 @@ The analytics returned fields allow analysts to investigate the event further by
| [T1110](https://attack.mitre.org/techniques/T1110/) | Brute Force | Credential Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -63,7 +113,7 @@ The analytics returned fields allow analysts to investigate the event further by
The SPL above uses the following Macros:
* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
-Note that `multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -83,9 +133,6 @@ A host failing to authenticate with multiple invalid domain users is not a commo
* [Active Directory Password Spraying](/stories/active_directory_password_spraying)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -95,8 +142,6 @@ A host failing to authenticate with multiple invalid domain users is not a commo
| 49.0 | 70 | 70 | Potential NTLM based password spraying attack from $Source_Workstation$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1110/003/](https://attack.mitre.org/techniques/T1110/003/)
@@ -106,7 +151,7 @@ A host failing to authenticate with multiple invalid domain users is not a commo
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md b/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md
index 23e89d1c70..81a76ff8c8 100644
--- a/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md
+++ b/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md
@@ -25,21 +25,71 @@ tags:
this search is designed to detect suspicious powershell process that tries to inject code and to known/critical windows process and execute it using CreateRemoteThread. This technique is seen in several malware like trickbot and offensive tooling like cobaltstrike where it load a shellcode to svchost.exe to execute reverse shell to c2 and download another payload
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-04-19
- **Author**: Teoderick Contreras, Splunk
- **ID**: ec102cb2-a0f5-11eb-9b38-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +102,10 @@ this search is designed to detect suspicious powershell process that tries to in
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `powershell_remote_thread_to_known_windows_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **powershell_remote_thread_to_known_windows_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -81,9 +131,6 @@ unknown
* [Trickbot](/stories/trickbot)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -93,8 +140,6 @@ unknown
| 63.0 | 70 | 90 | A suspicious powershell process $process_name$ that tries to create a remote thread on target process $TargetImage$ with eventcode $EventCode$ in host $Computer$ |
-
-
#### Reference
* [https://thedfirreport.com/2021/01/11/trickbot-still-alive-and-well/](https://thedfirreport.com/2021/01/11/trickbot-still-alive-and-well/)
@@ -102,7 +147,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-04-19-schedule_task_with_http_command_arguments.md b/docs/_posts/2021-04-19-schedule_task_with_http_command_arguments.md
index 8bfc223b39..21a66d2af0 100644
--- a/docs/_posts/2021-04-19-schedule_task_with_http_command_arguments.md
+++ b/docs/_posts/2021-04-19-schedule_task_with_http_command_arguments.md
@@ -26,21 +26,71 @@ tags:
The following query utilizes Windows Security EventCode 4698, `A scheduled task was created`, to identify suspicious tasks registered on Windows either via schtasks.exe OR TaskService with an arguments "HTTP" string that are unique entry of malware or attack that uses lolbin to download other file or payload to the infected machine. The search will return the first time and last time the task was registered, as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether it is `Hidden` or not. schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`. The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. If found loaded by another process, it is possible a scheduled task is being registered within that process context in memory. Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.'
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-04-19
- **Author**: Teoderick Contreras, Splunk
- **ID**: 523c2684-a101-11eb-916b-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -55,10 +105,10 @@ The following query utilizes Windows Security EventCode 4698, `A scheduled task
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `schedule_task_with_http_command_arguments_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **schedule_task_with_http_command_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -82,9 +132,6 @@ unknown
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -94,8 +141,6 @@ unknown
| 63.0 | 70 | 90 | A schedule task process commandline arguments $Arguments$ with http string on it in host $dest$ |
-
-
#### Reference
* [https://app.any.run/tasks/92d7ef61-bfd7-4c92-bc15-322172b4ebec/](https://app.any.run/tasks/92d7ef61-bfd7-4c92-bc15-322172b4ebec/)
@@ -103,7 +148,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-04-19-schedule_task_with_rundll32_command_trigger.md b/docs/_posts/2021-04-19-schedule_task_with_rundll32_command_trigger.md
index e9e12703fb..4b63079399 100644
--- a/docs/_posts/2021-04-19-schedule_task_with_rundll32_command_trigger.md
+++ b/docs/_posts/2021-04-19-schedule_task_with_rundll32_command_trigger.md
@@ -26,21 +26,71 @@ tags:
The following query utilizes Windows Security EventCode 4698, `A scheduled task was created`, to identify suspicious tasks registered on Windows either via schtasks.exe OR TaskService with a command to be executed with a Rundll32. This technique is common in new trickbot that uses rundll32 to load is trickbot downloader. The search will return the first time and last time the task was registered, as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether it is `Hidden` or not. schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`. The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. If found loaded by another process, it is possible a scheduled task is being registered within that process context in memory. Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.'
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-04-19
- **Author**: Teoderick Contreras, Splunk
- **ID**: 75b00fd8-a0ff-11eb-8b31-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -55,10 +105,10 @@ The following query utilizes Windows Security EventCode 4698, `A scheduled task
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `schedule_task_with_rundll32_command_trigger_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **schedule_task_with_rundll32_command_trigger_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +134,6 @@ unknown
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -96,8 +143,6 @@ unknown
| 70.0 | 70 | 100 | A schedule task process commandline rundll32 arguments $Arguments$ in host $dest$ |
-
-
#### Reference
* [https://labs.vipre.com/trickbot-and-its-modules/](https://labs.vipre.com/trickbot-and-its-modules/)
@@ -106,7 +151,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-04-19-wermgr_process_connecting_to_ip_check_web_services.md b/docs/_posts/2021-04-19-wermgr_process_connecting_to_ip_check_web_services.md
index f51daca822..41f98dbe17 100644
--- a/docs/_posts/2021-04-19-wermgr_process_connecting_to_ip_check_web_services.md
+++ b/docs/_posts/2021-04-19-wermgr_process_connecting_to_ip_check_web_services.md
@@ -27,16 +27,21 @@ tags:
this search is designed to detect suspicious wermgr.exe process that tries to connect to known IP web services. This technique is know for trickbot and other trojan spy malware to recon the infected machine and look for its ip address without so much finger print on the commandline process. Since wermgr.exe is designed for error handling process of windows it is really suspicious that this process is trying to connect to this IP web services cause that maybe cause of some malicious code injection.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-04-19
- **Author**: Teoderick Contreras, Splunk
- **ID**: ed313326-a0f9-11eb-a89c-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ this search is designed to detect suspicious wermgr.exe process that tries to co
| [T1590.005](https://attack.mitre.org/techniques/T1590/005/) | IP Addresses | Reconnaissance |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -56,10 +106,10 @@ this search is designed to detect suspicious wermgr.exe process that tries to co
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `wermgr_process_connecting_to_ip_check_web_services_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **wermgr_process_connecting_to_ip_check_web_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -83,9 +133,6 @@ unknown
* [Trickbot](/stories/trickbot)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -95,8 +142,6 @@ unknown
| 56.0 | 70 | 80 | Wermgr.exe process connecting IP location web services on $ComputerName$ |
-
-
#### Reference
* [https://labs.vipre.com/trickbot-and-its-modules/](https://labs.vipre.com/trickbot-and-its-modules/)
@@ -105,7 +150,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md b/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md
index 316399c8bc..ba6c575f79 100644
--- a/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md
+++ b/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md
@@ -24,21 +24,71 @@ tags:
this search is designed to detect potential malicious wermgr.exe process that drops or create executable file. Since wermgr.exe is an application trigger when error encountered in a process, it is really un ussual to this process to drop executable file. This technique is commonly seen in trickbot malware where it injects it code to this process to execute it malicious behavior like downloading other payload
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-04-19
- **Author**: Teoderick Contreras, Splunk
- **ID**: ab3bcce0-a105-11eb-973c-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1027](https://attack.mitre.org/techniques/T1027/) | Obfuscated Files or Information | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -51,10 +101,10 @@ this search is designed to detect potential malicious wermgr.exe process that dr
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `wermgr_process_create_executable_file_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **wermgr_process_create_executable_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -76,9 +126,6 @@ unknown
* [Trickbot](/stories/trickbot)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -88,8 +135,6 @@ unknown
| 56.0 | 70 | 80 | Wermgr.exe writing executable files on $dest$ |
-
-
#### Reference
* [https://labs.vipre.com/trickbot-and-its-modules/](https://labs.vipre.com/trickbot-and-its-modules/)
@@ -98,7 +143,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md b/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md
index b5c31e20ef..63185cd9c2 100644
--- a/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md
+++ b/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md
@@ -24,21 +24,71 @@ tags:
This search is designed to detect suspicious cmd and powershell process spawned by wermgr.exe process. This suspicious behavior are commonly seen in code injection technique technique like trickbot to execute a shellcode, dll modules to run malicious behavior.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-04-19
- **Author**: Teoderick Contreras, Splunk
- **ID**: e8fc95bc-a107-11eb-a978-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,12 +102,12 @@ This search is designed to detect suspicious cmd and powershell process spawned
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
-Note that `wermgr_process_spawned_cmd_or_powershell_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **wermgr_process_spawned_cmd_or_powershell_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +134,6 @@ unknown
* [Trickbot](/stories/trickbot)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -96,8 +143,6 @@ unknown
| 56.0 | 70 | 80 | Wermgr.exe spawning suspicious processes on $dest$ |
-
-
#### Reference
* [https://labs.vipre.com/trickbot-and-its-modules/](https://labs.vipre.com/trickbot-and-its-modules/)
@@ -106,7 +151,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-04-21-excessive_usage_of_nslookup_app.md b/docs/_posts/2021-04-21-excessive_usage_of_nslookup_app.md
index d64f895540..1c79405b19 100644
--- a/docs/_posts/2021-04-21-excessive_usage_of_nslookup_app.md
+++ b/docs/_posts/2021-04-21-excessive_usage_of_nslookup_app.md
@@ -24,21 +24,71 @@ tags:
This search is to detect potential DNS exfiltration using nslookup application. This technique are seen in couple of malware and APT group to exfiltrated collected data in a infected machine or infected network. This detection is looking for unique use of nslookup where it tries to use specific record type (TXT, A, AAAA) that are commonly used by attacker and also the retry parameter which is designed to query C2 DNS multiple tries.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-04-21
- **Author**: Teoderick Contreras, Stanislav Miskovic, Splunk
- **ID**: 0a69fdaa-a2b8-11eb-b16d-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1048](https://attack.mitre.org/techniques/T1048/) | Exfiltration Over Alternative Protocol | Exfiltration |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -56,10 +106,10 @@ This search is to detect potential DNS exfiltration using nslookup application.
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `excessive_usage_of_nslookup_app_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **excessive_usage_of_nslookup_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -81,9 +131,6 @@ unknown
* [Command and Control](/stories/command_and_control)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -93,8 +140,6 @@ unknown
| 28.0 | 40 | 70 | Excessive usage of nslookup.exe has been detected on $Computer$. This detection is triggered as as it violates the dynamic threshold |
-
-
#### Reference
* [https://www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html](https://www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html)
@@ -104,7 +149,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md b/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md
index 73aecab177..1da816b5f4 100644
--- a/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md
+++ b/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md
@@ -27,16 +27,21 @@ tags:
This search is designed to detect high frequency of archive files data exfiltration through HTTP POST method protocol. This are one of the common techniques used by APT or trojan spy after doing the data collection like screenshot, recording, sensitive data to the infected machines. The attacker may execute archiving command to the collected data, save it a temp folder with a hidden attribute then send it to its C2 through HTTP POST. Sometimes adversaries will rename the archive files or encode/encrypt to cover their tracks. This detection can detect a renamed archive files transfer to HTTP POST since it checks the request body header. Unfortunately this detection cannot support archive that was encrypted or encoded before doing the exfiltration.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic)
-
- **Last Updated**: 2021-04-21
- **Author**: Teoderick Contreras, Splunk
- **ID**: 4477f3ea-a28f-11eb-b762-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This search is designed to detect high frequency of archive files data exfiltrat
| [T1048](https://attack.mitre.org/techniques/T1048/) | Exfiltration Over Alternative Protocol | Exfiltration |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -62,7 +112,7 @@ The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml)
-Note that `multiple_archive_files_http_post_traffic_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **multiple_archive_files_http_post_traffic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -88,9 +138,6 @@ Normal archive transfer via HTTP protocol may trip this detection.
* [Command and Control](/stories/command_and_control)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -100,8 +147,6 @@ Normal archive transfer via HTTP protocol may trip this detection.
| 25.0 | 50 | 50 | A http post $http_method$ sending packet with possible archive bytes header 4form_data$ in uri path $uri_path$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1560/001/](https://attack.mitre.org/techniques/T1560/001/)
@@ -111,7 +156,7 @@ Normal archive transfer via HTTP protocol may trip this detection.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-04-22-anomalous_usage_of_7zip.md b/docs/_posts/2021-04-22-anomalous_usage_of_7zip.md
index 7985fab248..e9cc22551c 100644
--- a/docs/_posts/2021-04-22-anomalous_usage_of_7zip.md
+++ b/docs/_posts/2021-04-22-anomalous_usage_of_7zip.md
@@ -27,16 +27,21 @@ tags:
The following detection identifies a 7z.exe spawned from `Rundll32.exe` or `Dllhost.exe`. It is assumed that the adversary has brought in `7z.exe` and `7z.dll`. It has been observed where an adversary will rename `7z.exe`. Additional coverage may be required to identify the behavior of renamed instances of `7z.exe`. During triage, identify the source of injection into `Rundll32.exe` or `Dllhost.exe`. Capture any files written to disk and analyze as needed. Review parallel processes for additional behaviors. Typically, archiving files will result in exfiltration.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-04-22
- **Author**: Michael Haag, Teoderick Contreras, Splunk
- **ID**: 9364ee8e-a39a-11eb-8f1d-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ The following detection identifies a 7z.exe spawned from `Rundll32.exe` or `Dllh
| [T1560](https://attack.mitre.org/techniques/T1560/) | Archive Collected Data | Collection |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +107,10 @@ The following detection identifies a 7z.exe spawned from `Rundll32.exe` or `Dllh
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `anomalous_usage_of_7zip_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **anomalous_usage_of_7zip_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -86,9 +136,6 @@ False positives should be limited as this behavior is not normal for `rundll32.e
* [NOBELIUM Group](/stories/nobelium_group)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -98,8 +145,6 @@ False positives should be limited as this behavior is not normal for `rundll32.e
| 64.0 | 80 | 80 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior is indicative of suspicious loading of 7zip. |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1560/001/](https://attack.mitre.org/techniques/T1560/001/)
@@ -109,7 +154,7 @@ False positives should be limited as this behavior is not normal for `rundll32.e
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md b/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md
index 5994e9fc15..0e60a65f2b 100644
--- a/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md
+++ b/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md
@@ -27,16 +27,21 @@ tags:
The following detection identifies the latest behavior utilized by IcedID malware family. This detection identifies any Windows Office Product spawning `rundll32.exe` without a `.dll` file extension. In malicious instances, the command-line of `rundll32.exe` will look like `rundll32 ..\oepddl.igk2,DllRegisterServer`. In addition, Threat Research has released a detection identifying the use of `DllRegisterServer` on the command-line of `rundll32.exe`. In this instance, we narrow our detection down to the Office suite as a parent process. During triage, review all file modifications. Capture and analyze the `DLL` that was dropped to disk. The Office Product will have reached out to a remote destination, capture and block the IPs or domain. Review additional parallel processes for further activity.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-04-22
- **Author**: Michael Haag, Splunk
- **ID**: c661f6be-a38c-11eb-be57-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ The following detection identifies the latest behavior utilized by IcedID malwar
| [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,11 +107,11 @@ The following detection identifies the latest behavior utilized by IcedID malwar
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `office_product_spawning_rundll32_with_no_dll_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **office_product_spawning_rundll32_with_no_dll_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -88,9 +138,6 @@ False positives should be limited, but if any are present, filter as needed.
* [Spearphishing Attachments](/stories/spearphishing_attachments)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -100,8 +147,6 @@ False positives should be limited, but if any are present, filter as needed.
| 63.0 | 70 | 90 | office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ and no dll commandline $process$ in host $dest$ |
-
-
#### Reference
* [https://www.joesandbox.com/analysis/395471/0/html](https://www.joesandbox.com/analysis/395471/0/html)
@@ -111,7 +156,7 @@ False positives should be limited, but if any are present, filter as needed.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md b/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md
index 9129a2ed60..b554f66150 100644
--- a/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md
+++ b/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md
@@ -27,16 +27,21 @@ tags:
This search is to detect potential plain HTTP POST method data exfiltration. This network traffic is commonly used by trickbot, trojanspy, keylogger or APT adversary where arguments or commands are sent in plain text to the remote C2 server using HTTP POST method as part of data exfiltration.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic)
-
- **Last Updated**: 2021-04-22
- **Author**: Teoderick Contreras, Splunk
- **ID**: e2b36208-a364-11eb-8909-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This search is to detect potential plain HTTP POST method data exfiltration. Thi
| [T1048](https://attack.mitre.org/techniques/T1048/) | Exfiltration Over Alternative Protocol | Exfiltration |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -59,7 +109,7 @@ The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml)
-Note that `plain_http_post_exfiltrated_data_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **plain_http_post_exfiltrated_data_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -82,9 +132,6 @@ unknown
* [Command and Control](/stories/command_and_control)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -94,8 +141,6 @@ unknown
| 63.0 | 70 | 90 | A http post $http_method$ sending packet with plain text of information $form_data$ in uri path $uri_path$ |
-
-
#### Reference
* [https://blog.talosintelligence.com/2020/03/trickbot-primer.html](https://blog.talosintelligence.com/2020/03/trickbot-primer.html)
@@ -103,7 +148,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-04-22-winword_spawning_cmd.md b/docs/_posts/2021-04-22-winword_spawning_cmd.md
index 6837fc5bc4..bbb43cd8df 100644
--- a/docs/_posts/2021-04-22-winword_spawning_cmd.md
+++ b/docs/_posts/2021-04-22-winword_spawning_cmd.md
@@ -27,16 +27,21 @@ tags:
The following detection identifies Microsoft Word spawning `cmd.exe`. Typically, this is not common behavior and not default with winword.exe. Winword.exe will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16` (version will vary). Cmd.exe spawning from winword.exe is common for a spearphishing attachment and is actively used. Albeit, the command-line will indicate what is being executed. During triage, review parallel processes and identify any files that may have been written. It is possible that COM is utilized to trampoline the child process to `explorer.exe` or `wmiprvse.exe`.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-04-22
- **Author**: Michael Haag, Splunk
- **ID**: 6fcbaedc-a37b-11eb-956b-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ The following detection identifies Microsoft Word spawning `cmd.exe`. Typically,
| [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -58,10 +108,10 @@ The following detection identifies Microsoft Word spawning `cmd.exe`. Typically,
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
-Note that `winword_spawning_cmd_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **winword_spawning_cmd_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -88,9 +138,6 @@ False positives should be limited, but if any are present, filter as needed.
* [Spearphishing Attachments](/stories/spearphishing_attachments)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -100,8 +147,6 @@ False positives should be limited, but if any are present, filter as needed.
| 70.0 | 70 | 100 | $parent_process_name$ on $dest$ by $user$ launched command: $process_name$ which is very common in spearphishing attacks. |
-
-
#### Reference
* [https://app.any.run/tasks/73af0064-a785-4c0a-ab0d-cde593fe16ef/](https://app.any.run/tasks/73af0064-a785-4c0a-ab0d-cde593fe16ef/)
@@ -109,7 +154,7 @@ False positives should be limited, but if any are present, filter as needed.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md b/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md
index bd04f0c86e..0e0916d061 100644
--- a/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md
+++ b/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md
@@ -27,16 +27,21 @@ tags:
The following detection identifies the latest behavior utilized by different malware families (including TA551, IcedID). This detection identifies any Windows Office Product spawning `bitsadmin.exe`. In malicious instances, the command-line of `bitsadmin.exe` will contain a URL to a remote destination or similar command-line arguments as transfer, Download, priority, Foreground. In addition, Threat Research has released a detections identifying suspicious use of `bitsadmin.exe`. In this instance, we narrow our detection down to the Office suite as a parent process. During triage, review all file modifications. Capture and analyze any artifacts on disk. The Office Product, or `bitsadmin.exe` will have reached out to a remote destination, capture and block the IPs or domain. Review additional parallel processes for further activity.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-04-26
- **Author**: Michael Haag, Splunk
- **ID**: e8c591f4-a6d7-11eb-8cf7-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ The following detection identifies the latest behavior utilized by different mal
| [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,11 +107,11 @@ The following detection identifies the latest behavior utilized by different mal
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_bitsadmin](https://github.com/splunk/security_content/blob/develop/macros/process_bitsadmin.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `office_product_spawning_bitsadmin_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **office_product_spawning_bitsadmin_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -88,9 +138,6 @@ No false positives known. Filter as needed.
* [Spearphishing Attachments](/stories/spearphishing_attachments)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -100,8 +147,6 @@ No false positives known. Filter as needed.
| 63.0 | 70 | 90 | office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ in host $dest$ |
-
-
#### Reference
* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1197/T1197.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1197/T1197.md)
@@ -109,7 +154,7 @@ No false positives known. Filter as needed.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-04-26-office_product_spawning_certutil.md b/docs/_posts/2021-04-26-office_product_spawning_certutil.md
index 4dc1f8206d..fede6fa04a 100644
--- a/docs/_posts/2021-04-26-office_product_spawning_certutil.md
+++ b/docs/_posts/2021-04-26-office_product_spawning_certutil.md
@@ -27,16 +27,21 @@ tags:
The following detection identifies the latest behavior utilized by different malware families (including TA551, IcedID). This detection identifies any Windows Office Product spawning `certutil.exe`. In malicious instances, the command-line of `certutil.exe` will contain a URL to a remote destination. In addition, Threat Research has released a detections identifying suspicious use of `certutil.exe`. In this instance, we narrow our detection down to the Office suite as a parent process. During triage, review all file modifications. Capture and analyze any artifacts on disk. The Office Product, or `certutil.exe` will have reached out to a remote destination, capture and block the IPs or domain. Review additional parallel processes for further activity.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-04-26
- **Author**: Michael Haag, Splunk
- **ID**: 6925fe72-a6d5-11eb-9e17-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ The following detection identifies the latest behavior utilized by different mal
| [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,11 +107,11 @@ The following detection identifies the latest behavior utilized by different mal
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `office_product_spawning_certutil_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **office_product_spawning_certutil_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -88,9 +138,6 @@ No false positives known. Filter as needed.
* [Spearphishing Attachments](/stories/spearphishing_attachments)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -100,8 +147,6 @@ No false positives known. Filter as needed.
| 63.0 | 70 | 90 | office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ in host $dest$ |
-
-
#### Reference
* [https://redcanary.com/threat-detection-report/threats/TA551/](https://redcanary.com/threat-detection-report/threats/TA551/)
@@ -110,7 +155,7 @@ No false positives known. Filter as needed.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-04-26-office_product_spawning_mshta.md b/docs/_posts/2021-04-26-office_product_spawning_mshta.md
index 665a1a09f7..c9ebe37cff 100644
--- a/docs/_posts/2021-04-26-office_product_spawning_mshta.md
+++ b/docs/_posts/2021-04-26-office_product_spawning_mshta.md
@@ -27,16 +27,21 @@ tags:
The following detection identifies the latest behavior utilized by different malware families (including TA551, IcedID). This detection identifies any Windows Office Product spawning `mshta.exe`. In malicious instances, the command-line of `mshta.exe` will contain the `hta` file locally, or a URL to the remote destination. In addition, Threat Research has released a detections identifying suspicious use of `mshta.exe`. In this instance, we narrow our detection down to the Office suite as a parent process. During triage, review all file modifications. Capture and analyze any artifacts on disk. The Office Product, or `mshta.exe` will have reached out to a remote destination, capture and block the IPs or domain. Review additional parallel processes for further activity.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-04-26
- **Author**: Michael Haag, Splunk
- **ID**: 6078fa20-a6d2-11eb-b662-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ The following detection identifies the latest behavior utilized by different mal
| [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,11 +107,11 @@ The following detection identifies the latest behavior utilized by different mal
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `office_product_spawning_mshta_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **office_product_spawning_mshta_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -89,9 +139,6 @@ No false positives known. Filter as needed.
* [IcedID](/stories/icedid)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -101,8 +148,6 @@ No false positives known. Filter as needed.
| 63.0 | 70 | 90 | office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ in host $dest$ |
-
-
#### Reference
* [https://redcanary.com/threat-detection-report/threats/TA551/](https://redcanary.com/threat-detection-report/threats/TA551/)
@@ -110,7 +155,7 @@ No false positives known. Filter as needed.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-04-26-trickbot_named_pipe.md b/docs/_posts/2021-04-26-trickbot_named_pipe.md
index 36bdbfb2c2..0eadc14902 100644
--- a/docs/_posts/2021-04-26-trickbot_named_pipe.md
+++ b/docs/_posts/2021-04-26-trickbot_named_pipe.md
@@ -25,21 +25,71 @@ tags:
this search is to detect potential trickbot infection through the create/connected named pipe to the system. This technique is used by trickbot to communicate to its c2 to post or get command during infection.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-04-26
- **Author**: Teoderick Contreras, Splunk
- **ID**: 1804b0a4-a682-11eb-8f68-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +102,10 @@ this search is to detect potential trickbot infection through the create/connect
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `trickbot_named_pipe_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **trickbot_named_pipe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -78,9 +128,6 @@ unknown
* [Trickbot](/stories/trickbot)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -90,8 +137,6 @@ unknown
| 42.0 | 70 | 60 | Possible Trickbot namedpipe created on $Computer$ by $Image$ |
-
-
#### Reference
* [https://labs.vipre.com/trickbot-and-its-modules/](https://labs.vipre.com/trickbot-and-its-modules/)
@@ -100,7 +145,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-04-29-icacls_deny_command.md b/docs/_posts/2021-04-29-icacls_deny_command.md
index 944d1a7bce..1a44f88cfd 100644
--- a/docs/_posts/2021-04-29-icacls_deny_command.md
+++ b/docs/_posts/2021-04-29-icacls_deny_command.md
@@ -24,21 +24,71 @@ tags:
This analytic identifies a potential adversary that changes the security permission of a specific file or directory. This technique is commonly seen in APT tradecraft or coinminer scripts. This behavior is meant to evade detection and prevent access to their component files.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-04-29
- **Author**: Teoderick Contreras, Splunk
- **ID**: cf8d753e-a8fe-11eb-8f58-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1222](https://attack.mitre.org/techniques/T1222/) | File and Directory Permissions Modification | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +102,10 @@ This analytic identifies a potential adversary that changes the security permiss
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `icacls_deny_command_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **icacls_deny_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -77,9 +127,6 @@ Unknown. It is possible some administrative scripts use ICacls. Filter as needed
* [XMRig](/stories/xmrig)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -89,8 +136,6 @@ Unknown. It is possible some administrative scripts use ICacls. Filter as needed
| 72.0 | 90 | 80 | Process name $process_name$ with deny argument executed by $user$ to change security permission of a specific file or directory on host $dest$ |
-
-
#### Reference
* [https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/](https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/)
@@ -98,7 +143,7 @@ Unknown. It is possible some administrative scripts use ICacls. Filter as needed
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md b/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md
index b01176f5b5..4639b50b53 100644
--- a/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md
+++ b/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md
@@ -29,16 +29,21 @@ tags:
This analytic will detect suspicious driver loaded paths. This technique is commonly used by malicious software like coin miners (xmrig) to register its malicious driver from notable directories where executable or drivers do not commonly exist. During triage, validate this driver is for legitimate business use. Review the metadata and certificate information. Unsigned drivers from non-standard paths is not normal, but occurs. In addition, review driver loads into `ntoskrnl.exe` for possible other drivers of interest. Long tail analyze drivers by path (outside of default, and in default) for further review.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-04-29
- **Author**: Teoderick Contreras, Splunk
- **ID**: f880acd4-a8f1-11eb-a53b-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,51 @@ This analytic will detect suspicious driver loaded paths. This technique is comm
| [T1543](https://attack.mitre.org/techniques/T1543/) | Create or Modify System Process | Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -58,10 +108,10 @@ This analytic will detect suspicious driver loaded paths. This technique is comm
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `suspicious_driver_loaded_path_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **suspicious_driver_loaded_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -83,9 +133,6 @@ Limited false positives will be present. Some applications do load drivers
* [XMRig](/stories/xmrig)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -95,8 +142,6 @@ Limited false positives will be present. Some applications do load drivers
| 63.0 | 70 | 90 | Suspicious driver $ImageLoaded$ on $Computer$ |
-
-
#### Reference
* [https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/](https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/)
@@ -105,7 +150,7 @@ Limited false positives will be present. Some applications do load drivers
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-04-29-xmrig_driver_loaded.md b/docs/_posts/2021-04-29-xmrig_driver_loaded.md
index 256ab3fced..a8ebca20c2 100644
--- a/docs/_posts/2021-04-29-xmrig_driver_loaded.md
+++ b/docs/_posts/2021-04-29-xmrig_driver_loaded.md
@@ -29,16 +29,21 @@ tags:
This analytic identifies XMRIG coinminer driver installation on the system. The XMRIG driver name by default is `WinRing0x64.sys`. This cpu miner is an open source project that is commonly abused by adversaries to infect and mine bitcoin.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-04-29
- **Author**: Teoderick Contreras, Splunk
- **ID**: 90080fa6-a8df-11eb-91e4-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,51 @@ This analytic identifies XMRIG coinminer driver installation on the system. The
| [T1543](https://attack.mitre.org/techniques/T1543/) | Create or Modify System Process | Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -58,10 +108,10 @@ This analytic identifies XMRIG coinminer driver installation on the system. The
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `xmrig_driver_loaded_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **xmrig_driver_loaded_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -83,9 +133,6 @@ False positives should be limited.
* [XMRig](/stories/xmrig)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -95,8 +142,6 @@ False positives should be limited.
| 80.0 | 80 | 100 | A driver $ImageLoaded$ related to xmrig crytominer loaded in host $Computer$ |
-
-
#### Reference
* [https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/](https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/)
@@ -104,7 +149,7 @@ False positives should be limited.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-05-04-deleting_of_net_users.md b/docs/_posts/2021-05-04-deleting_of_net_users.md
index 75ae915a4a..d1e7071bbe 100644
--- a/docs/_posts/2021-05-04-deleting_of_net_users.md
+++ b/docs/_posts/2021-05-04-deleting_of_net_users.md
@@ -24,21 +24,71 @@ tags:
This analytic will detect a suspicious net.exe/net1.exe command-line to delete a user on a system. This technique may be use by an administrator for legitimate purposes, however this behavior has been used in the wild to impair some user or deleting adversaries tracks created during its lateral movement additional systems. During triage, review parallel processes for additional behavior. Identify any other user accounts created before or after.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-05-04
- **Author**: Teoderick Contreras, Splunk
- **ID**: 1c8c6f66-acce-11eb-aafb-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1531](https://attack.mitre.org/techniques/T1531/) | Account Access Removal | Impact |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,11 +102,11 @@ This analytic will detect a suspicious net.exe/net1.exe command-line to delete a
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `deleting_of_net_users_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **deleting_of_net_users_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -83,9 +133,6 @@ System administrators or scripts may delete user accounts via this technique. Fi
* [XMRig](/stories/xmrig)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -95,8 +142,6 @@ System administrators or scripts may delete user accounts via this technique. Fi
| 25.0 | 50 | 50 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to delete accounts. |
-
-
#### Reference
* [https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/](https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/)
@@ -104,7 +149,7 @@ System administrators or scripts may delete user accounts via this technique. Fi
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-05-04-disabling_net_user_account.md b/docs/_posts/2021-05-04-disabling_net_user_account.md
index 7908240cd6..52b011b607 100644
--- a/docs/_posts/2021-05-04-disabling_net_user_account.md
+++ b/docs/_posts/2021-05-04-disabling_net_user_account.md
@@ -24,21 +24,71 @@ tags:
This analytic will identify a suspicious command-line that disables a user account using the `net.exe` utility native to Windows. This technique may used by the adversaries to interrupt availability of such users to do their malicious act.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-05-04
- **Author**: Teoderick Contreras, Splunk
- **ID**: c0325326-acd6-11eb-98c2-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1531](https://attack.mitre.org/techniques/T1531/) | Account Access Removal | Impact |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,11 +102,11 @@ This analytic will identify a suspicious command-line that disables a user accou
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `disabling_net_user_account_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **disabling_net_user_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -83,9 +133,6 @@ unknown
* [XMRig](/stories/xmrig)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -95,8 +142,6 @@ unknown
| 42.0 | 70 | 60 | An instance of $parent_process_name$ spawning $process_name$ was identified disabling a user account on endpoint $dest$ by user $user$. |
-
-
#### Reference
* [https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/](https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/)
@@ -104,7 +149,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-05-04-excessive_attempt_to_disable_services.md b/docs/_posts/2021-05-04-excessive_attempt_to_disable_services.md
index 1bba356f13..5ed2cfa27c 100644
--- a/docs/_posts/2021-05-04-excessive_attempt_to_disable_services.md
+++ b/docs/_posts/2021-05-04-excessive_attempt_to_disable_services.md
@@ -24,21 +24,71 @@ tags:
This analytic will identify suspicious series of command-line to disable several services. This technique is seen where the adversary attempts to disable security app services or other malware services to complete the objective on the compromised system.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-05-04
- **Author**: Teoderick Contreras, Splunk
- **ID**: 8fa2a0f0-acd9-11eb-8994-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1489](https://attack.mitre.org/techniques/T1489/) | Service Stop | Impact |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -53,10 +103,10 @@ This analytic will identify suspicious series of command-line to disable several
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `excessive_attempt_to_disable_services_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **excessive_attempt_to_disable_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -78,9 +128,6 @@ unknown
* [XMRig](/stories/xmrig)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -90,8 +137,6 @@ unknown
| 80.0 | 80 | 100 | An excessive amount of $process_name$ was executed on $dest$ attempting to disable services. |
-
-
#### Reference
* [https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/](https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/)
@@ -99,7 +144,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-05-04-excessive_service_stop_attempt.md b/docs/_posts/2021-05-04-excessive_service_stop_attempt.md
index 644f3e9c7c..38f4430c31 100644
--- a/docs/_posts/2021-05-04-excessive_service_stop_attempt.md
+++ b/docs/_posts/2021-05-04-excessive_service_stop_attempt.md
@@ -24,21 +24,71 @@ tags:
This analytic identifies suspicious series of attempt to kill multiple services on a system using either `net.exe` or `sc.exe`. This technique is use by adversaries to terminate security services or other related services to continue there objective and evade detections.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-05-04
- **Author**: Teoderick Contreras, Splunk
- **ID**: ae8d3f4a-acd7-11eb-8846-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1489](https://attack.mitre.org/techniques/T1489/) | Service Stop | Impact |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -53,11 +103,11 @@ This analytic identifies suspicious series of attempt to kill multiple services
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `excessive_service_stop_attempt_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **excessive_service_stop_attempt_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -85,9 +135,6 @@ unknown
* [Ransomware](/stories/ransomware)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -97,8 +144,6 @@ unknown
| 80.0 | 80 | 100 | An excessive amount of $process_name$ was executed on $dest$ attempting to disable services. |
-
-
#### Reference
* [https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/](https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/)
@@ -106,7 +151,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-05-04-excessive_usage_of_taskkill.md b/docs/_posts/2021-05-04-excessive_usage_of_taskkill.md
index 2206321efd..bff59e613c 100644
--- a/docs/_posts/2021-05-04-excessive_usage_of_taskkill.md
+++ b/docs/_posts/2021-05-04-excessive_usage_of_taskkill.md
@@ -27,16 +27,21 @@ tags:
This analytic identifies excessive usage of `taskkill.exe` application. This application is commonly used by adversaries to evade detections by killing security product processes or even other processes to evade detection.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-05-04
- **Author**: Teoderick Contreras, Splunk
- **ID**: fe5bca48-accb-11eb-a67c-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This analytic identifies excessive usage of `taskkill.exe` application. This app
| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -58,10 +108,10 @@ This analytic identifies excessive usage of `taskkill.exe` application. This app
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `excessive_usage_of_taskkill_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **excessive_usage_of_taskkill_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -83,9 +133,6 @@ Unknown. Filter as needed.
* [XMRig](/stories/xmrig)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -95,8 +142,6 @@ Unknown. Filter as needed.
| 28.0 | 40 | 70 | Excessive usage of taskkill.exe with process id $process_id$ (more than 10 within 1m) has been detected on $dest$ with a parent process of $parent_process_name$. |
-
-
#### Reference
* [https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/](https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/)
@@ -104,7 +149,7 @@ Unknown. Filter as needed.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-05-04-icacls_grant_command.md b/docs/_posts/2021-05-04-icacls_grant_command.md
index f29015212f..79dbc6a308 100644
--- a/docs/_posts/2021-05-04-icacls_grant_command.md
+++ b/docs/_posts/2021-05-04-icacls_grant_command.md
@@ -24,21 +24,71 @@ tags:
This analytic identifies potential adversaries that modify the security permission of a specific file or directory. This technique is commonly seen in APT tradecraft and coinminer scripts to evade detections and restrict access to their component files.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-05-04
- **Author**: Teoderick Contreras, Splunk
- **ID**: b1b1e316-accc-11eb-a9b4-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1222](https://attack.mitre.org/techniques/T1222/) | File and Directory Permissions Modification | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +102,10 @@ This analytic identifies potential adversaries that modify the security permissi
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `icacls_grant_command_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **icacls_grant_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -78,9 +128,6 @@ Unknown. Filter as needed.
* [Ransomware](/stories/ransomware)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -90,8 +137,6 @@ Unknown. Filter as needed.
| 49.0 | 70 | 70 | Process name $process_name$ with grant argument executed by $user$ to change security permission of a specific file or directory on host $dest$ |
-
-
#### Reference
* [https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/](https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/)
@@ -99,7 +144,7 @@ Unknown. Filter as needed.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-05-04-process_kill_base_on_file_path.md b/docs/_posts/2021-05-04-process_kill_base_on_file_path.md
index 231e171b3b..240d794365 100644
--- a/docs/_posts/2021-05-04-process_kill_base_on_file_path.md
+++ b/docs/_posts/2021-05-04-process_kill_base_on_file_path.md
@@ -27,16 +27,21 @@ tags:
The following analytic identifies the use of `wmic.exe` using `delete` to remove a executable path. This is typically ran via a batch file during beginning stages of an adversary setting up for mining on an endpoint.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-05-04
- **Author**: Teoderick Contreras, Splunk
- **ID**: 5ffaa42c-acdb-11eb-9ad3-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ The following analytic identifies the use of `wmic.exe` using `delete` to remove
| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,11 +107,11 @@ The following analytic identifies the use of `wmic.exe` using `delete` to remove
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `process_kill_base_on_file_path_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **process_kill_base_on_file_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -88,9 +138,6 @@ Unknown.
* [XMRig](/stories/xmrig)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -100,8 +147,6 @@ Unknown.
| 56.0 | 70 | 80 | A process $process_name$ attempt to kill process by its file path using commandline $process$ in host $dest$ |
-
-
#### Reference
* [https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/](https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/)
@@ -109,7 +154,7 @@ Unknown.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-05-05-suspicious_process_file_path.md b/docs/_posts/2021-05-05-suspicious_process_file_path.md
index acbf547cad..055a5135e2 100644
--- a/docs/_posts/2021-05-05-suspicious_process_file_path.md
+++ b/docs/_posts/2021-05-05-suspicious_process_file_path.md
@@ -25,21 +25,71 @@ tags:
The following analytic will detect a suspicious process running in a file path where a process is not commonly seen and is most commonly used by malicious software. This behavior has been used by adversaries where they drop and run an exe in a path that is accessible without admin privileges.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-05-05
- **Author**: Teoderick Contreras, Splunk
- **ID**: 9be25988-ad82-11eb-a14f-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1543](https://attack.mitre.org/techniques/T1543/) | Create or Modify System Process | Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -53,10 +103,10 @@ The following analytic will detect a suspicious process running in a file path w
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `suspicious_process_file_path_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **suspicious_process_file_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +134,6 @@ Administrators may allow execution of specific binaries in non-standard paths. F
* [Hermetic Wiper](/stories/hermetic_wiper)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -96,8 +143,6 @@ Administrators may allow execution of specific binaries in non-standard paths. F
| 35.0 | 70 | 50 | Suspicioues process $Processes.process_path.file_path$ running from suspicious location |
-
-
#### Reference
* [https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/](https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/)
@@ -106,7 +151,7 @@ Administrators may allow execution of specific binaries in non-standard paths. F
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-05-06-download_files_using_telegram.md b/docs/_posts/2021-05-06-download_files_using_telegram.md
index 6807d4fa96..552c212ffa 100644
--- a/docs/_posts/2021-05-06-download_files_using_telegram.md
+++ b/docs/_posts/2021-05-06-download_files_using_telegram.md
@@ -24,21 +24,71 @@ tags:
The following analytic will identify a suspicious download by the Telegram application on a Windows system. This behavior was identified on a honeypot where the adversary gained access, installed Telegram and followed through with downloading different network scanners (port, bruteforcer, masscan) to the system and later used to mapped the whole network and further move laterally.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-05-06
- **Author**: Teoderick Contreras, Splunk
- **ID**: 58194e28-ae5e-11eb-8912-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1105](https://attack.mitre.org/techniques/T1105/) | Ingress Tool Transfer | Command And Control |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -51,10 +101,10 @@ The following analytic will identify a suspicious download by the Telegram appli
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `download_files_using_telegram_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **download_files_using_telegram_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -76,9 +126,6 @@ normal download of file in telegram app. (if it was a common app in network)
* [XMRig](/stories/xmrig)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -88,8 +135,6 @@ normal download of file in telegram app. (if it was a common app in network)
| 49.0 | 70 | 70 | Suspicious files were downloaded with the Telegram application on $dest$ by $user$. |
-
-
#### Reference
* [https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/](https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/)
@@ -97,7 +142,7 @@ normal download of file in telegram app. (if it was a common app in network)
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-05-06-enumerate_users_local_group_using_telegram.md b/docs/_posts/2021-05-06-enumerate_users_local_group_using_telegram.md
index bd9ad4564a..31daed681e 100644
--- a/docs/_posts/2021-05-06-enumerate_users_local_group_using_telegram.md
+++ b/docs/_posts/2021-05-06-enumerate_users_local_group_using_telegram.md
@@ -24,21 +24,71 @@ tags:
This analytic will detect a suspicious Telegram process enumerating all network users in a local group. This technique was seen in a Monero infected honeypot to mapped all the users on the compromised system. EventCode 4798 is generated when a process enumerates a user's security-enabled local groups on a computer or device.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-05-06
- **Author**: Teoderick Contreras, Splunk
- **ID**: fcd74532-ae54-11eb-a5ab-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -51,10 +101,10 @@ This analytic will detect a suspicious Telegram process enumerating all network
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `enumerate_users_local_group_using_telegram_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **enumerate_users_local_group_using_telegram_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -79,9 +129,6 @@ unknown
* [XMRig](/stories/xmrig)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -91,8 +138,6 @@ unknown
| 80.0 | 80 | 100 | The Telegram application has been identified enumerating local groups on $ComputerName$ by $user$. |
-
-
#### Reference
* [https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/](https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/)
@@ -101,7 +146,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-05-06-excessive_usage_of_net_app.md b/docs/_posts/2021-05-06-excessive_usage_of_net_app.md
index 193f137ebb..dc1591bc82 100644
--- a/docs/_posts/2021-05-06-excessive_usage_of_net_app.md
+++ b/docs/_posts/2021-05-06-excessive_usage_of_net_app.md
@@ -24,21 +24,71 @@ tags:
This analytic identifies excessive usage of `net.exe` or `net1.exe` within a bucket of time (1 minute). This behavior was seen in a Monero incident where the adversary attempts to create many users, delete and disable users as part of its malicious behavior.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-05-06
- **Author**: Teoderick Contreras, Splunk
- **ID**: 45e52536-ae42-11eb-b5c6-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1531](https://attack.mitre.org/techniques/T1531/) | Account Access Removal | Impact |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -53,11 +103,11 @@ This analytic identifies excessive usage of `net.exe` or `net1.exe` within a buc
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `excessive_usage_of_net_app_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **excessive_usage_of_net_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -85,9 +135,6 @@ unknown. Filter as needed. Modify the time span as needed.
* [Ransomware](/stories/ransomware)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -97,8 +144,6 @@ unknown. Filter as needed. Modify the time span as needed.
| 28.0 | 40 | 70 | Excessive usage of net1.exe or net.exe within 1m, with command line $process$ has been detected on $dest$ by $user$ |
-
-
#### Reference
* [https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/](https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/)
@@ -106,7 +151,7 @@ unknown. Filter as needed. Modify the time span as needed.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-05-06-executables_or_script_creation_in_suspicious_path.md b/docs/_posts/2021-05-06-executables_or_script_creation_in_suspicious_path.md
index 0cfcf41483..f0077b025d 100644
--- a/docs/_posts/2021-05-06-executables_or_script_creation_in_suspicious_path.md
+++ b/docs/_posts/2021-05-06-executables_or_script_creation_in_suspicious_path.md
@@ -24,21 +24,71 @@ tags:
This analytic will identify suspicious executable or scripts (known file extensions) in list of suspicious file path in Windows. This technique is used by adversaries to evade detection. The suspicious file path are known paths used in the wild and are not common to have executable or scripts.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-05-06
- **Author**: Teoderick Contreras, Splunk
- **ID**: a7e3f0f0-ae42-11eb-b245-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1036](https://attack.mitre.org/techniques/T1036/) | Masquerading | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +102,10 @@ This analytic will identify suspicious executable or scripts (known file extensi
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `executables_or_script_creation_in_suspicious_path_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **executables_or_script_creation_in_suspicious_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -81,9 +131,6 @@ Administrators may allow creation of script or exe in the paths specified. Filte
* [Hermetic Wiper](/stories/hermetic_wiper)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -93,8 +140,6 @@ Administrators may allow creation of script or exe in the paths specified. Filte
| 56.0 | 80 | 70 | Suspicious executable or scripts with file name $file_name$, $file_path$ and process_id $process_id$ executed in suspicious file path in Windows by $user$ |
-
-
#### Reference
* [https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/](https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/)
@@ -103,7 +148,7 @@ Administrators may allow creation of script or exe in the paths specified. Filte
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-05-07-excessive_usage_of_cacls_app.md b/docs/_posts/2021-05-07-excessive_usage_of_cacls_app.md
index 41ee4e0891..172b4f0ac3 100644
--- a/docs/_posts/2021-05-07-excessive_usage_of_cacls_app.md
+++ b/docs/_posts/2021-05-07-excessive_usage_of_cacls_app.md
@@ -24,21 +24,71 @@ tags:
The following analytic identifies excessive usage of `cacls.exe`, `xcacls.exe` or `icacls.exe` application to change file or folder permission. This behavior is commonly seen where the adversary attempts to impair some users from deleting or accessing its malware components or artifact from the compromised system.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-05-07
- **Author**: Teoderick Contreras, Splunk
- **ID**: 0bdf6092-af17-11eb-939a-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1222](https://attack.mitre.org/techniques/T1222/) | File and Directory Permissions Modification | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -53,10 +103,10 @@ The following analytic identifies excessive usage of `cacls.exe`, `xcacls.exe` o
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `excessive_usage_of_cacls_app_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **excessive_usage_of_cacls_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -78,9 +128,6 @@ Administrators or administrative scripts may use this application. Filter as nee
* [XMRig](/stories/xmrig)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -90,8 +137,6 @@ Administrators or administrative scripts may use this application. Filter as nee
| 80.0 | 80 | 100 | An excessive amount of $process_name$ was executed on $dest$ attempting to modify permissions. |
-
-
#### Reference
* [https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/](https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/)
@@ -99,7 +144,7 @@ Administrators or administrative scripts may use this application. Filter as nee
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-05-07-schtasks_run_task_on_demand.md b/docs/_posts/2021-05-07-schtasks_run_task_on_demand.md
index d3a6b7ceef..2b6feaaaa9 100644
--- a/docs/_posts/2021-05-07-schtasks_run_task_on_demand.md
+++ b/docs/_posts/2021-05-07-schtasks_run_task_on_demand.md
@@ -26,21 +26,71 @@ tags:
This analytic identifies an on demand run of a Windows Schedule Task through shell or command-line. This technique has been used by adversaries that force to run their created Schedule Task as their persistence mechanism or for lateral movement as part of their malicious attack to the compromised machine.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-05-07
- **Author**: Teoderick Contreras, Splunk
- **ID**: bb37061e-af1f-11eb-a159-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -54,10 +104,10 @@ This analytic identifies an on demand run of a Windows Schedule Task through she
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `schtasks_run_task_on_demand_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **schtasks_run_task_on_demand_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -79,9 +129,6 @@ Administrators may use to debug Schedule Task entries. Filter as needed.
* [XMRig](/stories/xmrig)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -91,8 +138,6 @@ Administrators may use to debug Schedule Task entries. Filter as needed.
| 48.0 | 60 | 80 | A "on demand" execution of schedule task process $process_name$ using commandline $process$ in host $dest$ |
-
-
#### Reference
* [https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/](https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/)
@@ -100,7 +145,7 @@ Administrators may use to debug Schedule Task entries. Filter as needed.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-05-12-delete_shadowcopy_with_powershell.md b/docs/_posts/2021-05-12-delete_shadowcopy_with_powershell.md
index 9fc92a4ff3..cbfc56943f 100644
--- a/docs/_posts/2021-05-12-delete_shadowcopy_with_powershell.md
+++ b/docs/_posts/2021-05-12-delete_shadowcopy_with_powershell.md
@@ -24,21 +24,71 @@ tags:
This following analytic detects PowerShell command to delete shadow copy using the WMIC PowerShell module. This technique was seen used by a recent adversary to deploy DarkSide Ransomware where it executed a child process of PowerShell to execute a hex encoded command to delete shadow copy. This hex encoded command was able to be decrypted by PowerShell log.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-05-12
- **Author**: Teoderick Contreras, Splunk
- **ID**: 5ee2bcd0-b2ff-11eb-bb34-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1490](https://attack.mitre.org/techniques/T1490/) | Inhibit System Recovery | Impact |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -51,10 +101,10 @@ This following analytic detects PowerShell command to delete shadow copy using t
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `delete_shadowcopy_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **delete_shadowcopy_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -76,9 +126,6 @@ unknown
* [Revil Ransomware](/stories/revil_ransomware)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -88,8 +135,6 @@ unknown
| 81.0 | 90 | 90 | An attempt to delete ShadowCopy was performed using PowerShell on $ComputerName$ by $User$. |
-
-
#### Reference
* [https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html](https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html)
@@ -98,7 +143,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md b/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md
index a8e33958d5..5f00a8936a 100644
--- a/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md
+++ b/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md
@@ -27,16 +27,21 @@ tags:
This analytic detects a potential process using COM Object like CMLUA or CMSTPLUA to bypass UAC. This technique has been used by ransomware adversaries to gain administrative privileges to its running process.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-05-13
- **Author**: Teoderick Contreras, Splunk
- **ID**: f87b5062-b405-11eb-a889-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This analytic detects a potential process using COM Object like CMLUA or CMSTPLU
| [T1218.003](https://attack.mitre.org/techniques/T1218/003/) | CMSTP | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -56,10 +106,10 @@ This analytic detects a potential process using COM Object like CMLUA or CMSTPLU
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `cmlua_or_cmstplua_uac_bypass_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **cmlua_or_cmstplua_uac_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -83,9 +133,6 @@ Legitimate windows application that are not on the list loading this dll. Filter
* [Ransomware](/stories/ransomware)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -95,8 +142,6 @@ Legitimate windows application that are not on the list loading this dll. Filter
| 80.0 | 80 | 100 | The following module $ImageLoaded$ was loaded by a non-standard application on endpoint $Computer$ by user $user$. |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1218/003/](https://attack.mitre.org/techniques/T1218/003/)
@@ -104,7 +149,7 @@ Legitimate windows application that are not on the list loading this dll. Filter
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-05-13-slui_runas_elevated.md b/docs/_posts/2021-05-13-slui_runas_elevated.md
index 9faf6ec155..ad740ff550 100644
--- a/docs/_posts/2021-05-13-slui_runas_elevated.md
+++ b/docs/_posts/2021-05-13-slui_runas_elevated.md
@@ -29,16 +29,21 @@ tags:
The following analytic identifies the Microsoft Software Licensing User Interface Tool, `slui.exe`, elevating access using the `-verb runas` function. This particular bypass utilizes a registry key/value. Identified by two sources, the registry keys are `HKCU\Software\Classes\exefile\shell` and `HKCU\Software\Classes\launcher.Systemsettings\Shell\open\command`. To simulate this behavior, multiple POC are available. The analytic identifies the use of `runas` by `slui.exe`.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-05-13
- **Author**: Michael Haag, Splunk
- **ID**: 8d124810-b3e4-11eb-96c7-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,51 @@ The following analytic identifies the Microsoft Software Licensing User Interfac
| [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -59,10 +109,10 @@ The following analytic identifies the Microsoft Software Licensing User Interfac
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `slui_runas_elevated_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **slui_runas_elevated_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -86,9 +136,6 @@ Limited false positives should be present as this is not commonly used by legiti
* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -98,8 +145,6 @@ Limited false positives should be present as this is not commonly used by legiti
| 63.0 | 70 | 90 | A slui process $process_name$ with elevated commandline $process$ in host $dest$ |
-
-
#### Reference
* [https://www.exploit-db.com/exploits/46998](https://www.exploit-db.com/exploits/46998)
@@ -111,7 +156,7 @@ Limited false positives should be present as this is not commonly used by legiti
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-05-13-slui_spawning_a_process.md b/docs/_posts/2021-05-13-slui_spawning_a_process.md
index 701f9cd90c..37ae2ee3f5 100644
--- a/docs/_posts/2021-05-13-slui_spawning_a_process.md
+++ b/docs/_posts/2021-05-13-slui_spawning_a_process.md
@@ -29,16 +29,21 @@ tags:
The following analytic identifies the Microsoft Software Licensing User Interface Tool, `slui.exe`, spawning a child process. This behavior is associated with publicly known UAC bypass. `slui.exe` is commonly associated with software updates and is most often spawned by `svchost.exe`. The `slui.exe` process should not have child processes, and any processes spawning from it will be running with elevated privileges. During triage, review the child process and additional parallel processes. Identify any file modifications that may have lead to the bypass.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-05-13
- **Author**: Michael Haag, Splunk
- **ID**: 879c4330-b3e0-11eb-b1b1-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,51 @@ The following analytic identifies the Microsoft Software Licensing User Interfac
| [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -59,10 +109,10 @@ The following analytic identifies the Microsoft Software Licensing User Interfac
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `slui_spawning_a_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **slui_spawning_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -86,9 +136,6 @@ Certain applications may spawn from `slui.exe` that are legitimate. Filtering wi
* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -98,8 +145,6 @@ Certain applications may spawn from `slui.exe` that are legitimate. Filtering wi
| 63.0 | 70 | 90 | A slui process $parent_process_name$ spawning child process $process_name$ in host $dest$ |
-
-
#### Reference
* [https://www.exploit-db.com/exploits/46998](https://www.exploit-db.com/exploits/46998)
@@ -109,7 +154,7 @@ Certain applications may spawn from `slui.exe` that are legitimate. Filtering wi
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-05-18-services_escalate_exe.md b/docs/_posts/2021-05-18-services_escalate_exe.md
index dc92cf5968..054ab7177a 100644
--- a/docs/_posts/2021-05-18-services_escalate_exe.md
+++ b/docs/_posts/2021-05-18-services_escalate_exe.md
@@ -25,21 +25,71 @@ tags:
The following analytic identifies the use of `svc-exe` with Cobalt Strike. The behavior typically follows after an adversary has already gained initial access and is escalating privileges. Using `svc-exe`, a randomly named binary will be downloaded from the remote Teamserver and placed on disk within `C:\Windows\400619a.exe`. Following, the binary will be added to the registry under key `HKLM\System\CurrentControlSet\Services\400619a\` with multiple keys and values added to look like a legitimate service. Upon loading, `services.exe` will spawn the randomly named binary from `\\127.0.0.1\ADMIN$\400619a.exe`. The process lineage is completed with `400619a.exe` spawning rundll32.exe, which is the default `spawnto_` value for Cobalt Strike. The `spawnto_` value is arbitrary and may be any process on disk (typically system32/syswow64 binary). The `spawnto_` process will also contain a network connection. During triage, review parallel procesess and identify any additional file modifications.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-05-18
- **Author**: Michael Haag, Splunk
- **ID**: c448488c-b7ec-11eb-8253-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -53,10 +103,10 @@ The following analytic identifies the use of `svc-exe` with Cobalt Strike. The b
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `services_escalate_exe_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **services_escalate_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -79,9 +129,6 @@ False positives should be limited as `services.exe` should never spawn a process
* [Cobalt Strike](/stories/cobalt_strike)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -91,8 +138,6 @@ False positives should be limited as `services.exe` should never spawn a process
| 76.0 | 80 | 95 | A service process $parent_process_name$ with process path $process_path$ in host $dest$ |
-
-
#### Reference
* [https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/](https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/)
@@ -102,7 +147,7 @@ False positives should be limited as `services.exe` should never spawn a process
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-05-19-allow_inbound_traffic_in_firewall_rule.md b/docs/_posts/2021-05-19-allow_inbound_traffic_in_firewall_rule.md
index 0d0954fcf5..f7c266b411 100644
--- a/docs/_posts/2021-05-19-allow_inbound_traffic_in_firewall_rule.md
+++ b/docs/_posts/2021-05-19-allow_inbound_traffic_in_firewall_rule.md
@@ -27,16 +27,21 @@ tags:
The following analytic identifies suspicious PowerShell command to allow inbound traffic inbound to a specific local port within the public profile. This technique was seen in some attacker want to have a remote access to a machine by allowing the traffic in firewall rule.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-05-19
- **Author**: Teoderick Contreras, Splunk
- **ID**: a5d85486-b89c-11eb-8267-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ The following analytic identifies suspicious PowerShell command to allow inbound
| [T1021](https://attack.mitre.org/techniques/T1021/) | Remote Services | Lateral Movement |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -56,10 +106,10 @@ The following analytic identifies suspicious PowerShell command to allow inbound
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `allow_inbound_traffic_in_firewall_rule_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **allow_inbound_traffic_in_firewall_rule_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -79,9 +129,6 @@ administrator may allow inbound traffic in certain network or machine.
* [Prohibited Traffic Allowed or Protocol Mismatch](/stories/prohibited_traffic_allowed_or_protocol_mismatch)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -91,8 +138,6 @@ administrator may allow inbound traffic in certain network or machine.
| 3.0 | 10 | 30 | Suspicious firewall modification detected on endpoint $ComputerName$ by user $user$. |
-
-
#### Reference
* [https://docs.microsoft.com/en-us/powershell/module/netsecurity/new-netfirewallrule?view=windowsserver2019-ps](https://docs.microsoft.com/en-us/powershell/module/netsecurity/new-netfirewallrule?view=windowsserver2019-ps)
@@ -100,7 +145,7 @@ administrator may allow inbound traffic in certain network or machine.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-05-19-mailsniper_invoke_functions.md b/docs/_posts/2021-05-19-mailsniper_invoke_functions.md
index 3a3beb672f..901e844500 100644
--- a/docs/_posts/2021-05-19-mailsniper_invoke_functions.md
+++ b/docs/_posts/2021-05-19-mailsniper_invoke_functions.md
@@ -27,16 +27,21 @@ tags:
This search is to detect known mailsniper.ps1 functions executed in a machine. This technique was seen in some attacker to harvest some sensitive e-mail in a compromised exchange server.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-05-19
- **Author**: Teoderick Contreras, Splunk
- **ID**: a36972c8-b894-11eb-9f78-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This search is to detect known mailsniper.ps1 functions executed in a machine. T
| [T1114.001](https://attack.mitre.org/techniques/T1114/001/) | Local Email Collection | Collection |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -56,10 +106,10 @@ This search is to detect known mailsniper.ps1 functions executed in a machine. T
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `mailsniper_invoke_functions_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **mailsniper_invoke_functions_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -79,9 +129,6 @@ unknown
* [Data Exfiltration](/stories/data_exfiltration)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -91,8 +138,6 @@ unknown
| 72.0 | 90 | 80 | mailsniper.ps1 functions $Message$ executed on a $ComputerName$ by user $user$. |
-
-
#### Reference
* [https://www.blackhillsinfosec.com/introducing-mailsniper-a-tool-for-searching-every-users-email-for-sensitive-data/](https://www.blackhillsinfosec.com/introducing-mailsniper-a-tool-for-searching-every-users-email-for-sensitive-data/)
@@ -100,7 +145,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md b/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md
index 7a21a0ae93..18854bca6a 100644
--- a/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md
+++ b/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md
@@ -35,16 +35,21 @@ tags:
This analytic identifies a common behavior by Cobalt Strike and other frameworks where the adversary will escalate privileges, either via `jump` (Cobalt Strike PTH) or `getsystem`, using named-pipe impersonation. A suspicious event will look like `cmd.exe /c echo 4sgryt3436 > \\.\Pipe\5erg53`.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-05-20
- **Author**: Michael Haag, Splunk
- **ID**: eb277ba0-b96b-11eb-b00e-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -56,6 +61,51 @@ This analytic identifies a common behavior by Cobalt Strike and other frameworks
| [T1543](https://attack.mitre.org/techniques/T1543/) | Create or Modify System Process | Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -70,10 +120,10 @@ This analytic identifies a common behavior by Cobalt Strike and other frameworks
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
-Note that `cmd_echo_pipe_-_escalation_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **cmd_echo_pipe_-_escalation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -100,9 +150,6 @@ Unknown. It is possible filtering may be required to ensure fidelity.
* [Cobalt Strike](/stories/cobalt_strike)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -112,8 +159,6 @@ Unknown. It is possible filtering may be required to ensure fidelity.
| 64.0 | 80 | 80 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ potentially performing privilege escalation using named pipes related to Cobalt Strike and other frameworks. |
-
-
#### Reference
* [https://redcanary.com/threat-detection-report/threats/cobalt-strike/](https://redcanary.com/threat-detection-report/threats/cobalt-strike/)
@@ -122,7 +167,7 @@ Unknown. It is possible filtering may be required to ensure fidelity.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-05-21-winrm_spawning_a_process.md b/docs/_posts/2021-05-21-winrm_spawning_a_process.md
index 134fa9d82d..6c50a0ad1c 100644
--- a/docs/_posts/2021-05-21-winrm_spawning_a_process.md
+++ b/docs/_posts/2021-05-21-winrm_spawning_a_process.md
@@ -27,21 +27,76 @@ We have not been able to test, simulate, or build datasets for this object. Use
The following analytic identifies suspicious processes spawning from WinRM (wsmprovhost.exe). This analytic is related to potential exploitation of CVE-2021-31166. which is a kernel-mode device driver http.sys vulnerability. Current proof of concept code will blue-screen the operating system. However, http.sys used by many different Windows processes, including WinRM. In this case, identifying suspicious process create (child processes) from `wsmprovhost.exe` is what this analytic is identifying.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-05-21
- **Author**: Drew Church, Michael Haag, Splunk
- **ID**: a081836a-ba4d-11eb-8593-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1190](https://attack.mitre.org/techniques/T1190/) | Exploit Public-Facing Application | Initial Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -55,10 +110,10 @@ The following analytic identifies suspicious processes spawning from WinRM (wsmp
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `winrm_spawning_a_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **winrm_spawning_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -81,10 +136,6 @@ Unknown. Add new processes or filter as needed. It is possible system management
* [Unusual Processes](/stories/unusual_processes)
-#### Kill Chain Phase
-* Exploitation
-* Actions on Objectives
-
#### RBA
@@ -94,14 +145,6 @@ Unknown. Add new processes or filter as needed. It is possible system management
| 25.0 | 50 | 50 | tbd |
-#### CVE
-
-| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
-| ----------- | ----------- | -------------- |
-| [CVE-2021-31166](https://nvd.nist.gov/vuln/detail/CVE-2021-31166) | HTTP Protocol Stack Remote Code Execution Vulnerability | 7.5 |
-
-
-
#### Reference
* [https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/win_susp_shell_spawn_from_winrm.yml](https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/win_susp_shell_spawn_from_winrm.yml)
@@ -111,7 +154,7 @@ Unknown. Add new processes or filter as needed. It is possible system management
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-05-26-secretdumps_offline_ntds_dumping_tool.md b/docs/_posts/2021-05-26-secretdumps_offline_ntds_dumping_tool.md
index 902c784577..5ede6720a5 100644
--- a/docs/_posts/2021-05-26-secretdumps_offline_ntds_dumping_tool.md
+++ b/docs/_posts/2021-05-26-secretdumps_offline_ntds_dumping_tool.md
@@ -27,16 +27,21 @@ tags:
This analytic detects a potential usage of secretsdump.py tool for dumping credentials (ntlm hash) from a copy of ntds.dit and SAM.Security,SYSTEM registrry hive. This technique was seen in some attacker that dump ntlm hashes offline after having a copy of ntds.dit and SAM/SYSTEM/SECURITY registry hive.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-05-26
- **Author**: Teoderick Contreras, Splunk
- **ID**: 5672819c-be09-11eb-bbfb-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
+| ----------- | ----------- | -------------- |
+| [CVE-2021-31166](https://nvd.nist.gov/vuln/detail/CVE-2021-31166) | HTTP Protocol Stack Remote Code Execution Vulnerability | 7.5 |
+
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This analytic detects a potential usage of secretsdump.py tool for dumping crede
| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +107,10 @@ This analytic detects a potential usage of secretsdump.py tool for dumping crede
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `secretdumps_offline_ntds_dumping_tool_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **secretdumps_offline_ntds_dumping_tool_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +134,6 @@ unknown
* [Credential Dumping](/stories/credential_dumping)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -96,8 +143,6 @@ unknown
| 80.0 | 80 | 100 | A secretdump process $process_name$ with secretdump commandline $process$ to dump credentials in host $dest$ |
-
-
#### Reference
* [https://github.com/SecureAuthCorp/impacket/blob/master/examples/secretsdump.py](https://github.com/SecureAuthCorp/impacket/blob/master/examples/secretsdump.py)
@@ -105,7 +150,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-05-27-detect_sharphound_file_modifications.md b/docs/_posts/2021-05-27-detect_sharphound_file_modifications.md
index bae3dbe879..a65e888144 100644
--- a/docs/_posts/2021-05-27-detect_sharphound_file_modifications.md
+++ b/docs/_posts/2021-05-27-detect_sharphound_file_modifications.md
@@ -42,16 +42,21 @@ tags:
SharpHound is used as a reconnaissance collector, ingestor, for BloodHound. SharpHound will query the domain controller and begin gathering all the data related to the domain and trusts. For output, it will drop a .zip file upon completion following a typical pattern that is often not changed. This analytic focuses on the default file name scheme. Note that this may be evaded with different parameters within SharpHound, but that depends on the operator. `-randomizefilenames` and `-encryptzip` are two examples. In addition, executing SharpHound via .exe or .ps1 without any command-line arguments will still perform activity and dump output to the default filename. Example default filename `20210601181553_BloodHound.zip`. SharpHound creates multiple temp files following the same pattern `20210601182121_computers.json`, `domains.json`, `gpos.json`, `ous.json` and `users.json`. Tuning may be required, or remove these json's entirely if it is too noisy. During traige, review parallel processes for further suspicious behavior. Typically, the process executing the `.ps1` ingestor will be PowerShell.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-05-27
- **Author**: Michael Haag, Splunk
- **ID**: 42b4b438-beed-11eb-ba1d-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -69,6 +74,51 @@ SharpHound is used as a reconnaissance collector, ingestor, for BloodHound. Shar
| [T1069](https://attack.mitre.org/techniques/T1069/) | Permission Groups Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -82,10 +132,10 @@ SharpHound is used as a reconnaissance collector, ingestor, for BloodHound. Shar
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_sharphound_file_modifications_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_sharphound_file_modifications_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -107,9 +157,6 @@ False positives should be limited as the analytic is specific to a filename with
* [Ransomware](/stories/ransomware)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -119,8 +166,6 @@ False positives should be limited as the analytic is specific to a filename with
| 24.0 | 30 | 80 | Potential SharpHound file modifications identified on $dest$ |
-
-
#### Reference
* [https://attack.mitre.org/software/S0521/](https://attack.mitre.org/software/S0521/)
@@ -132,7 +177,7 @@ False positives should be limited as the analytic is specific to a filename with
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-05-27-detect_sharphound_usage.md b/docs/_posts/2021-05-27-detect_sharphound_usage.md
index b858b58629..3f19325d68 100644
--- a/docs/_posts/2021-05-27-detect_sharphound_usage.md
+++ b/docs/_posts/2021-05-27-detect_sharphound_usage.md
@@ -42,16 +42,21 @@ tags:
The following analytic identifies SharpHound binary usage by using the original filena,e. In addition to renaming the PE, other coverage is available to detect command-line arguments. This particular analytic looks for the original_file_name of `SharpHound.exe` and the process name. It is possible older instances of SharpHound.exe have different original filenames. Dependent upon the operator, the code may be re-compiled and the attributes removed or changed to anything else. During triage, review the metadata of the binary in question. Review parallel processes for suspicious behavior. Identify the source of this binary.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-05-27
- **Author**: Michael Haag, Splunk
- **ID**: dd04b29a-beed-11eb-87bc-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -69,6 +74,51 @@ The following analytic identifies SharpHound binary usage by using the original
| [T1069](https://attack.mitre.org/techniques/T1069/) | Permission Groups Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -82,10 +132,10 @@ The following analytic identifies SharpHound binary usage by using the original
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_sharphound_usage_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_sharphound_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -113,9 +163,6 @@ False positives should be limited as this is specific to a file attribute not us
* [Ransomware](/stories/ransomware)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -125,8 +172,6 @@ False positives should be limited as this is specific to a file attribute not us
| 24.0 | 30 | 80 | Potential SharpHound binary identified on $dest$ |
-
-
#### Reference
* [https://attack.mitre.org/software/S0521/](https://attack.mitre.org/software/S0521/)
@@ -138,7 +183,7 @@ False positives should be limited as this is specific to a file attribute not us
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md b/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md
index 9c853627a5..5e255baf5d 100644
--- a/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md
+++ b/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md
@@ -42,16 +42,21 @@ tags:
The following analytic identifies the common command-line argument used by AzureHound `Invoke-AzureHound`. Being the script is FOSS, function names may be modified, but these changes are dependent upon the operator. In most instances the defaults are used. This analytic works to identify the common command-line attributes used. It does not cover the entirety of every argument in order to avoid false positives.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-06-01
- **Author**: Michael Haag, Splunk
- **ID**: 26f02e96-c300-11eb-b611-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -69,6 +74,51 @@ The following analytic identifies the common command-line argument used by Azure
| [T1069](https://attack.mitre.org/techniques/T1069/) | Permission Groups Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -82,10 +132,10 @@ The following analytic identifies the common command-line argument used by Azure
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_azurehound_command-line_arguments_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_azurehound_command-line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -112,9 +162,6 @@ Unknown.
* [Discovery Techniques](/stories/discovery_techniques)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -124,8 +171,6 @@ Unknown.
| 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ using AzureHound to enumerate AzureAD. |
-
-
#### Reference
* [https://attack.mitre.org/software/S0521/](https://attack.mitre.org/software/S0521/)
@@ -136,7 +181,7 @@ Unknown.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-06-01-detect_azurehound_file_modifications.md b/docs/_posts/2021-06-01-detect_azurehound_file_modifications.md
index 7d57da21cb..7037ea35b7 100644
--- a/docs/_posts/2021-06-01-detect_azurehound_file_modifications.md
+++ b/docs/_posts/2021-06-01-detect_azurehound_file_modifications.md
@@ -42,16 +42,21 @@ tags:
The following analytic is similar to SharpHound file modifications, but this instance covers the use of Invoke-AzureHound. AzureHound is the SharpHound equivilent but for Azure. It's possible this may never be seen in an environment as most attackers may execute this tool remotely. Once execution is complete, a zip file with a similar name will drop `20210601090751-azurecollection.zip`. In addition to the zip, multiple .json files will be written to disk, which are in the zip.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-06-01
- **Author**: Michael Haag, Splunk
- **ID**: 1c34549e-c31b-11eb-996b-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -69,6 +74,51 @@ The following analytic is similar to SharpHound file modifications, but this ins
| [T1069](https://attack.mitre.org/techniques/T1069/) | Permission Groups Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -82,10 +132,10 @@ The following analytic is similar to SharpHound file modifications, but this ins
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_azurehound_file_modifications_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_azurehound_file_modifications_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -106,9 +156,6 @@ False positives should be limited as the analytic is specific to a filename with
* [Discovery Techniques](/stories/discovery_techniques)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -118,8 +165,6 @@ False positives should be limited as the analytic is specific to a filename with
| 63.0 | 70 | 90 | A file - $file_name$ was written to disk that is related to AzureHound, a AzureAD enumeration utility, has occurred on endpoint $dest$ by user $user$. |
-
-
#### Reference
* [https://posts.specterops.io/introducing-bloodhound-4-0-the-azure-update-9b2b26c5e350](https://posts.specterops.io/introducing-bloodhound-4-0-the-azure-update-9b2b26c5e350)
@@ -128,7 +173,7 @@ False positives should be limited as the analytic is specific to a filename with
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md b/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md
index cc0653c8df..3c7a631b60 100644
--- a/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md
+++ b/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md
@@ -42,16 +42,21 @@ tags:
The following analytic identifies common command-line arguments used by SharpHound `-collectionMethod` and `invoke-bloodhound`. Being the script is FOSS, function names may be modified, but these changes are dependent upon the operator. In most instances the defaults are used. This analytic works to identify the common command-line attributes used. It does not cover the entirety of every argument in order to avoid false positives.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-06-01
- **Author**: Michael Haag, Splunk
- **ID**: a0bdd2f6-c2ff-11eb-b918-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -69,6 +74,51 @@ The following analytic identifies common command-line arguments used by SharpHou
| [T1069](https://attack.mitre.org/techniques/T1069/) | Permission Groups Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -82,10 +132,10 @@ The following analytic identifies common command-line arguments used by SharpHou
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_sharphound_command-line_arguments_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_sharphound_command-line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -109,9 +159,6 @@ False positives should be limited as the arguments used are specific to SharpHou
* [Ransomware](/stories/ransomware)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -121,8 +168,6 @@ False positives should be limited as the arguments used are specific to SharpHou
| 24.0 | 30 | 80 | Possible SharpHound command-Line arguments identified on $dest$ |
-
-
#### Reference
* [https://attack.mitre.org/software/S0521/](https://attack.mitre.org/software/S0521/)
@@ -134,7 +179,7 @@ False positives should be limited as the arguments used are specific to SharpHou
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-06-02-conti_common_exec_parameter.md b/docs/_posts/2021-06-02-conti_common_exec_parameter.md
index b1a90400fd..d6723b7f04 100644
--- a/docs/_posts/2021-06-02-conti_common_exec_parameter.md
+++ b/docs/_posts/2021-06-02-conti_common_exec_parameter.md
@@ -24,21 +24,71 @@ tags:
This search detects the suspicious commandline argument of revil ransomware to encrypt specific or all local drive and network shares of the compromised machine or host.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-06-02
- **Author**: Teoderick Contreras, Splunk
- **ID**: 624919bc-c382-11eb-adcc-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1204](https://attack.mitre.org/techniques/T1204/) | User Execution | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +102,10 @@ This search detects the suspicious commandline argument of revil ransomware to e
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `conti_common_exec_parameter_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **conti_common_exec_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -82,9 +132,6 @@ To successfully implement this search, you need to be ingesting logs with the pr
* [Ransomware](/stories/ransomware)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -94,8 +141,6 @@ To successfully implement this search, you need to be ingesting logs with the pr
| 64.0 | 80 | 80 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ executing specific Conti Ransomware related parameters. |
-
-
#### Reference
* [https://malpedia.caad.fkie.fraunhofer.de/details/win.conti](https://malpedia.caad.fkie.fraunhofer.de/details/win.conti)
@@ -103,7 +148,7 @@ To successfully implement this search, you need to be ingesting logs with the pr
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-06-02-modification_of_wallpaper.md b/docs/_posts/2021-06-02-modification_of_wallpaper.md
index 9be4bae3a9..df6790b3d3 100644
--- a/docs/_posts/2021-06-02-modification_of_wallpaper.md
+++ b/docs/_posts/2021-06-02-modification_of_wallpaper.md
@@ -24,21 +24,71 @@ tags:
This analytic identifies suspicious modification of registry to deface or change the wallpaper of a compromised machines as part of its payload. This technique was commonly seen in ransomware like REVIL where it create a bitmap file contain a note that the machine was compromised and make it as a wallpaper.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-06-02
- **Author**: Teoderick Contreras, Splunk
- **ID**: accb0712-c381-11eb-8e5b-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1491](https://attack.mitre.org/techniques/T1491/) | Defacement | Impact |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -51,10 +101,10 @@ This analytic identifies suspicious modification of registry to deface or change
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `modification_of_wallpaper_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **modification_of_wallpaper_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -81,9 +131,6 @@ To successfully implement this search, you need to be ingesting logs with the Im
* [Windows Registry Abuse](/stories/windows_registry_abuse)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -93,8 +140,6 @@ To successfully implement this search, you need to be ingesting logs with the Im
| 54.0 | 60 | 90 | Wallpaper modification on $dest$ |
-
-
#### Reference
* [https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/](https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/)
@@ -103,7 +148,7 @@ To successfully implement this search, you need to be ingesting logs with the Im
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-06-02-revil_common_exec_parameter.md b/docs/_posts/2021-06-02-revil_common_exec_parameter.md
index 2f6e23d65a..26fa5f1342 100644
--- a/docs/_posts/2021-06-02-revil_common_exec_parameter.md
+++ b/docs/_posts/2021-06-02-revil_common_exec_parameter.md
@@ -24,21 +24,71 @@ tags:
This analytic identifies suspicious commandline parameter that are commonly used by REVIL ransomware to encrypts the compromise machine.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-06-02
- **Author**: Teoderick Contreras, Splunk
- **ID**: 85facebe-c382-11eb-9c3e-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1204](https://attack.mitre.org/techniques/T1204/) | User Execution | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +102,10 @@ This analytic identifies suspicious commandline parameter that are commonly used
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `revil_common_exec_parameter_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **revil_common_exec_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -80,9 +130,6 @@ third party tool may have same command line parameters as revil ransomware.
* [Revil Ransomware](/stories/revil_ransomware)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -92,8 +139,6 @@ third party tool may have same command line parameters as revil ransomware.
| 54.0 | 60 | 90 | A process $process_name$ with commandline $process$ related to revil ransomware in host $dest$ |
-
-
#### Reference
* [https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/](https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/)
@@ -102,7 +147,7 @@ third party tool may have same command line parameters as revil ransomware.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-06-02-wbemprox_com_object_execution.md b/docs/_posts/2021-06-02-wbemprox_com_object_execution.md
index a4e7741d26..b2016bf0c5 100644
--- a/docs/_posts/2021-06-02-wbemprox_com_object_execution.md
+++ b/docs/_posts/2021-06-02-wbemprox_com_object_execution.md
@@ -27,16 +27,21 @@ tags:
this search is designed to detect potential malicious process loading COM object to wbemprox.dll,
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-06-02
- **Author**: Teoderick Contreras, Splunk
- **ID**: 9d911ce0-c3be-11eb-b177-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ this search is designed to detect potential malicious process loading COM object
| [T1218.003](https://attack.mitre.org/techniques/T1218/003/) | CMSTP | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -56,10 +106,10 @@ this search is designed to detect potential malicious process loading COM object
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `wbemprox_com_object_execution_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **wbemprox_com_object_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -85,9 +135,6 @@ legitimate process that are not in the exception list may trigger this event.
* [Revil Ransomware](/stories/revil_ransomware)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -97,8 +144,6 @@ legitimate process that are not in the exception list may trigger this event.
| 35.0 | 70 | 50 | Suspicious COM Object Execution on $Computer$ |
-
-
#### Reference
* [https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/](https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/)
@@ -107,7 +152,7 @@ legitimate process that are not in the exception list may trigger this event.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md b/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md
index 4c2c14ec8b..8955a7020a 100644
--- a/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md
+++ b/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md
@@ -24,21 +24,71 @@ tags:
This search detects a suspicioous termination of known services killed by ransomware before encrypting files in a compromised machine. This technique is commonly seen in most of ransomware now a days to avoid exception error while accessing the targetted files it wants to encrypts because of the open handle of those services to the targetted file.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-06-04
- **Author**: Teoderick Contreras, Splunk
- **ID**: 3070f8e0-c528-11eb-b2a0-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1490](https://attack.mitre.org/techniques/T1490/) | Inhibit System Recovery | Impact |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -51,10 +101,10 @@ This search detects a suspicioous termination of known services killed by ransom
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `known_services_killed_by_ransomware_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **known_services_killed_by_ransomware_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -75,9 +125,6 @@ Admin activities or installing related updates may do a sudden stop to list of s
* [BlackMatter Ransomware](/stories/blackmatter_ransomware)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -87,8 +134,6 @@ Admin activities or installing related updates may do a sudden stop to list of s
| 72.0 | 90 | 80 | Known services $Message$ terminated by a potential ransomware on $dest$ |
-
-
#### Reference
* [https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/](https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/)
@@ -97,7 +142,7 @@ Admin activities or installing related updates may do a sudden stop to list of s
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-06-07-excessive_number_of_taskhost_processes.md b/docs/_posts/2021-06-07-excessive_number_of_taskhost_processes.md
index 11bb005ab0..170d22adf3 100644
--- a/docs/_posts/2021-06-07-excessive_number_of_taskhost_processes.md
+++ b/docs/_posts/2021-06-07-excessive_number_of_taskhost_processes.md
@@ -24,21 +24,71 @@ tags:
This detection targets behaviors observed in post exploit kits like Meterpreter and Koadic that are run in memory. We have observed that these tools must invoke an excessive number of taskhost.exe and taskhostex.exe processes to complete various actions (discovery, lateral movement, etc.). It is extremely uncommon in the course of normal operations to see so many distinct taskhost and taskhostex processes running concurrently in a short time frame.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Microsoft Windows](https://splunkbase.splunk.com/app/742)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Microsoft Windows](https://splunkbase.splunk.com/app/742)
- **Last Updated**: 2021-06-07
- **Author**: Michael Hart
- **ID**: f443dac2-c7cf-11eb-ab51-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1033](https://attack.mitre.org/techniques/T1033/) | System Owner/User Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +107,10 @@ This detection targets behaviors observed in post exploit kits like Meterpreter
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `excessive_number_of_taskhost_processes_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **excessive_number_of_taskhost_processes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -80,9 +130,6 @@ Administrators, administrative actions or certain applications may run many inst
* [Meterpreter](/stories/meterpreter)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -92,8 +139,6 @@ Administrators, administrative actions or certain applications may run many inst
| 56.0 | 80 | 70 | An excessive amount of $process_name$ was executed on $dest$ indicative of suspicious behavior. |
-
-
#### Reference
* [https://attack.mitre.org/software/S0250/](https://attack.mitre.org/software/S0250/)
@@ -101,7 +146,7 @@ Administrators, administrative actions or certain applications may run many inst
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-06-08-powershell_fileless_process_injection_via_getprocaddress.md b/docs/_posts/2021-06-08-powershell_fileless_process_injection_via_getprocaddress.md
index 78c27162dc..83f9367acd 100644
--- a/docs/_posts/2021-06-08-powershell_fileless_process_injection_via_getprocaddress.md
+++ b/docs/_posts/2021-06-08-powershell_fileless_process_injection_via_getprocaddress.md
@@ -33,16 +33,21 @@ This analytic identifies `GetProcAddress` in the script block. This is not norma
In use, `$var_gpa = $var_unsafe_native_methods.GetMethod(GetProcAddress` and later referenced/executed elsewhere. \
During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-06-08
- **Author**: Michael Haag, Splunk
- **ID**: a26d9db4-c883-11eb-9d75-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -52,6 +57,51 @@ During triage, review parallel processes using an EDR product or 4688 events. It
| [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -64,10 +114,10 @@ During triage, review parallel processes using an EDR product or 4688 events. It
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `powershell_fileless_process_injection_via_getprocaddress_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **powershell_fileless_process_injection_via_getprocaddress_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -88,9 +138,6 @@ Limited false positives. Filter as needed.
* [Malicious PowerShell](/stories/malicious_powershell)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -100,8 +147,6 @@ Limited false positives. Filter as needed.
| 48.0 | 60 | 80 | A suspicious powershell script contains GetProcAddress API in $Message$ with EventCode $EventCode$ in host $ComputerName$ |
-
-
#### Reference
* [https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.](https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.)
@@ -112,7 +157,7 @@ Limited false positives. Filter as needed.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-06-08-powershell_fileless_script_contains_base64_encoded_content.md b/docs/_posts/2021-06-08-powershell_fileless_script_contains_base64_encoded_content.md
index 82609a45fb..20cc430662 100644
--- a/docs/_posts/2021-06-08-powershell_fileless_script_contains_base64_encoded_content.md
+++ b/docs/_posts/2021-06-08-powershell_fileless_script_contains_base64_encoded_content.md
@@ -32,16 +32,21 @@ This analytic identifies `FromBase64String` within the script block. A typical m
Command example - `[Byte[]]$var_code = [System.Convert]::FromBase64String(38uqIyMjQ6rG....` \
During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-06-08
- **Author**: Michael Haag, Splunk
- **ID**: 8acbc04c-c882-11eb-b060-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -51,6 +56,51 @@ During triage, review parallel processes using an EDR product or 4688 events. It
| [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -63,10 +113,10 @@ During triage, review parallel processes using an EDR product or 4688 events. It
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `powershell_fileless_script_contains_base64_encoded_content_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **powershell_fileless_script_contains_base64_encoded_content_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -87,9 +137,6 @@ False positives should be limited. Filter as needed.
* [Malicious PowerShell](/stories/malicious_powershell)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -99,8 +146,6 @@ False positives should be limited. Filter as needed.
| 56.0 | 70 | 80 | A suspicious powershell script contains base64 command in $Message$ with EventCode $EventCode$ in host $ComputerName$ |
-
-
#### Reference
* [https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.](https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.)
@@ -111,7 +156,7 @@ False positives should be limited. Filter as needed.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-06-09-detect_empire_with_powershell_script_block_logging.md b/docs/_posts/2021-06-09-detect_empire_with_powershell_script_block_logging.md
index 6a12a2ee15..5447ecbb75 100644
--- a/docs/_posts/2021-06-09-detect_empire_with_powershell_script_block_logging.md
+++ b/docs/_posts/2021-06-09-detect_empire_with_powershell_script_block_logging.md
@@ -28,16 +28,21 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
This analytic identifies the common PowerShell stager used by PowerShell-Empire. Each stager that may use PowerShell all uses the same pattern. The initial HTTP will be base64 encoded and use `system.net.webclient`. Note that some obfuscation may evade the analytic. \
During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-06-09
- **Author**: Michael Haag, Splunk
- **ID**: bc1dc6b8-c954-11eb-bade-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -45,6 +50,51 @@ During triage, review parallel processes using an EDR product or 4688 events. It
| [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +107,10 @@ During triage, review parallel processes using an EDR product or 4688 events. It
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_empire_with_powershell_script_block_logging_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_empire_with_powershell_script_block_logging_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -81,9 +131,6 @@ False positives may only pertain to it not being related to Empire, but another
* [Malicious PowerShell](/stories/malicious_powershell)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -93,8 +140,6 @@ False positives may only pertain to it not being related to Empire, but another
| 81.0 | 90 | 90 | The following behavior was identified and typically related to PowerShell-Empire on $ComputerName$ by $User$. |
-
-
#### Reference
* [https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.](https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.)
@@ -106,7 +151,7 @@ False positives may only pertain to it not being related to Empire, but another
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-06-09-detect_mimikatz_with_powershell_script_block_logging.md b/docs/_posts/2021-06-09-detect_mimikatz_with_powershell_script_block_logging.md
index 34b103b6b6..81f86ff70d 100644
--- a/docs/_posts/2021-06-09-detect_mimikatz_with_powershell_script_block_logging.md
+++ b/docs/_posts/2021-06-09-detect_mimikatz_with_powershell_script_block_logging.md
@@ -25,21 +25,71 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
This analytic identifies common Mimikatz functions that may be identified in the script block, including `mimikatz`. This will catch the most basic use cases for Pass the Ticket, Pass the Hash and `-DumprCreds`. \
During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-06-09
- **Author**: Michael Haag, Splunk
- **ID**: 8148c29c-c952-11eb-9255-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +102,10 @@ During triage, review parallel processes using an EDR product or 4688 events. It
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_mimikatz_with_powershell_script_block_logging_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_mimikatz_with_powershell_script_block_logging_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -76,9 +126,6 @@ False positives should be limited as the commands being identifies are quite spe
* [Malicious PowerShell](/stories/malicious_powershell)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -88,8 +135,6 @@ False positives should be limited as the commands being identifies are quite spe
| 90.0 | 90 | 100 | The following behavior was identified and typically related to MimiKatz being loaded within the context of PowerShell on $ComputerName$ by $User$. |
-
-
#### Reference
* [https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.](https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.)
@@ -100,7 +145,7 @@ False positives should be limited as the commands being identifies are quite spe
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-06-09-unloading_amsi_via_reflection.md b/docs/_posts/2021-06-09-unloading_amsi_via_reflection.md
index 4c8c69317c..761926455f 100644
--- a/docs/_posts/2021-06-09-unloading_amsi_via_reflection.md
+++ b/docs/_posts/2021-06-09-unloading_amsi_via_reflection.md
@@ -25,21 +25,71 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
This analytic identifies the behavior of AMSI being tampered with. Implemented natively in many frameworks, the command will look similar to `SEtValuE($Null,(New-OBJEct COLlECtionS.GenerIC.HAshSEt{[StrINg]))}$ReF=[ReF].AsSeMbLY.GeTTyPe("System.Management.Automation.Amsi"+"Utils")` taken from Powershell-Empire. \
During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-06-09
- **Author**: Michael Haag, Splunk
- **ID**: a21e3484-c94d-11eb-b55b-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +102,10 @@ During triage, review parallel processes using an EDR product or 4688 events. It
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `unloading_amsi_via_reflection_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **unloading_amsi_via_reflection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -76,9 +126,6 @@ Potential for some third party applications to disable AMSI upon invocation. Fil
* [Malicious PowerShell](/stories/malicious_powershell)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -88,8 +135,6 @@ Potential for some third party applications to disable AMSI upon invocation. Fil
| 49.0 | 70 | 70 | Possible AMSI Unloading via Reflection using PowerShell on $ComputerName$ |
-
-
#### Reference
* [https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.](https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.)
@@ -100,7 +145,7 @@ Potential for some third party applications to disable AMSI upon invocation. Fil
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-06-10-clear_unallocated_sector_using_cipher_app.md b/docs/_posts/2021-06-10-clear_unallocated_sector_using_cipher_app.md
index b79070ac73..f0d527ce43 100644
--- a/docs/_posts/2021-06-10-clear_unallocated_sector_using_cipher_app.md
+++ b/docs/_posts/2021-06-10-clear_unallocated_sector_using_cipher_app.md
@@ -27,16 +27,21 @@ tags:
this search is to detect execution of `cipher.exe` to clear the unallocated sectors of a specific disk. This technique was seen in some ransomware to make it impossible to forensically recover deleted files.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-06-10
- **Author**: Teoderick Contreras, Splunk
- **ID**: cd80a6ac-c9d9-11eb-8839-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ this search is to detect execution of `cipher.exe` to clear the unallocated sect
| [T1070](https://attack.mitre.org/techniques/T1070/) | Indicator Removal on Host | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +107,10 @@ this search is to detect execution of `cipher.exe` to clear the unallocated sect
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `clear_unallocated_sector_using_cipher_app_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **clear_unallocated_sector_using_cipher_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -87,9 +137,6 @@ administrator may execute this app to manage disk
* [Ransomware](/stories/ransomware)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -99,8 +146,6 @@ administrator may execute this app to manage disk
| 90.0 | 100 | 90 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to clear the unallocated sectors of a specific disk. |
-
-
#### Reference
* [https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/3/](https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/3/)
@@ -109,7 +154,7 @@ administrator may execute this app to manage disk
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-06-10-disable_logs_using_wevtutil.md b/docs/_posts/2021-06-10-disable_logs_using_wevtutil.md
index c8f60558e0..6f2b1af284 100644
--- a/docs/_posts/2021-06-10-disable_logs_using_wevtutil.md
+++ b/docs/_posts/2021-06-10-disable_logs_using_wevtutil.md
@@ -27,16 +27,21 @@ tags:
This search is to detect execution of wevtutil.exe to disable logs. This technique was seen in several ransomware to disable the event logs to evade alerts and detections.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-06-10
- **Author**: Teoderick Contreras, Splunk
- **ID**: 236e7c8e-c9d9-11eb-a824-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This search is to detect execution of wevtutil.exe to disable logs. This techniq
| [T1070.001](https://attack.mitre.org/techniques/T1070/001/) | Clear Windows Event Logs | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +107,10 @@ This search is to detect execution of wevtutil.exe to disable logs. This techniq
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `disable_logs_using_wevtutil_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **disable_logs_using_wevtutil_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +134,6 @@ network operator may disable audit event logs for debugging purposes.
* [Ransomware](/stories/ransomware)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -96,8 +143,6 @@ network operator may disable audit event logs for debugging purposes.
| 24.0 | 30 | 80 | WevtUtil.exe used to disable Event Logging on $dest |
-
-
#### Reference
* [https://www.bleepingcomputer.com/news/security/new-ransom-x-ransomware-used-in-texas-txdot-cyberattack/](https://www.bleepingcomputer.com/news/security/new-ransom-x-ransomware-used-in-texas-txdot-cyberattack/)
@@ -105,7 +150,7 @@ network operator may disable audit event logs for debugging purposes.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-06-10-permission_modification_using_takeown_app.md b/docs/_posts/2021-06-10-permission_modification_using_takeown_app.md
index 43f1065166..dbc2ab8cb9 100644
--- a/docs/_posts/2021-06-10-permission_modification_using_takeown_app.md
+++ b/docs/_posts/2021-06-10-permission_modification_using_takeown_app.md
@@ -24,21 +24,71 @@ tags:
This search is to detect a modification of file or directory permission using takeown.exe windows app. This technique was seen in some ransomware that take the ownership of a folder or files to encrypt or delete it.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-06-10
- **Author**: Teoderick Contreras, Splunk
- **ID**: fa7ca5c6-c9d8-11eb-bce9-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1222](https://attack.mitre.org/techniques/T1222/) | File and Directory Permissions Modification | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +102,10 @@ This search is to detect a modification of file or directory permission using ta
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `permission_modification_using_takeown_app_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **permission_modification_using_takeown_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -79,9 +129,6 @@ takeown.exe is a normal windows application that may used by network operator.
* [Ransomware](/stories/ransomware)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -91,8 +138,6 @@ takeown.exe is a normal windows application that may used by network operator.
| 56.0 | 70 | 80 | A suspicious of execution of $process_name$ with process id $process_id$ and commandline $process$ to modify permission of directory or files in host $dest$ |
-
-
#### Reference
* [https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/](https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/)
@@ -100,7 +145,7 @@ takeown.exe is a normal windows application that may used by network operator.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-06-10-powershell_creating_thread_mutex.md b/docs/_posts/2021-06-10-powershell_creating_thread_mutex.md
index 1132d25323..6115340021 100644
--- a/docs/_posts/2021-06-10-powershell_creating_thread_mutex.md
+++ b/docs/_posts/2021-06-10-powershell_creating_thread_mutex.md
@@ -26,16 +26,21 @@ tags:
The following analytic identifies suspicious PowerShell script execution via EventCode 4104 that is using the `mutex` function. This function is commonly seen in some obfuscated PowerShell scripts to make sure that only one instance of there process is running on a compromise machine. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-06-10
- **Author**: Teoderick Contreras, Splunk
- **ID**: 637557ec-ca08-11eb-bd0a-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,51 @@ The following analytic identifies suspicious PowerShell script execution via Eve
| [T1027.005](https://attack.mitre.org/techniques/T1027/005/) | Indicator Removal from Tools | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -55,10 +105,10 @@ The following analytic identifies suspicious PowerShell script execution via Eve
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `powershell_creating_thread_mutex_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **powershell_creating_thread_mutex_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -78,9 +128,6 @@ powershell developer may used this function in their script for instance checkin
* [Malicious PowerShell](/stories/malicious_powershell)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -90,8 +137,6 @@ powershell developer may used this function in their script for instance checkin
| 40.0 | 50 | 80 | A suspicious powershell script contains Thread Mutex in $Message$ with EventCode $EventCode$ in host $ComputerName$ |
-
-
#### Reference
* [https://isc.sans.edu/forums/diary/Some+Powershell+Malicious+Code/22988/](https://isc.sans.edu/forums/diary/Some+Powershell+Malicious+Code/22988/)
@@ -103,7 +148,7 @@ powershell developer may used this function in their script for instance checkin
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-06-10-powershell_domain_enumeration.md b/docs/_posts/2021-06-10-powershell_domain_enumeration.md
index c3fd570ea4..226ad31a52 100644
--- a/docs/_posts/2021-06-10-powershell_domain_enumeration.md
+++ b/docs/_posts/2021-06-10-powershell_domain_enumeration.md
@@ -28,16 +28,21 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
This analytic identifies specific PowerShell modules typically used to enumerate an organizations domain or users. \
During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-06-10
- **Author**: Michael Haag, Splunk
- **ID**: e1866ce2-ca22-11eb-8e44-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -45,6 +50,51 @@ During triage, review parallel processes using an EDR product or 4688 events. It
| [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +107,10 @@ During triage, review parallel processes using an EDR product or 4688 events. It
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `powershell_domain_enumeration_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **powershell_domain_enumeration_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -79,9 +129,6 @@ It is possible there will be false positives, filter as needed.
* [Malicious PowerShell](/stories/malicious_powershell)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -91,8 +138,6 @@ It is possible there will be false positives, filter as needed.
| 42.0 | 60 | 70 | A suspicious powershell script contains domain enumeration command in $Message$ with EventCode $EventCode$ in host $ComputerName$ |
-
-
#### Reference
* [https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.](https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.)
@@ -103,7 +148,7 @@ It is possible there will be false positives, filter as needed.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-06-10-powershell_loading_dotnet_into_memory_via_reflection.md b/docs/_posts/2021-06-10-powershell_loading_dotnet_into_memory_via_reflection.md
index 2076afc6f5..6ccd153a6a 100644
--- a/docs/_posts/2021-06-10-powershell_loading_dotnet_into_memory_via_reflection.md
+++ b/docs/_posts/2021-06-10-powershell_loading_dotnet_into_memory_via_reflection.md
@@ -28,16 +28,21 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
This analytic identifies the use of PowerShell loading .net assembly via reflection. This is commonly found in malicious PowerShell usage, including Empire and Cobalt Strike. In addition, the `load(` value may be modifed by removing `(` and it will identify more events to review. \
During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-06-10
- **Author**: Michael Haag, Splunk
- **ID**: 85bc3f30-ca28-11eb-bd21-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -45,6 +50,51 @@ During triage, review parallel processes using an EDR product or 4688 events. It
| [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +107,10 @@ During triage, review parallel processes using an EDR product or 4688 events. It
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `powershell_loading_dotnet_into_memory_via_reflection_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **powershell_loading_dotnet_into_memory_via_reflection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -81,9 +131,6 @@ False positives should be limited as day to day scripts do not use this method.
* [Malicious PowerShell](/stories/malicious_powershell)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -93,8 +140,6 @@ False positives should be limited as day to day scripts do not use this method.
| 56.0 | 70 | 80 | A suspicious powershell script contains reflective class assembly command in $Message$ to load .net code in memory with EventCode $EventCode$ in host $ComputerName$ |
-
-
#### Reference
* [https://docs.microsoft.com/en-us/dotnet/api/system.reflection.assembly?view=net-5.0](https://docs.microsoft.com/en-us/dotnet/api/system.reflection.assembly?view=net-5.0)
@@ -106,7 +151,7 @@ False positives should be limited as day to day scripts do not use this method.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-06-10-powershell_processing_stream_of_data.md b/docs/_posts/2021-06-10-powershell_processing_stream_of_data.md
index 6b99444a66..7a46260c9a 100644
--- a/docs/_posts/2021-06-10-powershell_processing_stream_of_data.md
+++ b/docs/_posts/2021-06-10-powershell_processing_stream_of_data.md
@@ -26,16 +26,21 @@ tags:
The following analytic identifies suspicious PowerShell script execution via EventCode 4104 that is processing compressed stream data. This is typically found in obfuscated PowerShell or PowerShell executing embedded .NET or binary files that are stream flattened and will be deflated durnig execution. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-06-10
- **Author**: Teoderick Contreras, Splunk
- **ID**: 0d718b52-c9f1-11eb-bc61-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,51 @@ The following analytic identifies suspicious PowerShell script execution via Eve
| [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -55,10 +105,10 @@ The following analytic identifies suspicious PowerShell script execution via Eve
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `powershell_processing_stream_of_data_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **powershell_processing_stream_of_data_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -79,9 +129,6 @@ powershell may used this function to process compressed data.
* [Malicious PowerShell](/stories/malicious_powershell)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -91,8 +138,6 @@ powershell may used this function to process compressed data.
| 40.0 | 50 | 80 | A suspicious powershell script contains stream command in $Message$ commonly for processing compressed or to decompressed binary file with EventCode $EventCode$ in host $ComputerName$ |
-
-
#### Reference
* [https://medium.com/@ahmedjouini99/deobfuscating-emotets-powershell-payload-e39fb116f7b9](https://medium.com/@ahmedjouini99/deobfuscating-emotets-powershell-payload-e39fb116f7b9)
@@ -104,7 +149,7 @@ powershell may used this function to process compressed data.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-06-10-powershell_using_memory_as_backing_store.md b/docs/_posts/2021-06-10-powershell_using_memory_as_backing_store.md
index f46e0b1634..5d7ae5728c 100644
--- a/docs/_posts/2021-06-10-powershell_using_memory_as_backing_store.md
+++ b/docs/_posts/2021-06-10-powershell_using_memory_as_backing_store.md
@@ -23,21 +23,71 @@ tags:
The following analytic identifies suspicious PowerShell script execution via EventCode 4104 that is using memory stream as new object backstore. The malicious PowerShell script will contain stream flate data and will be decompressed in memory to run or drop the actual payload. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-06-10
- **Author**: Teoderick Contreras, Splunk
- **ID**: c396a0c4-c9f2-11eb-b4f5-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1140](https://attack.mitre.org/techniques/T1140/) | Deobfuscate/Decode Files or Information | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -50,10 +100,10 @@ The following analytic identifies suspicious PowerShell script execution via Eve
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `powershell_using_memory_as_backing_store_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **powershell_using_memory_as_backing_store_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -73,9 +123,6 @@ powershell may used this function to store out object into memory.
* [Malicious PowerShell](/stories/malicious_powershell)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -85,8 +132,6 @@ powershell may used this function to store out object into memory.
| 40.0 | 50 | 80 | A suspicious powershell script contains memorystream command in $Message$ as new object backstore with EventCode $EventCode$ in host $ComputerName$ |
-
-
#### Reference
* [https://www.carbonblack.com/blog/decoding-malicious-powershell-streams/](https://www.carbonblack.com/blog/decoding-malicious-powershell-streams/)
@@ -98,7 +143,7 @@ powershell may used this function to store out object into memory.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md b/docs/_posts/2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md
index 3d15f8a8ef..5ba60d93de 100644
--- a/docs/_posts/2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md
+++ b/docs/_posts/2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md
@@ -24,21 +24,71 @@ tags:
This search is to detect a suspicious bcdedit.exe execution to ignore all failures. This technique was used by ransomware to prevent the compromise machine automatically boot in repair mode.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-06-10
- **Author**: Teoderick Contreras, Splunk
- **ID**: 7742aa92-c9d9-11eb-bbfc-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1490](https://attack.mitre.org/techniques/T1490/) | Inhibit System Recovery | Impact |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +102,10 @@ This search is to detect a suspicious bcdedit.exe execution to ignore all failur
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `prevent_automatic_repair_mode_using_bcdedit_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **prevent_automatic_repair_mode_using_bcdedit_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -79,9 +129,6 @@ Administrators may modify the boot configuration ignore failure during testing a
* [Ransomware](/stories/ransomware)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -91,8 +138,6 @@ Administrators may modify the boot configuration ignore failure during testing a
| 56.0 | 70 | 80 | A suspicious process $process_name$ with process id $process_id$ contains commandline $process$ to ignore all bcdedit execution failure in host $dest$ |
-
-
#### Reference
* [https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_1_tamada-yamazaki-nakatsuru_en.pdf](https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_1_tamada-yamazaki-nakatsuru_en.pdf)
@@ -100,7 +145,7 @@ Administrators may modify the boot configuration ignore failure during testing a
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-06-10-recon_avproduct_through_pwh_or_wmi.md b/docs/_posts/2021-06-10-recon_avproduct_through_pwh_or_wmi.md
index 1dba6de5c0..f54f1619a4 100644
--- a/docs/_posts/2021-06-10-recon_avproduct_through_pwh_or_wmi.md
+++ b/docs/_posts/2021-06-10-recon_avproduct_through_pwh_or_wmi.md
@@ -23,21 +23,71 @@ tags:
The following analytic identifies suspicious PowerShell script execution via EventCode 4104 performing checks to identify anti-virus products installed on the endpoint. This technique is commonly found in malware and APT events where the adversary will map all running security applications or services. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-06-10
- **Author**: Teoderick Contreras, Splunk
- **ID**: 28077620-c9f6-11eb-8785-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1592](https://attack.mitre.org/techniques/T1592/) | Gather Victim Host Information | Reconnaissance |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -50,10 +100,10 @@ The following analytic identifies suspicious PowerShell script execution via Eve
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `recon_avproduct_through_pwh_or_wmi_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **recon_avproduct_through_pwh_or_wmi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -74,9 +124,6 @@ network administrator may used this command for checking purposes
* [Malicious PowerShell](/stories/malicious_powershell)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -86,8 +133,6 @@ network administrator may used this command for checking purposes
| 56.0 | 70 | 80 | A suspicious powershell script contains AV recon command in $Message$ with EventCode $EventCode$ in host $ComputerName$ |
-
-
#### Reference
* [https://news.sophos.com/en-us/2020/05/12/maze-ransomware-1-year-counting/](https://news.sophos.com/en-us/2020/05/12/maze-ransomware-1-year-counting/)
@@ -99,7 +144,7 @@ network administrator may used this command for checking purposes
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-06-10-recon_using_wmi_class.md b/docs/_posts/2021-06-10-recon_using_wmi_class.md
index 870feb6293..39627d5823 100644
--- a/docs/_posts/2021-06-10-recon_using_wmi_class.md
+++ b/docs/_posts/2021-06-10-recon_using_wmi_class.md
@@ -23,21 +23,71 @@ tags:
The following analytic identifies suspicious PowerShell via EventCode 4104, where WMI is performing an event query looking for running processes or running services. This technique is commonly found where the adversary will identify services and system information on the compromised machine. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-06-10
- **Author**: Teoderick Contreras, Splunk
- **ID**: 018c1972-ca07-11eb-9473-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1592](https://attack.mitre.org/techniques/T1592/) | Gather Victim Host Information | Reconnaissance |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -50,10 +100,10 @@ The following analytic identifies suspicious PowerShell via EventCode 4104, wher
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `recon_using_wmi_class_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **recon_using_wmi_class_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -73,9 +123,6 @@ network administrator may used this command for checking purposes
* [Malicious PowerShell](/stories/malicious_powershell)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -85,8 +132,6 @@ network administrator may used this command for checking purposes
| 60.0 | 75 | 80 | A suspicious powershell script contains host recon command in $Message$ with EventCode $EventCode$ in host $ComputerName$ |
-
-
#### Reference
* [https://news.sophos.com/en-us/2020/05/12/maze-ransomware-1-year-counting/](https://news.sophos.com/en-us/2020/05/12/maze-ransomware-1-year-counting/)
@@ -98,7 +143,7 @@ network administrator may used this command for checking purposes
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-06-14-wmi_recon_running_process_or_services.md b/docs/_posts/2021-06-14-wmi_recon_running_process_or_services.md
index fe0db9da87..bb588df593 100644
--- a/docs/_posts/2021-06-14-wmi_recon_running_process_or_services.md
+++ b/docs/_posts/2021-06-14-wmi_recon_running_process_or_services.md
@@ -23,21 +23,71 @@ tags:
The following analytic identifies suspicious PowerShell script execution via EventCode 4104, where WMI is performing an event query looking for running processes or running services. This technique is commonly found in malware and APT events where the adversary will map all running security applications or services on the compromised machine. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-06-14
- **Author**: Teoderick Contreras, Splunk
- **ID**: b5cd5526-cce7-11eb-b3bd-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1592](https://attack.mitre.org/techniques/T1592/) | Gather Victim Host Information | Reconnaissance |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -50,10 +100,10 @@ The following analytic identifies suspicious PowerShell script execution via Eve
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `wmi_recon_running_process_or_services_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **wmi_recon_running_process_or_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -73,9 +123,6 @@ network administrator may used this command for checking purposes
* [Malicious PowerShell](/stories/malicious_powershell)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -85,8 +132,6 @@ network administrator may used this command for checking purposes
| 30.0 | 30 | 100 | Suspicious powerShell script execution by $user$ on $ComputerName$ via EventCode 4104, where WMI is performing an event query looking for running processes or running services |
-
-
#### Reference
* [https://news.sophos.com/en-us/2020/05/12/maze-ransomware-1-year-counting/](https://news.sophos.com/en-us/2020/05/12/maze-ransomware-1-year-counting/)
@@ -97,7 +142,7 @@ network administrator may used this command for checking purposes
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md b/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md
index 73f5a6d0a6..986c97fc50 100644
--- a/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md
+++ b/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md
@@ -33,16 +33,21 @@ All event subscriptions have three components \
1. Binding - Registers a filter to a consumer. EventID equals 21 \
Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToConsumerBinding. It may be pertinent to review all 3 to identify the flow of execution. In addition, EventCode 4104 may assist with any other PowerShell script usage that registered the subscription.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-06-16
- **Author**: Michael Haag, Splunk
- **ID**: 01d9a0c2-cece-11eb-ab46-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -50,6 +55,51 @@ Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToCons
| [T1546](https://attack.mitre.org/techniques/T1546/) | Event Triggered Execution | Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -62,10 +112,10 @@ Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToCons
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_wmi_event_subscription_persistence_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_wmi_event_subscription_persistence_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +134,6 @@ It is possible some applications will create a consumer and may be required to b
* [Suspicious WMI Use](/stories/suspicious_wmi_use)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -96,8 +143,6 @@ It is possible some applications will create a consumer and may be required to b
| 63.0 | 70 | 90 | Possible malicious WMI Subscription created on $dest$ |
-
-
#### Reference
* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.003/T1546.003.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.003/T1546.003.md)
@@ -108,7 +153,7 @@ It is possible some applications will create a consumer and may be required to b
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-06-17-suspicious_event_log_service_behavior.md b/docs/_posts/2021-06-17-suspicious_event_log_service_behavior.md
index edd94d80fb..8173d871c1 100644
--- a/docs/_posts/2021-06-17-suspicious_event_log_service_behavior.md
+++ b/docs/_posts/2021-06-17-suspicious_event_log_service_behavior.md
@@ -26,16 +26,21 @@ tags:
The following analytic utilizes Windows Event ID 1100 to identify when Windows event log service is shutdown. Note that this is a voluminous analytic that will require tuning or restricted to specific endpoints based on criticality. This event generates every time Windows Event Log service has shut down. It also generates during normal system shutdown. During triage, based on time of day and user, determine if this was planned. If not planned, follow through with reviewing parallel alerts and other data sources to determine what else may have occurred.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-06-17
- **Author**: Mauricio Velazco, Splunk
- **ID**: 2b85aa3d-f5f6-4c2e-a081-a09f6e1c2e40
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,61 @@ The following analytic utilizes Windows Event ID 1100 to identify when Windows e
| [T1070.001](https://attack.mitre.org/techniques/T1070/001/) | Clear Windows Event Logs | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.DP
+* PR.IP
+* PR.AC
+* PR.AT
+* DE.AE
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 6
+
+
+
+
+
+
+
#### Search
```
@@ -55,10 +115,10 @@ The following analytic utilizes Windows Event ID 1100 to identify when Windows e
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `suspicious_event_log_service_behavior_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **suspicious_event_log_service_behavior_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -78,9 +138,6 @@ It is possible the Event Logging service gets shut down due to system errors or
* [Clop Ransomware](/stories/clop_ransomware)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -90,8 +147,6 @@ It is possible the Event Logging service gets shut down due to system errors or
| 9.0 | 30 | 30 | The Windows Event Log Service shutdown on $ComputerName$ |
-
-
#### Reference
* [https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-1100](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-1100)
@@ -102,7 +157,7 @@ It is possible the Event Logging service gets shut down due to system errors or
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-06-22-execute_javascript_with_jscript_com_clsid.md b/docs/_posts/2021-06-22-execute_javascript_with_jscript_com_clsid.md
index 99e7c98439..93f0cb6512 100644
--- a/docs/_posts/2021-06-22-execute_javascript_with_jscript_com_clsid.md
+++ b/docs/_posts/2021-06-22-execute_javascript_with_jscript_com_clsid.md
@@ -27,16 +27,21 @@ tags:
This analytic will identify suspicious process of cscript.exe where it tries to execute javascript using jscript.encode CLSID (COM OBJ). This technique was seen in ransomware (reddot ransomware) where it execute javascript with this com object with combination of amsi disabling technique.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-06-22
- **Author**: Teoderick Contreras, Splunk
- **ID**: dc64d064-d346-11eb-8588-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This analytic will identify suspicious process of cscript.exe where it tries to
| [T1059.005](https://attack.mitre.org/techniques/T1059/005/) | Visual Basic | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +107,10 @@ This analytic will identify suspicious process of cscript.exe where it tries to
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `execute_javascript_with_jscript_com_clsid_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **execute_javascript_with_jscript_com_clsid_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -83,9 +133,6 @@ unknown
* [Ransomware](/stories/ransomware)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -95,8 +142,6 @@ unknown
| 56.0 | 80 | 70 | Suspicious process of cscript.exe with a parent process $parent_process_name$ where it tries to execute javascript using jscript.encode CLSID (COM OBJ), detected on $dest$ by $user$ |
-
-
#### Reference
* [https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/](https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/)
@@ -104,7 +149,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-06-22-powershell_enable_smb1protocol_feature.md b/docs/_posts/2021-06-22-powershell_enable_smb1protocol_feature.md
index bf8070ab6d..fe2bb8a091 100644
--- a/docs/_posts/2021-06-22-powershell_enable_smb1protocol_feature.md
+++ b/docs/_posts/2021-06-22-powershell_enable_smb1protocol_feature.md
@@ -27,16 +27,21 @@ tags:
This search is to detect a suspicious enabling of smb1protocol through "powershell.exe". This technique was seen in some ransomware (like reddot) where it enable smb share to do the lateral movement and encrypt other files within the compromise network system.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-06-22
- **Author**: Teoderick Contreras, Splunk
- **ID**: afed80b2-d34b-11eb-a952-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This search is to detect a suspicious enabling of smb1protocol through "powershe
| [T1027.005](https://attack.mitre.org/techniques/T1027/005/) | Indicator Removal from Tools | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -56,10 +106,10 @@ This search is to detect a suspicious enabling of smb1protocol through "powershe
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `powershell_enable_smb1protocol_feature_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **powershell_enable_smb1protocol_feature_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -80,9 +130,6 @@ network operator may enable or disable this windows feature.
* [Ransomware](/stories/ransomware)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -92,8 +139,6 @@ network operator may enable or disable this windows feature.
| 25.0 | 50 | 50 | Powershell Enable SMB1Protocol Feature |
-
-
#### Reference
* [https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/](https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/)
@@ -101,7 +146,7 @@ network operator may enable or disable this windows feature.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md b/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md
index f1a413bf73..9ade789aa2 100644
--- a/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md
+++ b/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md
@@ -27,16 +27,21 @@ tags:
This search is to detect a suspicious commandline designed to delete files or directory recursive using batch command. This technique was seen in ransomware (reddot) where it it tries to delete the files in recycle bin to impaire user from recovering deleted files.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-06-22
- **Author**: Teoderick Contreras, Splunk
- **ID**: ba570b3a-d356-11eb-8358-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This search is to detect a suspicious commandline designed to delete files or di
| [T1070](https://attack.mitre.org/techniques/T1070/) | Indicator Removal on Host | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -58,10 +108,10 @@ This search is to detect a suspicious commandline designed to delete files or di
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
-Note that `recursive_delete_of_directory_in_batch_cmd_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **recursive_delete_of_directory_in_batch_cmd_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -88,9 +138,6 @@ network operator may use this batch command to delete recursively a directory or
* [Ransomware](/stories/ransomware)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -100,8 +147,6 @@ network operator may use this batch command to delete recursively a directory or
| 25.0 | 50 | 50 | Recursive Delete of Directory In Batch CMD |
-
-
#### Reference
* [https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/](https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/)
@@ -109,7 +154,7 @@ network operator may use this batch command to delete recursively a directory or
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md b/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md
index c9a86afd57..bf45950160 100644
--- a/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md
+++ b/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md
@@ -27,16 +27,21 @@ tags:
This search is to detect a suspicious modification of firewall to allow file and printer sharing. This technique was seen in ransomware to be able to discover more machine connected to the compromised host to encrypt more files
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-06-23
- **Author**: Teoderick Contreras, Splunk
- **ID**: ce27646e-d411-11eb-8a00-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This search is to detect a suspicious modification of firewall to allow file and
| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,11 +107,11 @@ This search is to detect a suspicious modification of firewall to allow file and
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `allow_file_and_printing_sharing_in_firewall_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **allow_file_and_printing_sharing_in_firewall_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -88,9 +138,6 @@ network admin may modify this firewall feature that may cause this rule to be tr
* [Ransomware](/stories/ransomware)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -100,8 +147,6 @@ network admin may modify this firewall feature that may cause this rule to be tr
| 25.0 | 50 | 50 | |
-
-
#### Reference
* [https://kb.fortinet.com/kb/documentLink.do?externalID=FD52469](https://kb.fortinet.com/kb/documentLink.do?externalID=FD52469)
@@ -110,7 +155,7 @@ network admin may modify this firewall feature that may cause this rule to be tr
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md b/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md
index 06650f463e..a5a9cc2a68 100644
--- a/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md
+++ b/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md
@@ -27,16 +27,21 @@ tags:
This search is to detect a suspicious modification to the firewall to allow network discovery on a machine. This technique was seen in couple of ransomware (revil, reddot) to discover other machine connected to the compromised host to encrypt more files.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-06-23
- **Author**: Teoderick Contreras, Splunk
- **ID**: ccd6a38c-d40b-11eb-85a5-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This search is to detect a suspicious modification to the firewall to allow netw
| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,11 +107,11 @@ This search is to detect a suspicious modification to the firewall to allow netw
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `allow_network_discovery_in_firewall_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **allow_network_discovery_in_firewall_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -89,9 +139,6 @@ network admin may modify this firewall feature that may cause this rule to be tr
* [Revil Ransomware](/stories/revil_ransomware)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -101,8 +148,6 @@ network admin may modify this firewall feature that may cause this rule to be tr
| 25.0 | 50 | 50 | |
-
-
#### Reference
* [https://kb.fortinet.com/kb/documentLink.do?externalID=FD52469](https://kb.fortinet.com/kb/documentLink.do?externalID=FD52469)
@@ -111,7 +156,7 @@ network admin may modify this firewall feature that may cause this rule to be tr
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md b/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md
index f7791092bc..12b22c558f 100644
--- a/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md
+++ b/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md
@@ -27,16 +27,21 @@ tags:
This search is to detect a suspicious excessive usage of sc.exe in a host machine. This technique was seen in several ransomware , xmrig and other malware to create, modify, delete or disable a service may related to security application or to gain privilege escalation.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-06-24
- **Author**: Teoderick Contreras, Splunk
- **ID**: cb6b339e-d4c6-11eb-a026-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This search is to detect a suspicious excessive usage of sc.exe in a host machin
| [T1569.002](https://attack.mitre.org/techniques/T1569/002/) | Service Execution | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -61,10 +111,10 @@ This search is to detect a suspicious excessive usage of sc.exe in a host machin
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `excessive_usage_of_sc_service_utility_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **excessive_usage_of_sc_service_utility_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -83,9 +133,6 @@ excessive execution of sc.exe is quite suspicious since it can modify or execute
* [Ransomware](/stories/ransomware)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -95,8 +142,6 @@ excessive execution of sc.exe is quite suspicious since it can modify or execute
| 25.0 | 50 | 50 | Excessive Usage Of SC Service Utility |
-
-
#### Reference
* [https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/](https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/)
@@ -104,7 +149,7 @@ excessive execution of sc.exe is quite suspicious since it can modify or execute
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-06-25-excessive_number_of_service_control_start_as_disabled.md b/docs/_posts/2021-06-25-excessive_number_of_service_control_start_as_disabled.md
index e2c2037d60..6671a1b142 100644
--- a/docs/_posts/2021-06-25-excessive_number_of_service_control_start_as_disabled.md
+++ b/docs/_posts/2021-06-25-excessive_number_of_service_control_start_as_disabled.md
@@ -27,16 +27,21 @@ tags:
This detection targets behaviors observed when threat actors have used sc.exe to modify services. We observed malware in a honey pot spawning numerous sc.exe processes in a short period of time, presumably to impair defenses, possibly to block others from compromising the same machine. This detection will alert when we see both an excessive number of sc.exe processes launched with specific commandline arguments to disable the start of certain services.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-06-25
- **Author**: Michael Hart, Splunk
- **ID**: 77592bec-d5cc-11eb-9e60-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This detection targets behaviors observed when threat actors have used sc.exe to
| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -58,10 +108,10 @@ This detection targets behaviors observed when threat actors have used sc.exe to
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `excessive_number_of_service_control_start_as_disabled_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **excessive_number_of_service_control_start_as_disabled_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +134,6 @@ Legitimate programs and administrators will execute sc.exe with the start disabl
* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -96,8 +143,6 @@ Legitimate programs and administrators will execute sc.exe with the start disabl
| 80.0 | 80 | 100 | An excessive amount of $process_name$ was executed on $dest$ attempting to disable services. |
-
-
#### Reference
* [https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/sc-create](https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/sc-create)
@@ -106,7 +151,7 @@ Legitimate programs and administrators will execute sc.exe with the start disabl
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md b/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md
index c7a634f250..39e80769c2 100644
--- a/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md
+++ b/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md
@@ -33,16 +33,21 @@ The following analytic identifies new printer drivers being load by utilizing th
Within the proof of concept code, the following event will occur - "Printer driver 1234 for Windows x64 Version-3 was added or updated. Files:- UNIDRV.DLL, kernelbase.dll, evil.dll. No user action is required." \
During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events and review the source of where the exploitation began.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-07-01
- **Author**: Mauricio Velazco, Michael Haag, Teoderick Contreras, Splunk
- **ID**: 313681a2-da8e-11eb-adad-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -50,6 +55,56 @@ During triage, isolate the endpoint and review for source of exploitation. Captu
| [T1547](https://attack.mitre.org/techniques/T1547/) | Boot or Logon Autostart Execution | Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -62,10 +117,10 @@ During triage, isolate the endpoint and review for source of exploitation. Captu
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [printservice](https://github.com/splunk/security_content/blob/develop/macros/printservice.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `print_spooler_adding_a_printer_driver_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **print_spooler_adding_a_printer_driver_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -85,9 +140,6 @@ Unknown. This may require filtering.
* [PrintNightmare CVE-2021-34527](/stories/printnightmare_cve-2021-34527)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -97,15 +149,6 @@ Unknown. This may require filtering.
| 72.0 | 80 | 90 | Suspicious print driver was loaded on endpoint $ComputerName$. |
-#### CVE
-
-| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
-| ----------- | ----------- | -------------- |
-| [CVE-2021-34527](https://nvd.nist.gov/vuln/detail/CVE-2021-34527) | Windows Print Spooler Remote Code Execution Vulnerability | 9.0 |
-| [CVE-2021-1675](https://nvd.nist.gov/vuln/detail/CVE-2021-1675) | Windows Print Spooler Elevation of Privilege Vulnerability | 9.3 |
-
-
-
#### Reference
* [https://twitter.com/MalwareJake/status/1410421445608476679?s=20](https://twitter.com/MalwareJake/status/1410421445608476679?s=20)
@@ -116,7 +159,7 @@ Unknown. This may require filtering.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md b/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md
index 7f4387b2b7..83cbd2e90b 100644
--- a/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md
+++ b/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md
@@ -34,16 +34,21 @@ Within the proof of concept code, the following error will occur - "The print sp
The analytic is based on file path and failure to load the plug-in. \
During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-07-01
- **Author**: Mauricio Velazco, Michael Haag, Splunk
- **ID**: 1adc9548-da7c-11eb-8f13-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
+| ----------- | ----------- | -------------- |
+| [CVE-2021-34527](https://nvd.nist.gov/vuln/detail/CVE-2021-34527) | Windows Print Spooler Remote Code Execution Vulnerability | 9.0 |
+| [CVE-2021-1675](https://nvd.nist.gov/vuln/detail/CVE-2021-1675) | Windows Print Spooler Elevation of Privilege Vulnerability | 9.3 |
+
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -51,6 +56,56 @@ During triage, isolate the endpoint and review for source of exploitation. Captu
| [T1547](https://attack.mitre.org/techniques/T1547/) | Boot or Logon Autostart Execution | Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -63,10 +118,10 @@ During triage, isolate the endpoint and review for source of exploitation. Captu
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [printservice](https://github.com/splunk/security_content/blob/develop/macros/printservice.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `print_spooler_failed_to_load_a_plug-in_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **print_spooler_failed_to_load_a_plug-in_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -86,9 +141,6 @@ False positives are unknown and filtering may be required.
* [PrintNightmare CVE-2021-34527](/stories/printnightmare_cve-2021-34527)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -98,15 +150,6 @@ False positives are unknown and filtering may be required.
| 72.0 | 80 | 90 | Suspicious printer spooler errors have occured on endpoint $ComputerName$ with EventCode $EventCode$. |
-#### CVE
-
-| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
-| ----------- | ----------- | -------------- |
-| [CVE-2021-34527](https://nvd.nist.gov/vuln/detail/CVE-2021-34527) | Windows Print Spooler Remote Code Execution Vulnerability | 9.0 |
-| [CVE-2021-1675](https://nvd.nist.gov/vuln/detail/CVE-2021-1675) | Windows Print Spooler Elevation of Privilege Vulnerability | 9.3 |
-
-
-
#### Reference
* [https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/](https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/)
@@ -116,7 +159,7 @@ False positives are unknown and filtering may be required.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md b/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md
index fece08905b..ea46591f80 100644
--- a/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md
+++ b/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md
@@ -30,16 +30,21 @@ tags:
The following analytic identifies a suspicious child process, `rundll32.exe`, with no command-line arguments being spawned from `spoolsv.exe`. This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. Typically, this is not normal behavior for `spoolsv.exe` to spawn a process. During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-07-01
- **Author**: Mauricio Velazco, Michael Haag, Splunk
- **ID**: 15d905f6-da6b-11eb-ab82-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
+| ----------- | ----------- | -------------- |
+| [CVE-2021-34527](https://nvd.nist.gov/vuln/detail/CVE-2021-34527) | Windows Print Spooler Remote Code Execution Vulnerability | 9.0 |
+| [CVE-2021-1675](https://nvd.nist.gov/vuln/detail/CVE-2021-1675) | Windows Print Spooler Elevation of Privilege Vulnerability | 9.3 |
+
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -47,6 +52,55 @@ The following analytic identifies a suspicious child process, `rundll32.exe`, wi
| [T1547](https://attack.mitre.org/techniques/T1547/) | Boot or Logon Autostart Execution | Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -60,11 +114,11 @@ The following analytic identifies a suspicious child process, `rundll32.exe`, wi
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `spoolsv_spawning_rundll32_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **spoolsv_spawning_rundll32_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -91,9 +145,6 @@ Limited false positives have been identified. There are limited instances where
* [PrintNightmare CVE-2021-34527](/stories/printnightmare_cve-2021-34527)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -103,14 +154,6 @@ Limited false positives have been identified. There are limited instances where
| 72.0 | 80 | 90 | $parent_process$ has spawned $process_name$ on endpoint $ComputerName$. This behavior is suspicious and related to PrintNightmare. |
-#### CVE
-
-| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
-| ----------- | ----------- | -------------- |
-| [CVE-2021-34527](https://nvd.nist.gov/vuln/detail/CVE-2021-34527) | Windows Print Spooler Remote Code Execution Vulnerability | 9.0 |
-
-
-
#### Reference
* [https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/](https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/)
@@ -120,7 +163,7 @@ Limited false positives have been identified. There are limited instances where
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md b/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md
index 2e9c0ee649..3a912ebefc 100644
--- a/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md
+++ b/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md
@@ -30,16 +30,21 @@ tags:
This search is to detect suspicious loading of dll in specific path relative to printnightmare exploitation. In this search we try to detect the loaded modules made by spoolsv.exe after the exploitation.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-07-01
- **Author**: Mauricio Velazco, Michael Haag, Teoderick Contreras, Splunk
- **ID**: a5e451f8-da81-11eb-b245-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
+| ----------- | ----------- | -------------- |
+| [CVE-2021-34527](https://nvd.nist.gov/vuln/detail/CVE-2021-34527) | Windows Print Spooler Remote Code Execution Vulnerability | 9.0 |
+
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -47,6 +52,55 @@ This search is to detect suspicious loading of dll in specific path relative to
| [T1547](https://attack.mitre.org/techniques/T1547/) | Boot or Logon Autostart Execution | Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -60,10 +114,10 @@ This search is to detect suspicious loading of dll in specific path relative to
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `spoolsv_suspicious_loaded_modules_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **spoolsv_suspicious_loaded_modules_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -83,9 +137,6 @@ unknown
* [PrintNightmare CVE-2021-34527](/stories/printnightmare_cve-2021-34527)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -95,14 +146,6 @@ unknown
| 72.0 | 80 | 90 | $Image$ with process id $process_id$ has loaded a driver from $ImageLoaded$ on endpoint $Computer$. This behavior is suspicious and related to PrintNightmare. |
-#### CVE
-
-| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
-| ----------- | ----------- | -------------- |
-| [CVE-2021-34527](https://nvd.nist.gov/vuln/detail/CVE-2021-34527) | Windows Print Spooler Remote Code Execution Vulnerability | 9.0 |
-
-
-
#### Reference
* [https://raw.githubusercontent.com/hieuttmmo/sigma/dceb13fe3f1821b119ae495b41e24438bd97e3d0/rules/windows/image_load/sysmon_cve_2021_1675_print_nightmare.yml](https://raw.githubusercontent.com/hieuttmmo/sigma/dceb13fe3f1821b119ae495b41e24438bd97e3d0/rules/windows/image_load/sysmon_cve_2021_1675_print_nightmare.yml)
@@ -110,7 +153,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md b/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md
index bb05314bf1..f549313207 100644
--- a/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md
+++ b/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md
@@ -25,21 +25,75 @@ tags:
This analytic identifies a suspicious behavior related to PrintNightmare, or CVE-2021-34527 previously (CVE-2021-1675), to gain privilege escalation on the vulnerable machine. This exploit attacks a critical Windows Print Spooler Vulnerability to elevate privilege. This detection is to look for suspicious process access made by the spoolsv.exe that may related to the attack.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-07-01
- **Author**: Mauricio Velazco, Michael Haag, Teoderick Contreras, Splunk
- **ID**: 799b606e-da81-11eb-93f8-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
+| ----------- | ----------- | -------------- |
+| [CVE-2021-34527](https://nvd.nist.gov/vuln/detail/CVE-2021-34527) | Windows Print Spooler Remote Code Execution Vulnerability | 9.0 |
+
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1068](https://attack.mitre.org/techniques/T1068/) | Exploitation for Privilege Escalation | Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +106,10 @@ This analytic identifies a suspicious behavior related to PrintNightmare, or CVE
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `spoolsv_suspicious_process_access_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **spoolsv_suspicious_process_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -76,9 +130,6 @@ Unknown. Filter as needed.
* [PrintNightmare CVE-2021-34527](/stories/printnightmare_cve-2021-34527)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -88,14 +139,6 @@ Unknown. Filter as needed.
| 72.0 | 80 | 90 | $SourceImage$ was GrantedAccess open access to $TargetImage$ on endpoint $Computer$. This behavior is suspicious and related to PrintNightmare. |
-#### CVE
-
-| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
-| ----------- | ----------- | -------------- |
-| [CVE-2021-34527](https://nvd.nist.gov/vuln/detail/CVE-2021-34527) | Windows Print Spooler Remote Code Execution Vulnerability | 9.0 |
-
-
-
#### Reference
* [https://github.com/cube0x0/impacket/commit/73b9466c17761384ece11e1028ec6689abad6818](https://github.com/cube0x0/impacket/commit/73b9466c17761384ece11e1028ec6689abad6818)
@@ -106,7 +149,7 @@ Unknown. Filter as needed.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-07-01-spoolsv_writing_a_dll.md b/docs/_posts/2021-07-01-spoolsv_writing_a_dll.md
index e3714b0ca4..644dbc96bc 100644
--- a/docs/_posts/2021-07-01-spoolsv_writing_a_dll.md
+++ b/docs/_posts/2021-07-01-spoolsv_writing_a_dll.md
@@ -30,16 +30,21 @@ tags:
The following analytic identifies a `.dll` being written by `spoolsv.exe`. This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. Typically, this is not normal behavior for `spoolsv.exe` to write a `.dll`. Current POC code used will write the suspicious DLL to disk within a path of `\spool\drivers\x64\`. During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-07-01
- **Author**: Mauricio Velazco, Michael Haag, Splunk
- **ID**: d5bf5cf2-da71-11eb-92c2-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
+| ----------- | ----------- | -------------- |
+| [CVE-2021-34527](https://nvd.nist.gov/vuln/detail/CVE-2021-34527) | Windows Print Spooler Remote Code Execution Vulnerability | 9.0 |
+
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -47,6 +52,55 @@ The following analytic identifies a `.dll` being written by `spoolsv.exe`. This
| [T1547](https://attack.mitre.org/techniques/T1547/) | Boot or Logon Autostart Execution | Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -66,7 +120,7 @@ The following analytic identifies a `.dll` being written by `spoolsv.exe`. This
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `spoolsv_writing_a_dll_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **spoolsv_writing_a_dll_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -90,9 +144,6 @@ Unknown.
* [PrintNightmare CVE-2021-34527](/stories/printnightmare_cve-2021-34527)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -102,14 +153,6 @@ Unknown.
| 72.0 | 80 | 90 | $process_name$ has been identified writing dll's to $file_path$ on endpoint $dest$. This behavior is suspicious and related to PrintNightmare. |
-#### CVE
-
-| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
-| ----------- | ----------- | -------------- |
-| [CVE-2021-34527](https://nvd.nist.gov/vuln/detail/CVE-2021-34527) | Windows Print Spooler Remote Code Execution Vulnerability | 9.0 |
-
-
-
#### Reference
* [https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/](https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/)
@@ -119,7 +162,7 @@ Unknown.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md b/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md
index b040161cab..f6d5b756f5 100644
--- a/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md
+++ b/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md
@@ -30,16 +30,21 @@ tags:
The following analytic identifies a `.dll` being written by `spoolsv.exe`. This was identified during our testing of CVE-2021-34527 previously(CVE-2021-1675) or PrintNightmare. Typically, this is not normal behavior for `spoolsv.exe` to write a `.dll`. Current POC code used will write the suspicious DLL to disk within a path of `\spool\drivers\x64\`. During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-07-01
- **Author**: Mauricio Velazco, Michael Haag, Splunk
- **ID**: 347fd388-da87-11eb-836d-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
+| ----------- | ----------- | -------------- |
+| [CVE-2021-34527](https://nvd.nist.gov/vuln/detail/CVE-2021-34527) | Windows Print Spooler Remote Code Execution Vulnerability | 9.0 |
+
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -47,6 +52,55 @@ The following analytic identifies a `.dll` being written by `spoolsv.exe`. This
| [T1547](https://attack.mitre.org/techniques/T1547/) | Boot or Logon Autostart Execution | Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -59,10 +113,10 @@ The following analytic identifies a `.dll` being written by `spoolsv.exe`. This
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `spoolsv_writing_a_dll_-_sysmon_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **spoolsv_writing_a_dll_-_sysmon_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +138,6 @@ Limited false positives. Filter as needed.
* [PrintNightmare CVE-2021-34527](/stories/printnightmare_cve-2021-34527)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -96,14 +147,6 @@ Limited false positives. Filter as needed.
| 72.0 | 80 | 90 | $process_name$ has been identified writing dll's to $file_path$ on endpoint $dest$. This behavior is suspicious and related to PrintNightmare. |
-#### CVE
-
-| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
-| ----------- | ----------- | -------------- |
-| [CVE-2021-34527](https://nvd.nist.gov/vuln/detail/CVE-2021-34527) | Windows Print Spooler Remote Code Execution Vulnerability | 9.0 |
-
-
-
#### Reference
* [https://github.com/cube0x0/impacket/commit/73b9466c17761384ece11e1028ec6689abad6818](https://github.com/cube0x0/impacket/commit/73b9466c17761384ece11e1028ec6689abad6818)
@@ -114,7 +157,7 @@ Limited false positives. Filter as needed.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-07-05-msmpeng_application_dll_side_loading.md b/docs/_posts/2021-07-05-msmpeng_application_dll_side_loading.md
index fb35d74468..421a6bb7bf 100644
--- a/docs/_posts/2021-07-05-msmpeng_application_dll_side_loading.md
+++ b/docs/_posts/2021-07-05-msmpeng_application_dll_side_loading.md
@@ -31,16 +31,21 @@ tags:
This search is to detect a suspicious creation of msmpeng.exe or mpsvc.dll in non default windows defender folder. This technique was seen couple days ago with revil ransomware in Kaseya Supply chain. The approach is to drop an old version of msmpeng.exe to load the actual payload name as mspvc.dll which will load the revil ransomware to the compromise machine
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-07-05
- **Author**: Teoderick Contreras, Splunk
- **ID**: 8bb3f280-dd9b-11eb-84d5-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
+| ----------- | ----------- | -------------- |
+| [CVE-2021-34527](https://nvd.nist.gov/vuln/detail/CVE-2021-34527) | Windows Print Spooler Remote Code Execution Vulnerability | 9.0 |
+
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -48,6 +53,51 @@ This search is to detect a suspicious creation of msmpeng.exe or mpsvc.dll in no
| [T1574](https://attack.mitre.org/techniques/T1574/) | Hijack Execution Flow | Defense Evasion, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -61,10 +111,10 @@ This search is to detect a suspicious creation of msmpeng.exe or mpsvc.dll in no
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `msmpeng_application_dll_side_loading_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **msmpeng_application_dll_side_loading_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -86,9 +136,6 @@ quite minimal false positive expected.
* [Revil Ransomware](/stories/revil_ransomware)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -98,8 +145,6 @@ quite minimal false positive expected.
| 25.0 | 50 | 50 | |
-
-
#### Reference
* [https://community.sophos.com/b/security-blog/posts/active-ransomware-attack-on-kaseya-customers](https://community.sophos.com/b/security-blog/posts/active-ransomware-attack-on-kaseya-customers)
@@ -107,7 +152,7 @@ quite minimal false positive expected.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md b/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md
index 5fb1b5d0ae..dd084f95c4 100644
--- a/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md
+++ b/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md
@@ -27,16 +27,21 @@ tags:
This search is to identifies a modification in registry to disable the windows denfender real time behavior monitoring. This event or technique is commonly seen in RAT, bot, or Trojan to disable AV to evade detections.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-07-05
- **Author**: Michael Haag, Splunk
- **ID**: c148a894-dd93-11eb-bf2a-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This search is to identifies a modification in registry to disable the windows d
| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,11 +107,11 @@ This search is to identifies a modification in registry to disable the windows d
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `powershell_disable_security_monitoring_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **powershell_disable_security_monitoring_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -89,9 +139,6 @@ Limited false positives. However, tune based on scripts that may perform this ac
* [Revil Ransomware](/stories/revil_ransomware)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -101,8 +148,6 @@ Limited false positives. However, tune based on scripts that may perform this ac
| 25.0 | 50 | 50 | |
-
-
#### Reference
* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-15---tamper-with-windows-defender-atp-powershell](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-15---tamper-with-windows-defender-atp-powershell)
@@ -110,7 +155,7 @@ Limited false positives. However, tune based on scripts that may perform this ac
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md b/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md
index b3c9ea04b5..cf52d7e01a 100644
--- a/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md
+++ b/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md
@@ -29,16 +29,21 @@ tags:
This search is to detect a suspicious loaded unsigned dll by MMC.exe application. This technique is commonly seen in attacker that tries to bypassed UAC feature or gain privilege escalation. This is done by modifying some CLSID registry that will trigger the mmc.exe to load the dll path
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-07-12
- **Author**: Teoderick Contreras, Splunk
- **ID**: 7f04349c-e30d-11eb-bc7f-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,51 @@ This search is to detect a suspicious loaded unsigned dll by MMC.exe application
| [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -58,10 +108,10 @@ This search is to detect a suspicious loaded unsigned dll by MMC.exe application
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `uac_bypass_mmc_load_unsigned_dll_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **uac_bypass_mmc_load_unsigned_dll_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -85,9 +135,6 @@ unknown. all of the dll loaded by mmc.exe is microsoft signed dll.
* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -97,8 +144,6 @@ unknown. all of the dll loaded by mmc.exe is microsoft signed dll.
| 63.0 | 70 | 90 | Suspicious unsigned $ImageLoaded$ loaded by $Image$ on endpoint $Computer$ with EventCode $EventCode$ |
-
-
#### Reference
* [https://offsec.almond.consulting/UAC-bypass-dotnet.html](https://offsec.almond.consulting/UAC-bypass-dotnet.html)
@@ -106,7 +151,7 @@ unknown. all of the dll loaded by mmc.exe is microsoft signed dll.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md b/docs/_posts/2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md
index 7438decb2d..8c47f9ca87 100644
--- a/docs/_posts/2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md
+++ b/docs/_posts/2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md
@@ -33,16 +33,21 @@ tags:
This search looks for cloud compute instances created by users who have not created them before.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change)
-- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719)
+- **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change)- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719)
- **Last Updated**: 2021-07-13
- **Author**: Rico Valdez, Splunk
- **ID**: 37a0ec8d-827e-4d6d-8025-cedf31f3a149
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -50,6 +55,55 @@ This search looks for cloud compute instances created by users who have not crea
| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* ID.AM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 1
+
+
+
+
+
+
+
#### Search
```
@@ -68,10 +122,10 @@ This search looks for cloud compute instances created by users who have not crea
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `cloud_compute_instance_created_by_previously_unseen_user_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **cloud_compute_instance_created_by_previously_unseen_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Lookups
The SPL above uses the following Lookups:
@@ -96,9 +150,6 @@ It's possible that a user will start to create compute instances for the first t
* [Cloud Cryptomining](/stories/cloud_cryptomining)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -108,13 +159,11 @@ It's possible that a user will start to create compute instances for the first t
| 18.0 | 30 | 60 | User $user$ is creating a new instance $dest$ for the first time |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-07-19-aws_createloginprofile.md b/docs/_posts/2021-07-19-aws_createloginprofile.md
index 640bca456a..f800e58822 100644
--- a/docs/_posts/2021-07-19-aws_createloginprofile.md
+++ b/docs/_posts/2021-07-19-aws_createloginprofile.md
@@ -26,16 +26,21 @@ tags:
This search looks for AWS CloudTrail events where a user A(victim A) creates a login profile for user B, followed by a AWS Console login event from user B from the same src_ip as user B. This correlated event can be indicative of privilege escalation since both events happened from the same src_ip
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-07-19
- **Author**: Bhavin Patel, Splunk
- **ID**: 2a9b80d3-6340-4345-11ad-212bf444d111
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,57 @@ This search looks for AWS CloudTrail events where a user A(victim A) creates a l
| [T1136](https://attack.mitre.org/techniques/T1136/) | Create Account | Persistence |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.DS
+* PR.AC
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 13
+
+
+
+
+
+
+
#### Search
```
@@ -60,10 +116,10 @@ This search looks for AWS CloudTrail events where a user A(victim A) creates a l
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `aws_createloginprofile_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **aws_createloginprofile_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -83,9 +139,6 @@ While this search has no known false positives, it is possible that an AWS admin
* [AWS IAM Privilege Escalation](/stories/aws_iam_privilege_escalation)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -95,8 +148,6 @@ While this search has no known false positives, it is possible that an AWS admin
| 72.0 | 90 | 80 | User $user_arn$ is attempting to create a login profile for $requestParameters.userName$ and did a console login from this IP $src_ip$ |
-
-
#### Reference
* [https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws](https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws)
@@ -105,7 +156,7 @@ While this search has no known false positives, it is possible that an AWS admin
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-07-19-detect_new_open_s3_buckets.md b/docs/_posts/2021-07-19-detect_new_open_s3_buckets.md
index c88c7299fe..364ee513a4 100644
--- a/docs/_posts/2021-07-19-detect_new_open_s3_buckets.md
+++ b/docs/_posts/2021-07-19-detect_new_open_s3_buckets.md
@@ -23,21 +23,77 @@ tags:
This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-07-19
- **Author**: Bhavin Patel, Patrick Bareiss, Splunk
- **ID**: 2a9b80d3-6340-4345-b5ad-290bf3d0dac4
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1530](https://attack.mitre.org/techniques/T1530/) | Data from Cloud Storage Object | Collection |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.DS
+* PR.AC
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 13
+
+
+
+
+
+
+
#### Search
```
@@ -59,10 +115,10 @@ This search looks for AWS CloudTrail events where a user has created an open/pub
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_new_open_s3_buckets_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_new_open_s3_buckets_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -86,9 +142,6 @@ While this search has no known false positives, it is possible that an AWS admin
* [Suspicious AWS S3 Activities](/stories/suspicious_aws_s3_activities)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -98,13 +151,11 @@ While this search has no known false positives, it is possible that an AWS admin
| 48.0 | 60 | 80 | User $user_arn$ has created an open/public bucket $bucketName$ with the following permissions $permission$ |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-07-19-detect_new_open_s3_buckets_over_aws_cli.md b/docs/_posts/2021-07-19-detect_new_open_s3_buckets_over_aws_cli.md
index a723f3dbc1..a3c79a5700 100644
--- a/docs/_posts/2021-07-19-detect_new_open_s3_buckets_over_aws_cli.md
+++ b/docs/_posts/2021-07-19-detect_new_open_s3_buckets_over_aws_cli.md
@@ -23,21 +23,77 @@ tags:
This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket over the aws cli.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-07-19
- **Author**: Patrick Bareiss, Splunk
- **ID**: 39c61d09-8b30-4154-922b-2d0a694ecc22
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1530](https://attack.mitre.org/techniques/T1530/) | Data from Cloud Storage Object | Collection |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.DS
+* PR.AC
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 13
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +108,10 @@ This search looks for AWS CloudTrail events where a user has created an open/pub
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_new_open_s3_buckets_over_aws_cli_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_new_open_s3_buckets_over_aws_cli_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -82,9 +138,6 @@ While this search has no known false positives, it is possible that an AWS admin
* [Suspicious AWS S3 Activities](/stories/suspicious_aws_s3_activities)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -94,13 +147,11 @@ While this search has no known false positives, it is possible that an AWS admin
| 48.0 | 60 | 80 | User $userIdentity.userName$ has created an open/public bucket $bucketName$ using AWS CLI with the following permissions - $requestParameters.accessControlList.x-amz-grant-read$ $requestParameters.accessControlList.x-amz-grant-read-acp$ $requestParameters.accessControlList.x-amz-grant-write$ $requestParameters.accessControlList.x-amz-grant-write-acp$ $requestParameters.accessControlList.x-amz-grant-full-control$ |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md b/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md
index fd4d0be075..4f2a431103 100644
--- a/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md
+++ b/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md
@@ -27,16 +27,21 @@ tags:
This search is to detect a suspicious mshta.exe process that spawn rundll32 or regsvr32 child process. This technique was seen in several malware nowadays like trickbot to load its initial .dll stage loader to execute and download the the actual trickbot payload.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-07-19
- **Author**: Teoderick Contreras, Splunk
- **ID**: 4aa5d062-e893-11eb-9eb2-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This search is to detect a suspicious mshta.exe process that spawn rundll32 or r
| [T1218.005](https://attack.mitre.org/techniques/T1218/005/) | Mshta | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,12 +107,12 @@ This search is to detect a suspicious mshta.exe process that spawn rundll32 or r
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml)
+* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `mshta_spawning_rundll32_or_regsvr32_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **mshta_spawning_rundll32_or_regsvr32_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -91,9 +141,6 @@ limitted. this anomaly behavior is not commonly seen in clean host.
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -103,8 +150,6 @@ limitted. this anomaly behavior is not commonly seen in clean host.
| 56.0 | 70 | 80 | a mshta parent process $parent_process_name$ spawn child process $process_name$ in host $dest$ |
-
-
#### Reference
* [https://twitter.com/cyb3rops/status/1416050325870587910?s=21](https://twitter.com/cyb3rops/status/1416050325870587910?s=21)
@@ -112,7 +157,7 @@ limitted. this anomaly behavior is not commonly seen in clean host.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md b/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md
index 4279e0871d..d7f05c74fb 100644
--- a/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md
+++ b/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md
@@ -27,16 +27,21 @@ tags:
this search is to detect a suspicious office product process that spawn cmd child process. This is commonly seen in a ms office product having macro to execute shell command to download or execute malicious lolbin relative to its malicious code. This is seen in trickbot spear phishing doc where it execute shell cmd to run mshta payload.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-07-19
- **Author**: Teoderick Contreras, Splunk
- **ID**: b8b19420-e892-11eb-9244-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ this search is to detect a suspicious office product process that spawn cmd chil
| [T1218.005](https://attack.mitre.org/techniques/T1218/005/) | Mshta | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -58,10 +108,10 @@ this search is to detect a suspicious office product process that spawn cmd chil
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
-Note that `office_product_spawn_cmd_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **office_product_spawn_cmd_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -88,9 +138,6 @@ IT or network admin may create an document automation that will run shell script
* [Trickbot](/stories/trickbot)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -100,8 +147,6 @@ IT or network admin may create an document automation that will run shell script
| 56.0 | 70 | 80 | an office product parent process $parent_process_name$ spawn child process $process_name$ in host $dest$ |
-
-
#### Reference
* [https://twitter.com/cyb3rops/status/1416050325870587910?s=21](https://twitter.com/cyb3rops/status/1416050325870587910?s=21)
@@ -109,7 +154,7 @@ IT or network admin may create an document automation that will run shell script
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-07-20-detect_shared_ec2_snapshot.md b/docs/_posts/2021-07-20-detect_shared_ec2_snapshot.md
index 52501d629f..a7b9c87d6f 100644
--- a/docs/_posts/2021-07-20-detect_shared_ec2_snapshot.md
+++ b/docs/_posts/2021-07-20-detect_shared_ec2_snapshot.md
@@ -23,21 +23,77 @@ tags:
The following analytic utilizes AWS CloudTrail events to identify when an EC2 snapshot permissions are modified to be shared with a different AWS account. This method is used by adversaries to exfiltrate the EC2 snapshot.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-07-20
- **Author**: Bhavin Patel, Splunk
- **ID**: 2a9b80d3-6340-4345-b5ad-290bf3d222c4
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1537](https://attack.mitre.org/techniques/T1537/) | Transfer Data to Cloud Account | Exfiltration |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.DS
+* PR.AC
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 13
+
+
+
+
+
+
+
#### Search
```
@@ -54,7 +110,7 @@ The following analytic utilizes AWS CloudTrail events to identify when an EC2 sn
The SPL above uses the following Macros:
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
-Note that `detect_shared_ec2_snapshot_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_shared_ec2_snapshot_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -78,9 +134,6 @@ It is possible that an AWS admin has legitimately shared a snapshot with others
* [Data Exfiltration](/stories/data_exfiltration)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -90,8 +143,6 @@ It is possible that an AWS admin has legitimately shared a snapshot with others
| 48.0 | 60 | 80 | AWS EC2 snapshot from account $aws_account_id$ is shared with $requested_account_id$ by user $user_arn$ from $src_ip$ |
-
-
#### Reference
* [https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/](https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/)
@@ -99,7 +150,7 @@ It is possible that an AWS admin has legitimately shared a snapshot with others
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-07-21-detect_copy_of_shadowcopy_with_script_block_logging.md b/docs/_posts/2021-07-21-detect_copy_of_shadowcopy_with_script_block_logging.md
index 487cde1de6..593f93e968 100644
--- a/docs/_posts/2021-07-21-detect_copy_of_shadowcopy_with_script_block_logging.md
+++ b/docs/_posts/2021-07-21-detect_copy_of_shadowcopy_with_script_block_logging.md
@@ -29,16 +29,21 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
This analytic identifies `copy` or `[System.IO.File]::Copy` being used to capture the SAM, SYSTEM or SECURITY hives identified in script block. This will catch the most basic use cases for credentials being taken for offline cracking. \
During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-07-21
- **Author**: Michael Haag, Splunk
- **ID**: 9251299c-ea5b-11eb-a8de-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,55 @@ During triage, review parallel processes using an EDR product or 4688 events. It
| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -58,10 +112,10 @@ During triage, review parallel processes using an EDR product or 4688 events. It
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_copy_of_shadowcopy_with_script_block_logging_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_copy_of_shadowcopy_with_script_block_logging_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -82,9 +136,6 @@ Limited false positives as the scope is limited to SAM, SYSTEM and SECURITY hive
* [Credential Dumping](/stories/credential_dumping)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -94,14 +145,6 @@ Limited false positives as the scope is limited to SAM, SYSTEM and SECURITY hive
| 80.0 | 80 | 100 | PowerShell was identified running a script to capture the SAM hive on endpoint $ComputerName$ by user $user$. |
-#### CVE
-
-| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
-| ----------- | ----------- | -------------- |
-| [CVE-2021-36934](https://nvd.nist.gov/vuln/detail/CVE-2021-36934) | Windows Elevation of Privilege Vulnerability | 4.6 |
-
-
-
#### Reference
* [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36934](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36934)
@@ -111,7 +154,7 @@ Limited false positives as the scope is limited to SAM, SYSTEM and SECURITY hive
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-07-23-sam_database_file_access_attempt.md b/docs/_posts/2021-07-23-sam_database_file_access_attempt.md
index f413d93219..c157819162 100644
--- a/docs/_posts/2021-07-23-sam_database_file_access_attempt.md
+++ b/docs/_posts/2021-07-23-sam_database_file_access_attempt.md
@@ -28,16 +28,21 @@ tags:
The following analytic identifies access to SAM, SYSTEM or SECURITY databases' within the file path of `windows\system32\config` using Windows Security EventCode 4663. This particular behavior is related to credential access, an attempt to either use a Shadow Copy or recent CVE-2021-36934 to access the SAM database. The Security Account Manager (SAM) is a database file in Windows XP, Windows Vista, Windows 7, 8.1 and 10 that stores users' passwords.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-07-23
- **Author**: Michael Haag, Mauricio Velazco, Splunk
- **ID**: 57551656-ebdb-11eb-afdf-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
+| ----------- | ----------- | -------------- |
+| [CVE-2021-36934](https://nvd.nist.gov/vuln/detail/CVE-2021-36934) | Windows Elevation of Privilege Vulnerability | 4.6 |
+
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -45,6 +50,55 @@ The following analytic identifies access to SAM, SYSTEM or SECURITY databases' w
| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,7 +111,7 @@ The following analytic identifies access to SAM, SYSTEM or SECURITY databases' w
The SPL above uses the following Macros:
* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
-Note that `sam_database_file_access_attempt_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **sam_database_file_access_attempt_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -77,9 +131,6 @@ Natively, `dllhost.exe` will access the files. Every environment will have addit
* [Credential Dumping](/stories/credential_dumping)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -89,14 +140,6 @@ Natively, `dllhost.exe` will access the files. Every environment will have addit
| 80.0 | 80 | 100 | The following process $process_name$ accessed the object $Object_Name$ attempting to gain access to credentials on $dest$ by user $user$. |
-#### CVE
-
-| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
-| ----------- | ----------- | -------------- |
-| [CVE-2021-36934](https://nvd.nist.gov/vuln/detail/CVE-2021-36934) | Windows Elevation of Privilege Vulnerability | 4.6 |
-
-
-
#### Reference
* [https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4663](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4663)
@@ -109,7 +152,7 @@ Natively, `dllhost.exe` will access the files. Every environment will have addit
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md b/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md
index 29e149415d..c56733a83c 100644
--- a/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md
+++ b/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md
@@ -25,21 +25,71 @@ tags:
This analytic identifies the suspicious Remote Thread execution of rundll32.exe process to "firefox.exe" and "chrome.exe" browser. This technique was seen in IcedID malware where it hooks the browser to parse banking information as user used the targetted browser process.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-07-26
- **Author**: Teoderick Contreras, Splunk
- **ID**: f8a22586-ee2d-11eb-a193-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
+| ----------- | ----------- | -------------- |
+| [CVE-2021-36934](https://nvd.nist.gov/vuln/detail/CVE-2021-36934) | Windows Elevation of Privilege Vulnerability | 4.6 |
+
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +102,10 @@ This analytic identifies the suspicious Remote Thread execution of rundll32.exe
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `rundll32_createremotethread_in_browser_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **rundll32_createremotethread_in_browser_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -79,9 +129,6 @@ unknown
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -91,8 +138,6 @@ unknown
| 70.0 | 70 | 100 | rundl32 process $SourceImage$ create a remote thread to browser process $TargetImage$ in host $Computer$ |
-
-
#### Reference
* [https://www.joesandbox.com/analysis/380662/0/html](https://www.joesandbox.com/analysis/380662/0/html)
@@ -100,7 +145,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md b/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md
index ff94b3dc3e..dc22f72471 100644
--- a/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md
+++ b/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md
@@ -27,16 +27,21 @@ tags:
This search is to detect a suspicious rundll32 process that drops executable (.exe or .dll) files. this behavior seen in rundll32 process of IcedID that tries to drop copy of itself in temp folder or download executable drop it either appdata or programdata as part of its execution.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-07-26
- **Author**: Teoderick Contreras, Splunk
- **ID**: 6338266a-ee2a-11eb-bf68-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This search is to detect a suspicious rundll32 process that drops executable (.e
| [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -56,10 +106,10 @@ This search is to detect a suspicious rundll32 process that drops executable (.e
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `rundll32_process_creating_exe_dll_files_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **rundll32_process_creating_exe_dll_files_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -81,9 +131,6 @@ unknown
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -93,8 +140,6 @@ unknown
| 80.0 | 80 | 100 | rundll32 process $process_name$ drops a file $TargetFilename$ in host $dest$ |
-
-
#### Reference
* [https://any.run/malware-trends/icedid](https://any.run/malware-trends/icedid)
@@ -102,7 +147,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md b/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md
index 69a69c08d7..99dd65d479 100644
--- a/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md
+++ b/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md
@@ -27,16 +27,21 @@ tags:
This search is to detect a suspicious rundll32.exe commandline to execute dll file. This technique was seen in IcedID malware to load its payload dll with the following parameter to load encrypted dll payload which is the license.dat.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-07-26
- **Author**: Teoderick Contreras, Splunk
- **ID**: bed761f8-ee29-11eb-8bf3-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This search is to detect a suspicious rundll32.exe commandline to execute dll fi
| [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,11 +107,11 @@ This search is to detect a suspicious rundll32.exe commandline to execute dll fi
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `suspicious_icedid_rundll32_cmdline_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **suspicious_icedid_rundll32_cmdline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -89,9 +139,6 @@ limitted. this parameter is not commonly used by windows application but can be
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -101,8 +148,6 @@ limitted. this parameter is not commonly used by windows application but can be
| 56.0 | 70 | 80 | rundll32 process $process_name$ with commandline $process$ in host $dest$ |
-
-
#### Reference
* [https://threatpost.com/icedid-banking-trojan-surges-emotet/165314/](https://threatpost.com/icedid-banking-trojan-surges-emotet/165314/)
@@ -110,7 +155,7 @@ limitted. this parameter is not commonly used by windows application but can be
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md b/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md
index 0305b9bcc7..b4917c9792 100644
--- a/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md
+++ b/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md
@@ -27,16 +27,21 @@ tags:
This search is to detect a suspicious rundll32.exe process with plugininit parameter. This technique is commonly seen in IceID malware to execute its initial dll stager to download another payload to the compromised machine.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-07-26
- **Author**: Teoderick Contreras, Splunk
- **ID**: 92d51712-ee29-11eb-b1ae-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This search is to detect a suspicious rundll32.exe process with plugininit param
| [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,11 +107,11 @@ This search is to detect a suspicious rundll32.exe process with plugininit param
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `suspicious_rundll32_plugininit_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **suspicious_rundll32_plugininit_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -88,9 +138,6 @@ third party application may used this dll export name to execute function.
* [IcedID](/stories/icedid)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -100,8 +147,6 @@ third party application may used this dll export name to execute function.
| 42.0 | 60 | 70 | rundll32 process $process_name$ with commandline $process$ in host $dest$ |
-
-
#### Reference
* [https://threatpost.com/icedid-banking-trojan-surges-emotet/165314/](https://threatpost.com/icedid-banking-trojan-surges-emotet/165314/)
@@ -109,7 +154,7 @@ third party application may used this dll export name to execute function.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-07-27-chcp_command_execution.md b/docs/_posts/2021-07-27-chcp_command_execution.md
index a70078c3a7..fced024e03 100644
--- a/docs/_posts/2021-07-27-chcp_command_execution.md
+++ b/docs/_posts/2021-07-27-chcp_command_execution.md
@@ -24,21 +24,71 @@ tags:
This search is to detect execution of chcp.exe application. this utility is used to change the active code page of the console. This technique was seen in icedid malware to know the locale region/language/country of the compromise host.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-07-27
- **Author**: Teoderick Contreras, Splunk
- **ID**: 21d236ec-eec1-11eb-b23e-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +102,10 @@ This search is to detect execution of chcp.exe application. this utility is used
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `chcp_command_execution_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **chcp_command_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -79,9 +129,6 @@ other tools or script may used this to change code page to UTF-* or others
* [IcedID](/stories/icedid)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -91,8 +138,6 @@ other tools or script may used this to change code page to UTF-* or others
| 9.0 | 30 | 30 | parent process $parent_process_name$ spawning chcp process $process_name$ with parent command line $parent_process$ |
-
-
#### Reference
* [https://ss64.com/nt/chcp.html](https://ss64.com/nt/chcp.html)
@@ -101,7 +146,7 @@ other tools or script may used this to change code page to UTF-* or others
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md b/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md
index dd9792fbb3..0cc35633a2 100644
--- a/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md
+++ b/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md
@@ -27,16 +27,21 @@ tags:
The following analytic identifies Regsvr32.exe utilizing the silent switch to load DLLs. This technique has most recently been seen in IcedID campaigns to load its initial dll that will download the 2nd stage loader that will download and decrypt the config payload. The switch type may be either a hyphen `-` or forward slash `/`. This behavior is typically found with `-s`, and it is possible there are more switch types that may be used. \ During triage, review parallel processes and capture any artifacts that may have landed on disk. Isolate and contain the endpoint as necessary.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-07-27
- **Author**: Teoderick Contreras, Splunk
- **ID**: c9ef7dc4-eeaf-11eb-b2b6-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ The following analytic identifies Regsvr32.exe utilizing the silent switch to lo
| [T1218.010](https://attack.mitre.org/techniques/T1218/010/) | Regsvr32 | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -59,11 +109,11 @@ The following analytic identifies Regsvr32.exe utilizing the silent switch to lo
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `regsvr32_with_known_silent_switch_cmdline_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **regsvr32_with_known_silent_switch_cmdline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -93,9 +143,6 @@ minimal. but network operator can use this application to load dll.
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -105,8 +152,6 @@ minimal. but network operator can use this application to load dll.
| 56.0 | 70 | 80 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to load a DLL using the silent parameter. |
-
-
#### Reference
* [https://app.any.run/tasks/56680cba-2bbc-4b34-8633-5f7878ddf858/](https://app.any.run/tasks/56680cba-2bbc-4b34-8633-5f7878ddf858/)
@@ -115,7 +160,7 @@ minimal. but network operator can use this application to load dll.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md b/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md
index 8bed0ef8ce..537bb14e8d 100644
--- a/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md
+++ b/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md
@@ -25,21 +25,71 @@ tags:
This analytic identifies the suspicious Remote Thread execution of rundll32.exe process to cmd.exe process. This technique was seen in IcedID malware to execute its malicious code in normal process for defense evasion and to steal sensitive information the the compromised host. browser process.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-07-29
- **Author**: Teoderick Contreras, Splunk
- **ID**: 2dbeee3a-f067-11eb-96c0-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +102,10 @@ This analytic identifies the suspicious Remote Thread execution of rundll32.exe
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `rundll32_create_remote_thread_to_a_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **rundll32_create_remote_thread_to_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -79,9 +129,6 @@ unknown
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -91,8 +138,6 @@ unknown
| 56.0 | 70 | 80 | rundl32 process $SourceImage$ create a remote thread to process $TargetImage$ in host $Computer$ |
-
-
#### Reference
* [https://www.joesandbox.com/analysis/380662/0/html](https://www.joesandbox.com/analysis/380662/0/html)
@@ -100,7 +145,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-07-30-drop_icedid_license_dat.md b/docs/_posts/2021-07-30-drop_icedid_license_dat.md
index f3aa909358..dab7ce0922 100644
--- a/docs/_posts/2021-07-30-drop_icedid_license_dat.md
+++ b/docs/_posts/2021-07-30-drop_icedid_license_dat.md
@@ -27,16 +27,21 @@ tags:
This search is to detect dropping a suspicious file named as "license.dat" in %appdata%. This behavior seen in latest IcedID malware that contain the actual core bot that will be injected in other process to do banking stealing.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-07-30
- **Author**: Teoderick Contreras, Splunk
- **ID**: b7a045fc-f14a-11eb-8e79-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This search is to detect dropping a suspicious file named as "license.dat" in %a
| [T1204.002](https://attack.mitre.org/techniques/T1204/002/) | Malicious File | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -56,10 +106,10 @@ This search is to detect dropping a suspicious file named as "license.dat" in %a
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `drop_icedid_license_dat_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **drop_icedid_license_dat_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -75,9 +125,6 @@ unknown
* [IcedID](/stories/icedid)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -87,8 +134,6 @@ unknown
| 63.0 | 70 | 90 | process $SourceImage$ create a file $TargetImage$ in host $Computer$ |
-
-
#### Reference
* [https://www.cisecurity.org/white-papers/security-primer-icedid/](https://www.cisecurity.org/white-papers/security-primer-icedid/)
@@ -96,7 +141,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md b/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md
index 73edb54ec4..74c84eaf29 100644
--- a/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md
+++ b/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md
@@ -27,16 +27,21 @@ tags:
This search is to detect a suspicious file creation namely passff.tar and cookie.tar. This files are possible archived of stolen browser information like history and cookies in a compromised machine with IcedID.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-07-30
- **Author**: Teoderick Contreras, Splunk
- **ID**: 0db4da70-f14b-11eb-8043-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This search is to detect a suspicious file creation namely passff.tar and cookie
| [T1560](https://attack.mitre.org/techniques/T1560/) | Archive Collected Data | Collection |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -56,10 +106,10 @@ This search is to detect a suspicious file creation namely passff.tar and cookie
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `icedid_exfiltrated_archived_file_creation_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **icedid_exfiltrated_archived_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -80,9 +130,6 @@ unknown
* [IcedID](/stories/icedid)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -92,8 +139,6 @@ unknown
| 72.0 | 80 | 90 | process $SourceImage$ create a file $TargetImage$ in host $Computer$ |
-
-
#### Reference
* [https://www.cisecurity.org/white-papers/security-primer-icedid/](https://www.cisecurity.org/white-papers/security-primer-icedid/)
@@ -101,7 +146,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md b/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md
index 5e00712141..64bc66ec43 100644
--- a/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md
+++ b/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md
@@ -27,16 +27,21 @@ tags:
this detection was designed to identifies suspicious spawned process of known MS office application due to macro or malicious code. this technique can be seen in so many malware like IcedID that used MS office as its weapon or attack vector to initially infect the machines.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-07-30
- **Author**: Teoderick Contreras, Splunk
- **ID**: 2d9fc90c-f11f-11eb-9300-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ this detection was designed to identifies suspicious spawned process of known MS
| [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,11 +107,11 @@ this detection was designed to identifies suspicious spawned process of known MS
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `office_application_spawn_regsvr32_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **office_application_spawn_regsvr32_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -88,9 +138,6 @@ unknown
* [IcedID](/stories/icedid)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -100,8 +147,6 @@ unknown
| 63.0 | 70 | 90 | Office application spawning regsvr32.exe on $dest$ |
-
-
#### Reference
* [https://www.joesandbox.com/analysis/380662/0/html](https://www.joesandbox.com/analysis/380662/0/html)
@@ -109,7 +154,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md b/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md
index d4709062ea..8af853fd04 100644
--- a/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md
+++ b/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md
@@ -24,21 +24,71 @@ tags:
This search is to detect a suspicious file creation of sqlite3.dll in %temp% folder. This behavior was seen in IcedID malware where it download sqlite module to parse browser database like for chrome or firefox to stole browser information related to bank, credit card or credentials.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-08-03
- **Author**: Teoderick Contreras, Splunk
- **ID**: 0f216a38-f45f-11eb-b09c-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1005](https://attack.mitre.org/techniques/T1005/) | Data from Local System | Collection |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -51,10 +101,10 @@ This search is to detect a suspicious file creation of sqlite3.dll in %temp% fol
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `sqlite_module_in_temp_folder_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **sqlite_module_in_temp_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -75,9 +125,6 @@ unknown
* [IcedID](/stories/icedid)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -87,8 +134,6 @@ unknown
| 9.0 | 30 | 30 | process $SourceImage$ create a file $TargetImage$ in host $Computer$ |
-
-
#### Reference
* [https://www.cisecurity.org/white-papers/security-primer-icedid/](https://www.cisecurity.org/white-papers/security-primer-icedid/)
@@ -96,7 +141,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md b/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md
index 57e51ae7aa..0b9dd66eb8 100644
--- a/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md
+++ b/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md
@@ -25,21 +25,71 @@ tags:
This search is to detect suspicious process injection in command shell. This technique was seen in IcedID where it execute cmd.exe process to inject its shellcode as part of its execution as banking trojan. It is really uncommon to have a create remote thread execution in the following application.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-08-04
- **Author**: Teoderick Contreras, Splunk
- **ID**: 10399c1e-f51e-11eb-b920-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +102,10 @@ This search is to detect suspicious process injection in command shell. This tec
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `create_remote_thread_in_shell_application_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **create_remote_thread_in_shell_application_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -78,9 +128,6 @@ unknown
* [IcedID](/stories/icedid)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -90,8 +137,6 @@ unknown
| 70.0 | 70 | 100 | process $SourceImage$ create a remote thread to shell app process $TargetImage$ in host $Computer$ |
-
-
#### Reference
* [https://thedfirreport.com/2021/07/19/icedid-and-cobalt-strike-vs-antivirus/](https://thedfirreport.com/2021/07/19/icedid-and-cobalt-strike-vs-antivirus/)
@@ -99,7 +144,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-09-uninstall_app_using_msiexec.md b/docs/_posts/2021-08-09-uninstall_app_using_msiexec.md
index 44592607d6..7d70e2753c 100644
--- a/docs/_posts/2021-08-09-uninstall_app_using_msiexec.md
+++ b/docs/_posts/2021-08-09-uninstall_app_using_msiexec.md
@@ -27,16 +27,21 @@ tags:
This search is to detect a suspicious un-installation of application using msiexec. This technique was seen in conti leak tool and script where it tries to uninstall AV product using this commandline. This commandline to uninstall product is not a common practice in enterprise network.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-08-09
- **Author**: Teoderick Contreras, Splunk
- **ID**: 1fca2b28-f922-11eb-b2dd-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This search is to detect a suspicious un-installation of application using msiex
| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +107,10 @@ This search is to detect a suspicious un-installation of application using msiex
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `uninstall_app_using_msiexec_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **uninstall_app_using_msiexec_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +134,6 @@ unknown.
* [Ransomware](/stories/ransomware)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -96,8 +143,6 @@ unknown.
| 30.0 | 50 | 60 | process $process_name$ with a cmdline $process$ in host $dest$ |
-
-
#### Reference
* [https://threadreaderapp.com/thread/1423361119926816776.html](https://threadreaderapp.com/thread/1423361119926816776.html)
@@ -105,7 +150,7 @@ unknown.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-10-powershell_execute_com_object.md b/docs/_posts/2021-08-10-powershell_execute_com_object.md
index 36b81497a0..53e2481c1d 100644
--- a/docs/_posts/2021-08-10-powershell_execute_com_object.md
+++ b/docs/_posts/2021-08-10-powershell_execute_com_object.md
@@ -29,16 +29,21 @@ tags:
This search is to detect a COM CLSID execution through powershell. This technique was seen in several adversaries and malware like ransomware conti where it has a feature to execute command using COM Object. This technique may use by network operator at some cases but a good indicator if some application want to gain privilege escalation or bypass uac.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-08-10
- **Author**: Teoderick Contreras, Splunk
- **ID**: 65711630-f9bf-11eb-8d72-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,51 @@ This search is to detect a COM CLSID execution through powershell. This techniqu
| [T1546](https://attack.mitre.org/techniques/T1546/) | Event Triggered Execution | Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -58,10 +108,10 @@ This search is to detect a COM CLSID execution through powershell. This techniqu
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `powershell_execute_com_object_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **powershell_execute_com_object_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -78,9 +128,6 @@ network operrator may use this command.
* [Ransomware](/stories/ransomware)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -90,8 +137,6 @@ network operrator may use this command.
| 5.0 | 10 | 50 | A suspicious powershell script contains COM CLSID command in $Message$ with EventCode $EventCode$ in host $ComputerName$ |
-
-
#### Reference
* [https://threadreaderapp.com/thread/1423361119926816776.html](https://threadreaderapp.com/thread/1423361119926816776.html)
@@ -99,7 +144,7 @@ network operrator may use this command.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-11-fsutil_zeroing_file.md b/docs/_posts/2021-08-11-fsutil_zeroing_file.md
index b438c86f07..f4d554b272 100644
--- a/docs/_posts/2021-08-11-fsutil_zeroing_file.md
+++ b/docs/_posts/2021-08-11-fsutil_zeroing_file.md
@@ -24,21 +24,71 @@ tags:
This search is to detect a suspicious fsutil process to zeroing a target file. This technique was seen in lockbit ransomware where it tries to zero out its malware path as part of its defense evasion after encrypting the compromised host.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-08-11
- **Author**: Teoderick Contreras, Splunk
- **ID**: 4e5e024e-fabb-11eb-8b8f-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1070](https://attack.mitre.org/techniques/T1070/) | Indicator Removal on Host | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +102,10 @@ This search is to detect a suspicious fsutil process to zeroing a target file. T
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `fsutil_zeroing_file_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **fsutil_zeroing_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -77,9 +127,6 @@ unknown
* [Ransomware](/stories/ransomware)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -89,8 +136,6 @@ unknown
| 54.0 | 60 | 90 | Possible file data deletion on $dest$ using $process$ |
-
-
#### Reference
* [https://app.any.run/tasks/e0ac072d-58c9-4f53-8a3b-3e491c7ac5db/](https://app.any.run/tasks/e0ac072d-58c9-4f53-8a3b-3e491c7ac5db/)
@@ -98,7 +143,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md b/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md
index b49979b3c1..6b4f16d95a 100644
--- a/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md
+++ b/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md
@@ -27,16 +27,21 @@ tags:
This search is to detect a possible uac bypass using the colorui.dll COM Object. this technique was seen in so many malware and ransomware like lockbit where it make use of the colorui.dll COM CLSID to bypass UAC.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-08-13
- **Author**: Teoderick Contreras, Splunk
- **ID**: 2bcccd20-fc2b-11eb-8d22-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This search is to detect a possible uac bypass using the colorui.dll COM Object.
| [T1218.003](https://attack.mitre.org/techniques/T1218/003/) | CMSTP | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -56,10 +106,10 @@ This search is to detect a possible uac bypass using the colorui.dll COM Object.
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `uac_bypass_with_colorui_com_object_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **uac_bypass_with_colorui_com_object_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -82,9 +132,6 @@ not so common. but 3rd part app may load this dll.
* [Ransomware](/stories/ransomware)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -94,8 +141,6 @@ not so common. but 3rd part app may load this dll.
| 48.0 | 60 | 80 | The following module $ImageLoaded$ was loaded by a non-standard application on endpoint $Computer$ by user $user$. |
-
-
#### Reference
* [https://news.sophos.com/en-us/2020/04/24/lockbit-ransomware-borrows-tricks-to-keep-up-with-revil-and-maze/](https://news.sophos.com/en-us/2020/04/24/lockbit-ransomware-borrows-tricks-to-keep-up-with-revil-and-maze/)
@@ -103,7 +148,7 @@ not so common. but 3rd part app may load this dll.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-16-gsuite_drive_share_in_external_email.md b/docs/_posts/2021-08-16-gsuite_drive_share_in_external_email.md
index e83e92c30e..13226cb1c5 100644
--- a/docs/_posts/2021-08-16-gsuite_drive_share_in_external_email.md
+++ b/docs/_posts/2021-08-16-gsuite_drive_share_in_external_email.md
@@ -26,16 +26,21 @@ tags:
This search is to detect suspicious google drive or google docs files shared outside or externally. This behavior might be a good hunting query to monitor exfitration of data made by an attacker or insider to a targetted machine.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-08-16
- **Author**: Teoderick Contreras, Splunk
- **ID**: f6ee02d6-fea0-11eb-b2c2-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,51 @@ This search is to detect suspicious google drive or google docs files shared out
| [T1567](https://attack.mitre.org/techniques/T1567/) | Exfiltration Over Web Service | Exfiltration |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -61,10 +111,10 @@ This search is to detect suspicious google drive or google docs files shared out
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [gsuite_drive](https://github.com/splunk/security_content/blob/develop/macros/gsuite_drive.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `gsuite_drive_share_in_external_email_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **gsuite_drive_share_in_external_email_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -87,9 +137,6 @@ network admin or normal user may share files to customer and external team.
* [Dev Sec Ops](/stories/dev_sec_ops)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -99,8 +146,6 @@ network admin or normal user may share files to customer and external team.
| 72.0 | 80 | 90 | suspicious share gdrive from $parameters.owner$ to $email$ namely as $parameters.doc_title$ |
-
-
#### Reference
* [https://www.redhat.com/en/topics/devops/what-is-devsecops](https://www.redhat.com/en/topics/devops/what-is-devsecops)
@@ -108,7 +153,7 @@ network admin or normal user may share files to customer and external team.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-16-gsuite_email_suspicious_attachment.md b/docs/_posts/2021-08-16-gsuite_email_suspicious_attachment.md
index c15386382d..5f10c86d78 100644
--- a/docs/_posts/2021-08-16-gsuite_email_suspicious_attachment.md
+++ b/docs/_posts/2021-08-16-gsuite_email_suspicious_attachment.md
@@ -26,16 +26,21 @@ tags:
This search is to detect a suspicious attachment file extension in Gsuite email that may related to spear phishing attack. This file type is commonly used by malware to lure user to click on it to execute malicious code to compromised targetted machine. But this search can also catch some normal files related to this file type that maybe send by employee or network admin.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-08-16
- **Author**: Teoderick Contreras, Splunk
- **ID**: 6d663014-fe92-11eb-ab07-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,51 @@ This search is to detect a suspicious attachment file extension in Gsuite email
| [T1566](https://attack.mitre.org/techniques/T1566/) | Phishing | Initial Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -60,7 +110,7 @@ The SPL above uses the following Macros:
* [gsuite_gmail](https://github.com/splunk/security_content/blob/develop/macros/gsuite_gmail.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `gsuite_email_suspicious_attachment_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **gsuite_email_suspicious_attachment_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +134,6 @@ network admin and normal user may send this file attachment as part of their day
* [Dev Sec Ops](/stories/dev_sec_ops)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -96,8 +143,6 @@ network admin and normal user may send this file attachment as part of their day
| 49.0 | 70 | 70 | suspicious email from $source.address$ to $destination{}.address$ |
-
-
#### Reference
* [https://www.redhat.com/en/topics/devops/what-is-devsecops](https://www.redhat.com/en/topics/devops/what-is-devsecops)
@@ -105,7 +150,7 @@ network admin and normal user may send this file attachment as part of their day
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-17-7zip_commandline_to_smb_share_path.md b/docs/_posts/2021-08-17-7zip_commandline_to_smb_share_path.md
index 4460b9bbea..d609a050de 100644
--- a/docs/_posts/2021-08-17-7zip_commandline_to_smb_share_path.md
+++ b/docs/_posts/2021-08-17-7zip_commandline_to_smb_share_path.md
@@ -27,16 +27,21 @@ tags:
This search is to detect a suspicious 7z process with commandline pointing to SMB network share. This technique was seen in CONTI LEAK tools where it use 7z to archive a sensitive files and place it in network share tmp folder. This search is a good hunting query that may give analyst a hint why specific user try to archive a file pointing to SMB user which is un usual.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-08-17
- **Author**: Teoderick Contreras, Splunk
- **ID**: 01d29b48-ff6f-11eb-b81e-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This search is to detect a suspicious 7z process with commandline pointing to SM
| [T1560](https://attack.mitre.org/techniques/T1560/) | Archive Collected Data | Collection |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +107,10 @@ This search is to detect a suspicious 7z process with commandline pointing to SM
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `7zip_commandline_to_smb_share_path_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **7zip_commandline_to_smb_share_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +134,6 @@ unknown
* [Ransomware](/stories/ransomware)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -96,8 +143,6 @@ unknown
| 25.0 | 50 | 50 | archive process $process_name$ with suspicious cmdline $process$ in host $dest$ |
-
-
#### Reference
* [https://threadreaderapp.com/thread/1423361119926816776.html](https://threadreaderapp.com/thread/1423361119926816776.html)
@@ -105,7 +150,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_high.md b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_high.md
index 6534106970..2ee0d5fd8a 100644
--- a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_high.md
+++ b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_high.md
@@ -26,16 +26,21 @@ tags:
This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-08-17
- **Author**: Patrick Bareiss, Splunk
- **ID**: 62721bd2-1d82-4623-b6e6-aac170014423
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,57 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service (
| [T1204](https://attack.mitre.org/techniques/T1204/) | User Execution | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.DS
+* PR.AC
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 13
+
+
+
+
+
+
+
#### Search
```
@@ -63,10 +119,10 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service (
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `aws_ecr_container_scanning_findings_high_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **aws_ecr_container_scanning_findings_high_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* eventSource
@@ -90,9 +146,6 @@ unknown
* [Dev Sec Ops](/stories/dev_sec_ops)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -102,8 +155,6 @@ unknown
| 70.0 | 70 | 100 | Vulnerabilities with severity high found in image $image$ |
-
-
#### Reference
* [https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html](https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html)
@@ -111,7 +162,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_low_informational_unknown.md b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_low_informational_unknown.md
index a1f5018c4f..0778c43a9f 100644
--- a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_low_informational_unknown.md
+++ b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_low_informational_unknown.md
@@ -26,16 +26,21 @@ tags:
This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-08-17
- **Author**: Patrick Bareiss, Splunk
- **ID**: cbc95e44-7c22-443f-88fd-0424478f5589
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,57 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service (
| [T1204](https://attack.mitre.org/techniques/T1204/) | User Execution | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.DS
+* PR.AC
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 13
+
+
+
+
+
+
+
#### Search
```
@@ -63,10 +119,10 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service (
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `aws_ecr_container_scanning_findings_low_informational_unknown_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **aws_ecr_container_scanning_findings_low_informational_unknown_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* eventSource
@@ -90,9 +146,6 @@ unknown
* [Dev Sec Ops](/stories/dev_sec_ops)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -102,8 +155,6 @@ unknown
| 7.0 | 10 | 70 | Vulnerabilities with severity high found in repository $repositoryName$ |
-
-
#### Reference
* [https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html](https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html)
@@ -111,7 +162,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_medium.md b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_medium.md
index 41416c92f7..58d17ed3e6 100644
--- a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_medium.md
+++ b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_medium.md
@@ -26,16 +26,21 @@ tags:
This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-08-17
- **Author**: Patrick Bareiss, Splunk
- **ID**: 0b80e2c8-c746-4ddb-89eb-9efd892220cf
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,57 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service (
| [T1204](https://attack.mitre.org/techniques/T1204/) | User Execution | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.DS
+* PR.AC
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 13
+
+
+
+
+
+
+
#### Search
```
@@ -63,10 +119,10 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service (
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `aws_ecr_container_scanning_findings_medium_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **aws_ecr_container_scanning_findings_medium_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* eventSource
@@ -90,9 +146,6 @@ unknown
* [Dev Sec Ops](/stories/dev_sec_ops)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -102,8 +155,6 @@ unknown
| 21.0 | 30 | 70 | Vulnerabilities with severity high found in image $image$ |
-
-
#### Reference
* [https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html](https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html)
@@ -111,7 +162,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-17-gsuite_outbound_email_with_attachment_to_external_domain.md b/docs/_posts/2021-08-17-gsuite_outbound_email_with_attachment_to_external_domain.md
index dfa012c197..821666721c 100644
--- a/docs/_posts/2021-08-17-gsuite_outbound_email_with_attachment_to_external_domain.md
+++ b/docs/_posts/2021-08-17-gsuite_outbound_email_with_attachment_to_external_domain.md
@@ -26,16 +26,21 @@ tags:
This search is to detect a suspicious outbound e-mail from internal email to external email domain. This can be a good hunting query to monitor insider or outbound email traffic for not common domain e-mail. The idea is to parse the domain of destination email check if there is a minimum outbound traffic < 20 with attachment.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-08-17
- **Author**: Teoderick Contreras, Stanislav Miskovic, Splunk
- **ID**: dc4dc3a8-ff54-11eb-8bf7-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,51 @@ This search is to detect a suspicious outbound e-mail from internal email to ext
| [T1048](https://attack.mitre.org/techniques/T1048/) | Exfiltration Over Alternative Protocol | Exfiltration |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -65,7 +115,7 @@ The SPL above uses the following Macros:
* [gsuite_gmail](https://github.com/splunk/security_content/blob/develop/macros/gsuite_gmail.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `gsuite_outbound_email_with_attachment_to_external_domain_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **gsuite_outbound_email_with_attachment_to_external_domain_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -81,9 +131,6 @@ network admin and normal user may send this file attachment as part of their day
* [Dev Sec Ops](/stories/dev_sec_ops)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -93,8 +140,6 @@ network admin and normal user may send this file attachment as part of their day
| 9.0 | 30 | 30 | suspicious email from $source.address$ to $destination{}.address$ |
-
-
#### Reference
* [https://www.redhat.com/en/topics/devops/what-is-devsecops](https://www.redhat.com/en/topics/devops/what-is-devsecops)
@@ -102,7 +147,7 @@ network admin and normal user may send this file attachment as part of their day
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-18-esentutl_sam_copy.md b/docs/_posts/2021-08-18-esentutl_sam_copy.md
index d7a34ed1dd..c7396f3f5e 100644
--- a/docs/_posts/2021-08-18-esentutl_sam_copy.md
+++ b/docs/_posts/2021-08-18-esentutl_sam_copy.md
@@ -27,16 +27,21 @@ tags:
The following analytic identifies the process - `esentutl.exe` - being used to capture credentials stored in ntds.dit or the SAM file on disk. During triage, review parallel processes and determine if legitimate activity. Upon determination of illegitimate activity, take further action to isolate and contain the threat.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-08-18
- **Author**: Michael Haag, Splunk
- **ID**: d372f928-ce4f-11eb-a762-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ The following analytic identifies the process - `esentutl.exe` - being used to c
| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -58,10 +108,10 @@ The following analytic identifies the process - `esentutl.exe` - being used to c
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [process_esentutl](https://github.com/splunk/security_content/blob/develop/macros/process_esentutl.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [process_esentutl](https://github.com/splunk/security_content/blob/develop/macros/process_esentutl.yml)
-Note that `esentutl_sam_copy_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **esentutl_sam_copy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -89,9 +139,6 @@ False positives should be limited. Filter as needed.
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -101,8 +148,6 @@ False positives should be limited. Filter as needed.
| 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user user$ attempting to capture credentials for offline cracking or observability. |
-
-
#### Reference
* [https://github.com/redcanaryco/atomic-red-team/blob/6a570c2a4630cf0c2bd41a2e8375b5d5ab92f700/atomics/T1003.002/T1003.002.md](https://github.com/redcanaryco/atomic-red-team/blob/6a570c2a4630cf0c2bd41a2e8375b5d5ab92f700/atomics/T1003.002/T1003.002.md)
@@ -111,7 +156,7 @@ False positives should be limited. Filter as needed.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-18-powershell_4104_hunting.md b/docs/_posts/2021-08-18-powershell_4104_hunting.md
index 6498c46a10..7b4df0e9af 100644
--- a/docs/_posts/2021-08-18-powershell_4104_hunting.md
+++ b/docs/_posts/2021-08-18-powershell_4104_hunting.md
@@ -26,16 +26,21 @@ tags:
The following Hunting analytic assists with identifying suspicious PowerShell execution using Script Block Logging, or EventCode 4104. This analytic is not meant to be ran hourly, but occasionally to identify malicious or suspicious PowerShell. This analytic is a combination of work completed by Alex Teixeira and Splunk Threat Research Team.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-08-18
- **Author**: Michael Haag, Splunk
- **ID**: d6f2b006-0041-11ec-8885-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,51 @@ The following Hunting analytic assists with identifying suspicious PowerShell ex
| [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -231,7 +281,7 @@ The following Hunting analytic assists with identifying suspicious PowerShell ex
The SPL above uses the following Macros:
* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
-Note that `powershell_4104_hunting_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **powershell_4104_hunting_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -248,9 +298,6 @@ Limited false positives. May filter as needed.
* [Malicious PowerShell](/stories/malicious_powershell)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -260,8 +307,6 @@ Limited false positives. May filter as needed.
| 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ executing suspicious commands. |
-
-
#### Reference
* [https://github.com/inodee/threathunting-spl/blob/master/hunt-queries/powershell_qualifiers.md](https://github.com/inodee/threathunting-spl/blob/master/hunt-queries/powershell_qualifiers.md)
@@ -275,7 +320,7 @@ Limited false positives. May filter as needed.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-19-aws_ecr_container_upload_outside_business_hours.md b/docs/_posts/2021-08-19-aws_ecr_container_upload_outside_business_hours.md
index 0909632f37..7707095da2 100644
--- a/docs/_posts/2021-08-19-aws_ecr_container_upload_outside_business_hours.md
+++ b/docs/_posts/2021-08-19-aws_ecr_container_upload_outside_business_hours.md
@@ -26,16 +26,21 @@ tags:
This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). A upload of a new container is normally done during business hours. When done outside business hours, we want to take a look into it.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-08-19
- **Author**: Patrick Bareiss, Splunk
- **ID**: d4c4d4eb-3994-41ca-a25e-a82d64e125bb
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,57 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service (
| [T1204](https://attack.mitre.org/techniques/T1204/) | User Execution | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.DS
+* PR.AC
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 13
+
+
+
+
+
+
+
#### Search
```
@@ -59,10 +115,10 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service (
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `aws_ecr_container_upload_outside_business_hours_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **aws_ecr_container_upload_outside_business_hours_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* eventSource
@@ -86,9 +142,6 @@ When your development is spreaded in different time zones, applying this rule ca
* [Dev Sec Ops](/stories/dev_sec_ops)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -98,8 +151,6 @@ When your development is spreaded in different time zones, applying this rule ca
| 49.0 | 70 | 70 | Container uploaded outside business hours from $user$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1204/003/](https://attack.mitre.org/techniques/T1204/003/)
@@ -107,7 +158,7 @@ When your development is spreaded in different time zones, applying this rule ca
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md b/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md
index e8f5ed8a32..94c73a8cc5 100644
--- a/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md
+++ b/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md
@@ -26,16 +26,21 @@ tags:
This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). A upload of a new container is normally done from only a few known users. When the user was never seen before, we should have a closer look into the event.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-08-19
- **Author**: Patrick Bareiss, Splunk
- **ID**: 300688e4-365c-4486-a065-7c884462b31d
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,57 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service (
| [T1204](https://attack.mitre.org/techniques/T1204/) | User Execution | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.DS
+* PR.AC
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 13
+
+
+
+
+
+
+
#### Search
```
@@ -59,11 +115,11 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service (
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
* [aws_ecr_users](https://github.com/splunk/security_content/blob/develop/macros/aws_ecr_users.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `aws_ecr_container_upload_unknown_user_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **aws_ecr_container_upload_unknown_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* eventSource
@@ -87,9 +143,6 @@ unknown
* [Dev Sec Ops](/stories/dev_sec_ops)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -99,8 +152,6 @@ unknown
| 49.0 | 70 | 70 | Container uploaded from unknown user $user$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1204/003/](https://attack.mitre.org/techniques/T1204/003/)
@@ -108,7 +159,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-19-gsuite_email_suspicious_subject_with_attachment.md b/docs/_posts/2021-08-19-gsuite_email_suspicious_subject_with_attachment.md
index f92618a42f..17d48e69de 100644
--- a/docs/_posts/2021-08-19-gsuite_email_suspicious_subject_with_attachment.md
+++ b/docs/_posts/2021-08-19-gsuite_email_suspicious_subject_with_attachment.md
@@ -26,16 +26,21 @@ tags:
This search is to detect a gsuite email contains suspicious subject having known file type used in spear phishing. This technique is a common and effective entry vector of attacker to compromise a network by luring the user to click or execute the suspicious attachment send from external email account because of the effective social engineering of subject related to delivery, bank and so on. On the other hand this detection may catch a normal email traffic related to legitimate transaction so better to check the email sender, spelling and etc. avoid click link or opening the attachment if you are not expecting this type of e-mail.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-08-19
- **Author**: Teoderick Contreras, Splunk
- **ID**: 8ef3971e-00f2-11ec-b54f-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,51 @@ This search is to detect a gsuite email contains suspicious subject having known
| [T1566](https://attack.mitre.org/techniques/T1566/) | Phishing | Initial Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -63,7 +113,7 @@ The SPL above uses the following Macros:
* [gsuite_gmail](https://github.com/splunk/security_content/blob/develop/macros/gsuite_gmail.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `gsuite_email_suspicious_subject_with_attachment_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **gsuite_email_suspicious_subject_with_attachment_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -79,9 +129,6 @@ normal user or normal transaction may contain the subject and file type attachme
* [Dev Sec Ops](/stories/dev_sec_ops)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -91,8 +138,6 @@ normal user or normal transaction may contain the subject and file type attachme
| 25.0 | 50 | 50 | suspicious email from $source.address$ to $destination{}.address$ |
-
-
#### Reference
* [https://www.redhat.com/en/topics/devops/what-is-devsecops](https://www.redhat.com/en/topics/devops/what-is-devsecops)
@@ -101,7 +146,7 @@ normal user or normal transaction may contain the subject and file type attachme
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md b/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md
index f7af144dd3..792c4cde1e 100644
--- a/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md
+++ b/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md
@@ -23,14 +23,75 @@ We have not been able to test, simulate, or build datasets for this object. Use
The following analytic identifies cleartext protocols at risk of leaking sensitive information. Currently, this consists of legacy protocols such as telnet (port 23), POP3 (port 110), IMAP (port 143), and non-anonymous FTP (port 21) sessions. While some of these protocols may be used over SSL, they typically are found on different assigned ports in those instances.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic)
-
- **Last Updated**: 2021-08-19
- **Author**: Rico Valdez, Splunk
- **ID**: 6923cd64-17a0-453c-b945-81ac2d8c6db9
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.AE
+* PR.AC
+* PR.DS
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 9
+* CIS 14
+
+
+
+
+
+
+
#### Search
```
@@ -44,10 +105,10 @@ The following analytic identifies cleartext protocols at risk of leaking sensiti
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `protocols_passing_authentication_in_cleartext_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **protocols_passing_authentication_in_cleartext_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -69,10 +130,6 @@ Some networks may use kerberized FTP or telnet servers, however, this is rare.
* [Use of Cleartext Protocols](/stories/use_of_cleartext_protocols)
-#### Kill Chain Phase
-* Reconnaissance
-* Actions on Objectives
-
#### RBA
@@ -82,8 +139,6 @@ Some networks may use kerberized FTP or telnet servers, however, this is rare.
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
* [https://www.rackaid.com/blog/secure-your-email-and-file-transfers/](https://www.rackaid.com/blog/secure-your-email-and-file-transfers/)
@@ -92,7 +147,7 @@ Some networks may use kerberized FTP or telnet servers, however, this is rare.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-20-github_commit_changes_in_master.md b/docs/_posts/2021-08-20-github_commit_changes_in_master.md
index bb61207dd1..e4386e0f36 100644
--- a/docs/_posts/2021-08-20-github_commit_changes_in_master.md
+++ b/docs/_posts/2021-08-20-github_commit_changes_in_master.md
@@ -23,29 +23,77 @@ tags:
This search is to detect a pushed or commit to master or main branch. This is to avoid unwanted modification to master without a review to the changes. Ideally in terms of devsecops the changes made in a branch and do a PR for review. of course in some cases admin of the project may did a changes directly to master branch
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-08-20
- **Author**: Teoderick Contreras, Splunk
- **ID**: c9d2bfe2-019f-11ec-a8eb-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1199](https://attack.mitre.org/techniques/T1199/) | Trusted Relationship | Initial Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
`github` branches{}.name = main OR branches{}.name = master
-| eval severity="low"
-| eval phase="code"
-| stats count min(_time) as firstTime max(_time) as lastTime by commit.author.html_url commit.commit.author.email commit.author.login commit.commit.message repository.pushed_at commit.commit.committer.date, phase, severity
-| eval phase="code"
+| stats count min(_time) as firstTime max(_time) as lastTime by commit.commit.author.email commit.author.login commit.commit.message repository.pushed_at commit.commit.committer.date repository.full_name
+| rename commit.author.login as user, repository.full_name as repository
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `github_commit_changes_in_master_filter`
@@ -53,10 +101,10 @@ This search is to detect a pushed or commit to master or main branch. This is to
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `github_commit_changes_in_master_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **github_commit_changes_in_master_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -72,9 +120,6 @@ admin can do changes directly to master branch
* [Dev Sec Ops](/stories/dev_sec_ops)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -84,8 +129,6 @@ admin can do changes directly to master branch
| 9.0 | 30 | 30 | suspicious commit by $commit.commit.author.email$ to main branch |
-
-
#### Reference
* [https://www.redhat.com/en/topics/devops/what-is-devsecops](https://www.redhat.com/en/topics/devops/what-is-devsecops)
@@ -93,7 +136,7 @@ admin can do changes directly to master branch
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-20-kubernetes_nginx_ingress_lfi.md b/docs/_posts/2021-08-20-kubernetes_nginx_ingress_lfi.md
index 96855dfdf6..e4bff95cbe 100644
--- a/docs/_posts/2021-08-20-kubernetes_nginx_ingress_lfi.md
+++ b/docs/_posts/2021-08-20-kubernetes_nginx_ingress_lfi.md
@@ -23,21 +23,77 @@ tags:
This search uses the Kubernetes logs from a nginx ingress controller to detect local file inclusion attacks.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-08-20
- **Author**: Patrick Bareiss, Splunk
- **ID**: 0f83244b-425b-4528-83db-7a88c5f66e48
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1212](https://attack.mitre.org/techniques/T1212/) | Exploitation for Credential Access | Credential Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.DS
+* PR.AC
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 13
+
+
+
+
+
+
+
#### Search
```
@@ -60,7 +116,7 @@ The SPL above uses the following Macros:
* [kubernetes_container_controller](https://github.com/splunk/security_content/blob/develop/macros/kubernetes_container_controller.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `kubernetes_nginx_ingress_lfi_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **kubernetes_nginx_ingress_lfi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Lookups
The SPL above uses the following Lookups:
@@ -81,9 +137,6 @@ unknown
* [Dev Sec Ops](/stories/dev_sec_ops)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -93,8 +146,6 @@ unknown
| 49.0 | 70 | 70 | Local File Inclusion Attack detected on $host$ |
-
-
#### Reference
* [https://github.com/splunk/splunk-connect-for-kubernetes](https://github.com/splunk/splunk-connect-for-kubernetes)
@@ -103,7 +154,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-23-getlocaluser_with_powershell.md b/docs/_posts/2021-08-23-getlocaluser_with_powershell.md
index 87a0a53e5c..619162a960 100644
--- a/docs/_posts/2021-08-23-getlocaluser_with_powershell.md
+++ b/docs/_posts/2021-08-23-getlocaluser_with_powershell.md
@@ -27,16 +27,21 @@ tags:
This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to query for local users. The `Get-LocalUser` commandlet is used to return a list of all local users. Red Teams and adversaries may leverage this commandlet to enumerate users for situational awareness and Active Directory Discovery.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-08-23
- **Author**: Mauricio Velazco, Splunk
- **ID**: 85fae8fa-0427-11ec-8b78-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This analytic looks for the execution of `powershell.exe` with command-line argu
| [T1087.001](https://attack.mitre.org/techniques/T1087/001/) | Local Account | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +107,10 @@ This analytic looks for the execution of `powershell.exe` with command-line argu
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `getlocaluser_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **getlocaluser_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -76,9 +126,6 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -88,8 +135,6 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo
| 15.0 | 30 | 50 | Local user discovery enumeration using PowerShell on $dest$ by $user$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1087/001/](https://attack.mitre.org/techniques/T1087/001/)
@@ -97,7 +142,7 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-23-getlocaluser_with_powershell_script_block.md b/docs/_posts/2021-08-23-getlocaluser_with_powershell_script_block.md
index 4c8b83544d..3b1b485d3a 100644
--- a/docs/_posts/2021-08-23-getlocaluser_with_powershell_script_block.md
+++ b/docs/_posts/2021-08-23-getlocaluser_with_powershell_script_block.md
@@ -26,16 +26,21 @@ tags:
The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-LocalUser` commandlet. The `Get-LocalUser` commandlet is used to return a list of all local users. Red Teams and adversaries may leverage this commandlet to enumerate users for situational awareness and Active Directory Discovery.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-08-23
- **Author**: Mauricio Velazco, Splunk
- **ID**: 2e891cbe-0426-11ec-9c9c-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,51 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
| [T1087.001](https://attack.mitre.org/techniques/T1087/001/) | Local Account | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -54,10 +104,10 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `getlocaluser_with_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **getlocaluser_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -73,9 +123,6 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -85,8 +132,6 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo
| 15.0 | 30 | 50 | Local user discovery enumeration using PowerShell on $dest$ by $user$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1087/001/](https://attack.mitre.org/techniques/T1087/001/)
@@ -94,7 +139,7 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell.md b/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell.md
index 4e9a03ae6f..371d9b9057 100644
--- a/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell.md
+++ b/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell.md
@@ -27,16 +27,21 @@ tags:
This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to query local users. The `Get-WmiObject` commandlet combined with the `Win32_UserAccount` parameter is used to return a list of all local users. Red Teams and adversaries may leverage this commandlet to enumerate users for situational awareness and Active Directory Discovery.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-08-23
- **Author**: Mauricio Velazco, Splunk
- **ID**: b44f6ac6-0429-11ec-87e9-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This analytic looks for the execution of `powershell.exe` with command-line argu
| [T1087.001](https://attack.mitre.org/techniques/T1087/001/) | Local Account | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +107,10 @@ This analytic looks for the execution of `powershell.exe` with command-line argu
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `getwmiobject_user_account_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **getwmiobject_user_account_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -76,9 +126,6 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -88,8 +135,6 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo
| 15.0 | 30 | 50 | Local user discovery enumeration using PowerShell on $dest$ by $user$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1087/001/](https://attack.mitre.org/techniques/T1087/001/)
@@ -97,7 +142,7 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell_script_block.md b/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell_script_block.md
index db01d38464..523e28b3c3 100644
--- a/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell_script_block.md
+++ b/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell_script_block.md
@@ -26,16 +26,21 @@ tags:
The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-WmiObject` commandlet used with specific parameters. The `Win32_UserAccount` parameter is used to return a list of all local users. Red Teams and adversaries may leverage this commandlet to enumerate users for situational awareness and Active Directory Discovery.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-08-23
- **Author**: Mauricio Velazco, Splunk
- **ID**: 640b0eda-0429-11ec-accd-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,51 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
| [T1087.001](https://attack.mitre.org/techniques/T1087/001/) | Local Account | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -54,10 +104,10 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `getwmiobject_user_account_with_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **getwmiobject_user_account_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -73,9 +123,6 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -85,8 +132,6 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo
| 15.0 | 30 | 50 | Local user discovery enumeration using PowerShell on $dest$ by $user$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1087/001/](https://attack.mitre.org/techniques/T1087/001/)
@@ -94,7 +139,7 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-23-gsuite_email_with_known_abuse_web_service_link.md b/docs/_posts/2021-08-23-gsuite_email_with_known_abuse_web_service_link.md
index f115ceee44..7f91afb3f4 100644
--- a/docs/_posts/2021-08-23-gsuite_email_with_known_abuse_web_service_link.md
+++ b/docs/_posts/2021-08-23-gsuite_email_with_known_abuse_web_service_link.md
@@ -26,16 +26,21 @@ tags:
This analytics is to detect a gmail containing a link that are known to be abused by malware or attacker like pastebin, telegram and discord to deliver malicious payload. This event can encounter some normal email traffic within organization and external email that normally using this application and services.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-08-23
- **Author**: Teoderick Contreras, Splunk
- **ID**: 8630aa22-042b-11ec-af39-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,51 @@ This analytics is to detect a gmail containing a link that are known to be abuse
| [T1566](https://attack.mitre.org/techniques/T1566/) | Phishing | Initial Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -63,7 +113,7 @@ The SPL above uses the following Macros:
* [gsuite_gmail](https://github.com/splunk/security_content/blob/develop/macros/gsuite_gmail.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `gsuite_email_with_known_abuse_web_service_link_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **gsuite_email_with_known_abuse_web_service_link_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -79,9 +129,6 @@ normal email contains this link that are known application within the organizati
* [Dev Sec Ops](/stories/dev_sec_ops)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -91,8 +138,6 @@ normal email contains this link that are known application within the organizati
| 25.0 | 50 | 50 | suspicious email from $source.address$ to $destination{}.address$ |
-
-
#### Reference
* [https://news.sophos.com/en-us/2021/07/22/malware-increasingly-targets-discord-for-abuse/](https://news.sophos.com/en-us/2021/07/22/malware-increasingly-targets-discord-for-abuse/)
@@ -100,7 +145,7 @@ normal email contains this link that are known application within the organizati
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-23-gsuite_suspicious_shared_file_name.md b/docs/_posts/2021-08-23-gsuite_suspicious_shared_file_name.md
index 4f079e05eb..0f485dcb01 100644
--- a/docs/_posts/2021-08-23-gsuite_suspicious_shared_file_name.md
+++ b/docs/_posts/2021-08-23-gsuite_suspicious_shared_file_name.md
@@ -26,16 +26,21 @@ tags:
This search is to detect a shared file in google drive with suspicious file name that are commonly used by spear phishing campaign. This technique is very popular to lure the user by running a malicious document or click a malicious link within the shared file that will redirected to malicious website. This detection can also catch some normal email communication between organization and its external customer.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-08-23
- **Author**: Teoderick Contreras, Splunk
- **ID**: 07eed200-03f5-11ec-98fb-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,51 @@ This search is to detect a shared file in google drive with suspicious file name
| [T1566](https://attack.mitre.org/techniques/T1566/) | Phishing | Initial Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -61,10 +111,10 @@ This search is to detect a shared file in google drive with suspicious file name
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [gsuite_drive](https://github.com/splunk/security_content/blob/develop/macros/gsuite_drive.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `gsuite_suspicious_shared_file_name_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **gsuite_suspicious_shared_file_name_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -87,9 +137,6 @@ normal user or normal transaction may contain the subject and file type attachme
* [Dev Sec Ops](/stories/dev_sec_ops)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -99,8 +146,6 @@ normal user or normal transaction may contain the subject and file type attachme
| 21.0 | 30 | 70 | suspicious share gdrive from $parameters.owner$ to $email$ namely as $parameters.doc_title$ |
-
-
#### Reference
* [https://www.redhat.com/en/topics/devops/what-is-devsecops](https://www.redhat.com/en/topics/devops/what-is-devsecops)
@@ -109,7 +154,7 @@ normal user or normal transaction may contain the subject and file type attachme
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-23-kubernetes_nginx_ingress_rfi.md b/docs/_posts/2021-08-23-kubernetes_nginx_ingress_rfi.md
index ab6c4eaf9c..e60f72e3ca 100644
--- a/docs/_posts/2021-08-23-kubernetes_nginx_ingress_rfi.md
+++ b/docs/_posts/2021-08-23-kubernetes_nginx_ingress_rfi.md
@@ -23,21 +23,77 @@ tags:
This search uses the Kubernetes logs from a nginx ingress controller to detect remote file inclusion attacks.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-08-23
- **Author**: Patrick Bareiss, Splunk
- **ID**: fc5531ae-62fd-4de6-9c36-b4afdae8ca95
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1212](https://attack.mitre.org/techniques/T1212/) | Exploitation for Credential Access | Credential Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.DS
+* PR.AC
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 13
+
+
+
+
+
+
+
#### Search
```
@@ -60,7 +116,7 @@ The SPL above uses the following Macros:
* [kubernetes_container_controller](https://github.com/splunk/security_content/blob/develop/macros/kubernetes_container_controller.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `kubernetes_nginx_ingress_rfi_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **kubernetes_nginx_ingress_rfi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* raw
@@ -76,9 +132,6 @@ unknown
* [Dev Sec Ops](/stories/dev_sec_ops)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -88,8 +141,6 @@ unknown
| 49.0 | 70 | 70 | Remote File Inclusion Attack detected on $host$ |
-
-
#### Reference
* [https://github.com/splunk/splunk-connect-for-kubernetes](https://github.com/splunk/splunk-connect-for-kubernetes)
@@ -98,7 +149,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-24-adsisearcher_account_discovery.md b/docs/_posts/2021-08-24-adsisearcher_account_discovery.md
index 5c6664b773..a9cc95cf1b 100644
--- a/docs/_posts/2021-08-24-adsisearcher_account_discovery.md
+++ b/docs/_posts/2021-08-24-adsisearcher_account_discovery.md
@@ -26,16 +26,21 @@ tags:
The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the `[Adsisearcher]` type accelerator being used to query Active Directory for domain groups. Red Teams and adversaries may leverage `[Adsisearcher]` to enumerate domain users for situational awareness and Active Directory Discovery.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-08-24
- **Author**: Teoderick Contreras, Mauricio Velazco, Splunk
- **ID**: de7fcadc-04f3-11ec-a241-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,51 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
| [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -55,10 +105,10 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `adsisearcher_account_discovery_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **adsisearcher_account_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -78,9 +128,6 @@ Administrators or power users may use this command for troubleshooting.
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -90,8 +137,6 @@ Administrators or power users may use this command for troubleshooting.
| 25.0 | 50 | 50 | powershell process having commandline $Message$ for user enumeration |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1087/002/](https://attack.mitre.org/techniques/T1087/002/)
@@ -101,7 +146,7 @@ Administrators or power users may use this command for troubleshooting.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-24-domain_account_discovery_with_dsquery.md b/docs/_posts/2021-08-24-domain_account_discovery_with_dsquery.md
index 200b9a0b43..c45d9dd9fb 100644
--- a/docs/_posts/2021-08-24-domain_account_discovery_with_dsquery.md
+++ b/docs/_posts/2021-08-24-domain_account_discovery_with_dsquery.md
@@ -27,16 +27,21 @@ tags:
This analytic looks for the execution of `dsquery.exe` with command-line arguments utilized to discover domain users. The `user` argument returns a list of all users registered in the domain. Red Teams and adversaries alike engage in remote system discovery for situational awareness and Active Directory Discovery.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-08-24
- **Author**: Teoderick Contreras, Mauricio Velazco, Splunk
- **ID**: b1a8ce04-04c2-11ec-bea7-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This analytic looks for the execution of `dsquery.exe` with command-line argumen
| [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +107,10 @@ This analytic looks for the execution of `dsquery.exe` with command-line argumen
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `domain_account_discovery_with_dsquery_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **domain_account_discovery_with_dsquery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +134,6 @@ Administrators or power users may use this command for troubleshooting.
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -96,8 +143,6 @@ Administrators or power users may use this command for troubleshooting.
| 25.0 | 50 | 50 | an instance of process $process_name$ with commandline $process$ in $dest$ |
-
-
#### Reference
* [https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm](https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm)
@@ -106,7 +151,7 @@ Administrators or power users may use this command for troubleshooting.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md b/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md
index 40b242b92b..2a36720e6e 100644
--- a/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md
+++ b/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md
@@ -27,16 +27,21 @@ tags:
This analytic looks for the execution of `net.exe` or `net1.exe` with command-line arguments utilized to query for domain users. Red Teams and adversaries alike may use net.exe to enumerate domain users for situational awareness and Active Directory Discovery.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-08-24
- **Author**: Teoderick Contreras, Mauricio Velazco, Splunk
- **ID**: 98f6a534-04c2-11ec-96b2-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-li
| [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,11 +107,11 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-li
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `domain_account_discovery_with_net_app_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **domain_account_discovery_with_net_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -85,9 +135,6 @@ Administrators or power users may use this command for troubleshooting.
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -97,8 +144,6 @@ Administrators or power users may use this command for troubleshooting.
| 25.0 | 50 | 50 | an instance of process $process_name$ with commandline $process$ in $dest$ |
-
-
#### Reference
* [https://docs.microsoft.com/en-us/defender-for-identity/playbook-domain-dominance](https://docs.microsoft.com/en-us/defender-for-identity/playbook-domain-dominance)
@@ -107,7 +152,7 @@ Administrators or power users may use this command for troubleshooting.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-24-domain_account_discovery_with_wmic.md b/docs/_posts/2021-08-24-domain_account_discovery_with_wmic.md
index bc94ed43f5..1ee95e1903 100644
--- a/docs/_posts/2021-08-24-domain_account_discovery_with_wmic.md
+++ b/docs/_posts/2021-08-24-domain_account_discovery_with_wmic.md
@@ -27,16 +27,21 @@ tags:
This analytic looks for the execution of `wmic.exe` with command-line arguments utilized to query for domain users. Red Teams and adversaries alike use wmic.exe to enumerate domain users for situational awareness and Active Directory Discovery.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-08-24
- **Author**: Teoderick Contreras, Mauricio Velazco, Splunk
- **ID**: 383572e0-04c5-11ec-bdcc-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments
| [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +107,10 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `domain_account_discovery_with_wmic_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **domain_account_discovery_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +134,6 @@ Administrators or power users may use this command for troubleshooting.
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -96,8 +143,6 @@ Administrators or power users may use this command for troubleshooting.
| 25.0 | 50 | 50 | an instance of process $process_name$ with commandline $process$ in $dest$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1087/002/](https://attack.mitre.org/techniques/T1087/002/)
@@ -105,7 +150,7 @@ Administrators or power users may use this command for troubleshooting.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md b/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md
index f8bb924fc5..4ff50492dd 100644
--- a/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md
+++ b/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md
@@ -24,21 +24,71 @@ tags:
This analytic identifies Get-DomainTrust from PowerView in order to gather domain trust information. Typically, this is utilized within a script being executed and used to enumerate the domain trust information. This grants the adversary an understanding of how large or small the domain is. During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-08-24
- **Author**: Michael Haag, Splunk
- **ID**: 4fa7f846-054a-11ec-a836-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1482](https://attack.mitre.org/techniques/T1482/) | Domain Trust Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +102,10 @@ This analytic identifies Get-DomainTrust from PowerView in order to gather domai
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `get-domaintrust_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **get-domaintrust_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -82,9 +132,6 @@ Limited false positives as this requires an active Administrator or adversary to
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -94,8 +141,6 @@ Limited false positives as this requires an active Administrator or adversary to
| 12.0 | 30 | 40 | Suspicious PowerShell Get-DomainTrust was identified on endpoint $dest$ by user $user$. |
-
-
#### Reference
* [http://www.harmj0y.net/blog/redteaming/a-guide-to-attacking-domain-trusts/](http://www.harmj0y.net/blog/redteaming/a-guide-to-attacking-domain-trusts/)
@@ -103,7 +148,7 @@ Limited false positives as this requires an active Administrator or adversary to
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-24-get-domaintrust_with_powershell_script_block.md b/docs/_posts/2021-08-24-get-domaintrust_with_powershell_script_block.md
index 289579b49a..6c565d2699 100644
--- a/docs/_posts/2021-08-24-get-domaintrust_with_powershell_script_block.md
+++ b/docs/_posts/2021-08-24-get-domaintrust_with_powershell_script_block.md
@@ -25,21 +25,71 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
This analytic identifies Get-DomainTrust from PowerView in order to gather domain trust information. \
During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-08-24
- **Author**: Michael Haag, Splunk
- **ID**: 89275e7e-0548-11ec-bf75-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1482](https://attack.mitre.org/techniques/T1482/) | Domain Trust Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +102,10 @@ During triage, review parallel processes using an EDR product or 4688 events. It
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `get-domaintrust_with_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **get-domaintrust_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -77,9 +127,6 @@ It is possible certain system management frameworks utilize this command to gath
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -89,8 +136,6 @@ It is possible certain system management frameworks utilize this command to gath
| 12.0 | 30 | 40 | Suspicious PowerShell Get-DomainTrust was identified on endpoint $ComputerName$ by user $user$. |
-
-
#### Reference
* [http://www.harmj0y.net/blog/redteaming/a-guide-to-attacking-domain-trusts/](http://www.harmj0y.net/blog/redteaming/a-guide-to-attacking-domain-trusts/)
@@ -102,7 +147,7 @@ It is possible certain system management frameworks utilize this command to gath
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-24-get_aduser_with_powershell.md b/docs/_posts/2021-08-24-get_aduser_with_powershell.md
index 4902ce1faf..9a408350ad 100644
--- a/docs/_posts/2021-08-24-get_aduser_with_powershell.md
+++ b/docs/_posts/2021-08-24-get_aduser_with_powershell.md
@@ -27,16 +27,21 @@ tags:
This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to enumerate domain users. The `Get-AdUser' commandlet returns a list of all domain users. Red Teams and adversaries alike may use this commandlet to identify remote systems for situational awareness and Active Directory Discovery.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-08-24
- **Author**: Teoderick Contreras, Mauricio Velazco, Splunk
- **ID**: 0b6ee3f4-04e3-11ec-a87d-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This analytic looks for the execution of `powershell.exe` with command-line argu
| [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +107,10 @@ This analytic looks for the execution of `powershell.exe` with command-line argu
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `get_aduser_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **get_aduser_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +134,6 @@ Administrators or power users may use this command for troubleshooting.
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -96,8 +143,6 @@ Administrators or power users may use this command for troubleshooting.
| 25.0 | 50 | 50 | an instance of process $process_name$ with commandline $process$ in $dest$ |
-
-
#### Reference
* [https://www.blackhillsinfosec.com/red-blue-purple/](https://www.blackhillsinfosec.com/red-blue-purple/)
@@ -107,7 +152,7 @@ Administrators or power users may use this command for troubleshooting.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-24-get_aduser_with_powershell_script_block.md b/docs/_posts/2021-08-24-get_aduser_with_powershell_script_block.md
index ab683695c3..558f516974 100644
--- a/docs/_posts/2021-08-24-get_aduser_with_powershell_script_block.md
+++ b/docs/_posts/2021-08-24-get_aduser_with_powershell_script_block.md
@@ -26,16 +26,21 @@ tags:
The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-AdGUser` commandlet. The `Get-AdUser` commandlet is used to return a list of all domain users. Red Teams and adversaries may leverage this commandlet to enumerate domain groups for situational awareness and Active Directory Discovery.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-08-24
- **Author**: Teoderick Contreras, Mauricio Velazco, Splunk
- **ID**: 21432e40-04f4-11ec-b7e6-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,51 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
| [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -55,10 +105,10 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `get_aduser_with_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **get_aduser_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -78,9 +128,6 @@ Administrators or power users may use this command for troubleshooting.
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -90,8 +137,6 @@ Administrators or power users may use this command for troubleshooting.
| 25.0 | 50 | 50 | powershell process having commandline $Message$ for user enumeration |
-
-
#### Reference
* [https://www.blackhillsinfosec.com/red-blue-purple/](https://www.blackhillsinfosec.com/red-blue-purple/)
@@ -101,7 +146,7 @@ Administrators or power users may use this command for troubleshooting.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-24-get_domainuser_with_powershell.md b/docs/_posts/2021-08-24-get_domainuser_with_powershell.md
index e3a8c35ebe..8d25b236cb 100644
--- a/docs/_posts/2021-08-24-get_domainuser_with_powershell.md
+++ b/docs/_posts/2021-08-24-get_domainuser_with_powershell.md
@@ -27,16 +27,21 @@ tags:
This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to enumerate domain users. `Get-DomainUser` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may leverage PowerView to enumerate domain users for situational awareness and Active Directory Discovery.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-08-24
- **Author**: Teoderick Contreras, Mauricio Velazco, Splunk
- **ID**: 9a5a41d6-04e7-11ec-923c-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This analytic looks for the execution of `powershell.exe` with command-line argu
| [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +107,10 @@ This analytic looks for the execution of `powershell.exe` with command-line argu
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `get_domainuser_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **get_domainuser_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +134,6 @@ Administrators or power users may use this command for troubleshooting.
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -96,8 +143,6 @@ Administrators or power users may use this command for troubleshooting.
| 25.0 | 50 | 50 | an instance of process $process_name$ with commandline $process$ in $dest$ |
-
-
#### Reference
* [https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainUser/](https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainUser/)
@@ -105,7 +150,7 @@ Administrators or power users may use this command for troubleshooting.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-24-get_domainuser_with_powershell_script_block.md b/docs/_posts/2021-08-24-get_domainuser_with_powershell_script_block.md
index 8b01ee61b8..6f526d8776 100644
--- a/docs/_posts/2021-08-24-get_domainuser_with_powershell_script_block.md
+++ b/docs/_posts/2021-08-24-get_domainuser_with_powershell_script_block.md
@@ -26,16 +26,21 @@ tags:
The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainUser` commandlet. `GetDomainUser` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may use PowerView to enumerate domain users for situational awareness and Active Directory Discovery.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-08-24
- **Author**: Teoderick Contreras, Mauricio Velazco, Splunk
- **ID**: 61994268-04f4-11ec-865c-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,51 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
| [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -55,10 +105,10 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `get_domainuser_with_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **get_domainuser_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -78,9 +128,6 @@ Administrators or power users may use this command for troubleshooting.
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -90,8 +137,6 @@ Administrators or power users may use this command for troubleshooting.
| 25.0 | 50 | 50 | powershell process having commandline $Message$ for user enumeration |
-
-
#### Reference
* [https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainUser/](https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainUser/)
@@ -99,7 +144,7 @@ Administrators or power users may use this command for troubleshooting.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell.md b/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell.md
index 441c9b484e..bbc1f91c9a 100644
--- a/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell.md
+++ b/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell.md
@@ -27,16 +27,21 @@ tags:
This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to query for domain users. The `Get-WmiObject` commandlet combined with the `-class ds_user` parameter can be used to return the full list of users in a Windows domain. Red Teams and adversaries alike may leverage WMI in this case, using PowerShell, to enumerate domain users for situational awareness and Active Directory Discovery.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-08-24
- **Author**: Teoderick Contreras, Mauricio Velazco, Splunk
- **ID**: 22d3b118-04df-11ec-8fa3-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This analytic looks for the execution of `powershell.exe` with command-line argu
| [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +107,10 @@ This analytic looks for the execution of `powershell.exe` with command-line argu
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `getwmiobject_ds_user_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **getwmiobject_ds_user_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +134,6 @@ Administrators or power users may use this command for troubleshooting.
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -96,8 +143,6 @@ Administrators or power users may use this command for troubleshooting.
| 25.0 | 50 | 50 | an instance of process $process_name$ with commandline $process$ in $dest$ |
-
-
#### Reference
* [https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm](https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm)
@@ -105,7 +150,7 @@ Administrators or power users may use this command for troubleshooting.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell_script_block.md b/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell_script_block.md
index 546fbd8efe..1d7ad2997a 100644
--- a/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell_script_block.md
+++ b/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell_script_block.md
@@ -26,16 +26,21 @@ tags:
The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-WmiObject` commandlet. The `DS_User` class parameter leverages WMI to query for all domain users. Red Teams and adversaries may leverage this commandlet to enumerate domain users for situational awareness and Active Directory Discovery.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-08-24
- **Author**: Teoderick Contreras, Mauricio Velazco, Splunk
- **ID**: fabd364e-04f3-11ec-b34b-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,51 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
| [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -55,10 +105,10 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `getwmiobject_ds_user_with_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **getwmiobject_ds_user_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -78,9 +128,6 @@ Administrators or power users may use this command for troubleshooting.
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -90,8 +137,6 @@ Administrators or power users may use this command for troubleshooting.
| 25.0 | 50 | 50 | powershell process having commandline $Message$ for user enumeration |
-
-
#### Reference
* [https://www.blackhillsinfosec.com/red-blue-purple/](https://www.blackhillsinfosec.com/red-blue-purple/)
@@ -100,7 +145,7 @@ Administrators or power users may use this command for troubleshooting.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-24-kubernetes_scanner_image_pulling.md b/docs/_posts/2021-08-24-kubernetes_scanner_image_pulling.md
index a308c7ad19..9dd84e7f6a 100644
--- a/docs/_posts/2021-08-24-kubernetes_scanner_image_pulling.md
+++ b/docs/_posts/2021-08-24-kubernetes_scanner_image_pulling.md
@@ -23,21 +23,77 @@ tags:
This search uses the Kubernetes logs from Splunk Connect from Kubernetes to detect Kubernetes Security Scanner.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-08-24
- **Author**: Patrick Bareiss, Splunk
- **ID**: 4890cd6b-0112-4974-a272-c5c153aee551
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1526](https://attack.mitre.org/techniques/T1526/) | Cloud Service Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.DS
+* PR.AC
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 13
+
+
+
+
+
+
+
#### Search
```
@@ -58,7 +114,7 @@ The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [kube_objects_events](https://github.com/splunk/security_content/blob/develop/macros/kube_objects_events.yml)
-Note that `kubernetes_scanner_image_pulling_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **kubernetes_scanner_image_pulling_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* object.message
@@ -80,9 +136,6 @@ unknown
* [Dev Sec Ops](/stories/dev_sec_ops)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -92,8 +145,6 @@ unknown
| 81.0 | 90 | 90 | Kubernetes Scanner image pulled on host $host$ |
-
-
#### Reference
* [https://github.com/splunk/splunk-connect-for-kubernetes](https://github.com/splunk/splunk-connect-for-kubernetes)
@@ -101,7 +152,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-25-domain_group_discovery_with_adsisearcher.md b/docs/_posts/2021-08-25-domain_group_discovery_with_adsisearcher.md
index 7c81bbe5d7..bd72a25c37 100644
--- a/docs/_posts/2021-08-25-domain_group_discovery_with_adsisearcher.md
+++ b/docs/_posts/2021-08-25-domain_group_discovery_with_adsisearcher.md
@@ -26,16 +26,21 @@ tags:
The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the `[Adsisearcher]` type accelerator being used to query Active Directory for domain groups. Red Teams and adversaries may leverage `[Adsisearcher]` to enumerate domain groups for situational awareness and Active Directory Discovery.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-08-25
- **Author**: Mauricio Velazco, Splunk
- **ID**: 089c862f-5f83-49b5-b1c8-7e4ff66560c7
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,51 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
| [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -54,10 +104,10 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `domain_group_discovery_with_adsisearcher_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **domain_group_discovery_with_adsisearcher_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -77,9 +127,6 @@ Administrators or power users may use Adsisearcher for troubleshooting.
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -89,8 +136,6 @@ Administrators or power users may use Adsisearcher for troubleshooting.
| 18.0 | 30 | 60 | Domain group discovery enumeration using PowerShell on $dest$ by $user$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1069/002/](https://attack.mitre.org/techniques/T1069/002/)
@@ -99,7 +144,7 @@ Administrators or power users may use Adsisearcher for troubleshooting.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-25-domain_group_discovery_with_net.md b/docs/_posts/2021-08-25-domain_group_discovery_with_net.md
index 75d58e79dd..4700b5ffc0 100644
--- a/docs/_posts/2021-08-25-domain_group_discovery_with_net.md
+++ b/docs/_posts/2021-08-25-domain_group_discovery_with_net.md
@@ -27,16 +27,21 @@ tags:
This analytic looks for the execution of `net.exe` with command-line arguments utilized to query for domain groups. The argument `group /domain`, returns a list of all domain groups. Red Teams and adversaries alike use net.exe to enumerate domain groups for situational awareness and Active Directory Discovery.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-08-25
- **Author**: Mauricio Velazco, Splunk
- **ID**: f2f14ac7-fa81-471a-80d5-7eb65c3c7349
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This analytic looks for the execution of `net.exe` with command-line arguments u
| [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +107,10 @@ This analytic looks for the execution of `net.exe` with command-line arguments u
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `domain_group_discovery_with_net_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **domain_group_discovery_with_net_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* Processes.dest
@@ -86,9 +136,6 @@ Administrators or power users may use this command for troubleshooting.
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -98,8 +145,6 @@ Administrators or power users may use this command for troubleshooting.
| 15.0 | 30 | 50 | Domain group discovery enumeration on $dest$ by $user$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1069/002/](https://attack.mitre.org/techniques/T1069/002/)
@@ -107,7 +152,7 @@ Administrators or power users may use this command for troubleshooting.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-25-domain_group_discovery_with_wmic.md b/docs/_posts/2021-08-25-domain_group_discovery_with_wmic.md
index b7ba2c6750..ed160f58cb 100644
--- a/docs/_posts/2021-08-25-domain_group_discovery_with_wmic.md
+++ b/docs/_posts/2021-08-25-domain_group_discovery_with_wmic.md
@@ -27,16 +27,21 @@ tags:
This analytic looks for the execution of `wmic.exe` with command-line arguments utilized to query for domain groups. The arguments utilized in this command return a list of all domain groups. Red Teams and adversaries alike use wmic.exe to enumerate domain groups for situational awareness and Active Directory Discovery.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-08-25
- **Author**: Mauricio Velazco, Splunk
- **ID**: a87736a6-95cd-4728-8689-3c64d5026b3e
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments
| [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +107,10 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `domain_group_discovery_with_wmic_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **domain_group_discovery_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* Processes.dest
@@ -86,9 +136,6 @@ Administrators or power users may use this command for troubleshooting.
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -98,8 +145,6 @@ Administrators or power users may use this command for troubleshooting.
| 15.0 | 30 | 50 | Domain group discovery enumeration on $dest$ by $user$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1069/002/](https://attack.mitre.org/techniques/T1069/002/)
@@ -107,7 +152,7 @@ Administrators or power users may use this command for troubleshooting.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-25-elevated_group_discovery_with_net.md b/docs/_posts/2021-08-25-elevated_group_discovery_with_net.md
index f302935a35..1f91ecbd22 100644
--- a/docs/_posts/2021-08-25-elevated_group_discovery_with_net.md
+++ b/docs/_posts/2021-08-25-elevated_group_discovery_with_net.md
@@ -27,16 +27,21 @@ tags:
This analytic looks for the execution of `net.exe` or `net1.exe` with command-line arguments utilized to query for specific elevated domain groups. Red Teams and adversaries alike use net.exe to enumerate elevated domain groups for situational awareness and Active Directory Discovery to identify high privileged users.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-08-25
- **Author**: Mauricio Velazco, Splunk
- **ID**: a23a0e20-0b1b-4a07-82e5-ec5f70811e7a
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-l
| [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +107,10 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-l
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `elevated_group_discovery_with_net_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **elevated_group_discovery_with_net_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* Processes.dest
@@ -86,9 +136,6 @@ Administrators or power users may use this command for troubleshooting.
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -98,8 +145,6 @@ Administrators or power users may use this command for troubleshooting.
| 21.0 | 30 | 70 | Elevated domain group discovery enumeration on $dest$ by $user$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1069/002/](https://attack.mitre.org/techniques/T1069/002/)
@@ -109,7 +154,7 @@ Administrators or power users may use this command for troubleshooting.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-25-elevated_group_discovery_with_powerview.md b/docs/_posts/2021-08-25-elevated_group_discovery_with_powerview.md
index f62a4f2080..cbfd8b9b6d 100644
--- a/docs/_posts/2021-08-25-elevated_group_discovery_with_powerview.md
+++ b/docs/_posts/2021-08-25-elevated_group_discovery_with_powerview.md
@@ -26,16 +26,21 @@ tags:
The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainGroupMember` commandlet. `Get-DomainGroupMember` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. As the name suggests, `Get-DomainGroupMember` is used to list the members of an specific domain group. Red Teams and adversaries alike use PowerView to enumerate elevated domain groups for situational awareness and Active Directory Discovery to identify high privileged users.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-08-25
- **Author**: Mauricio Velazco, Splunk
- **ID**: 10d62950-0de5-4199-a710-cff9ea79b413
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,51 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
| [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -54,10 +104,10 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `elevated_group_discovery_with_powerview_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **elevated_group_discovery_with_powerview_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -77,9 +127,6 @@ Administrators or power users may use this PowerView for troubleshooting.
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -89,8 +136,6 @@ Administrators or power users may use this PowerView for troubleshooting.
| 21.0 | 30 | 70 | Elevated group discovery using PowerView on $dest$ by $user$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1069/002/](https://attack.mitre.org/techniques/T1069/002/)
@@ -101,7 +146,7 @@ Administrators or power users may use this PowerView for troubleshooting.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-25-elevated_group_discovery_with_wmic.md b/docs/_posts/2021-08-25-elevated_group_discovery_with_wmic.md
index dfa3d7a1a7..4b3a54b22c 100644
--- a/docs/_posts/2021-08-25-elevated_group_discovery_with_wmic.md
+++ b/docs/_posts/2021-08-25-elevated_group_discovery_with_wmic.md
@@ -27,16 +27,21 @@ tags:
This analytic looks for the execution of `wmic.exe` with command-line arguments utilized to query for specific domain groups. Red Teams and adversaries alike use net.exe to enumerate elevated domain groups for situational awareness and Active Directory Discovery to identify high privileged users.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-08-25
- **Author**: Mauricio Velazco, Splunk
- **ID**: 3f6bbf22-093e-4cb4-9641-83f47b8444b6
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments
| [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +107,10 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `elevated_group_discovery_with_wmic_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **elevated_group_discovery_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* Processes.dest
@@ -86,9 +136,6 @@ Administrators or power users may use this command for troubleshooting.
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -98,8 +145,6 @@ Administrators or power users may use this command for troubleshooting.
| 21.0 | 30 | 70 | Elevated domain group discovery enumeration on $dest$ by $user$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1069/002/](https://attack.mitre.org/techniques/T1069/002/)
@@ -109,7 +154,7 @@ Administrators or power users may use this command for troubleshooting.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-25-getadgroup_with_powershell.md b/docs/_posts/2021-08-25-getadgroup_with_powershell.md
index fc660e0b61..15a5c8f89c 100644
--- a/docs/_posts/2021-08-25-getadgroup_with_powershell.md
+++ b/docs/_posts/2021-08-25-getadgroup_with_powershell.md
@@ -27,16 +27,21 @@ tags:
This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to query for domain groups. The `Get-AdGroup` commandlnet is used to return a list of all groups available in a Windows Domain. Red Teams and adversaries alike may leverage this commandlet to enumerate domain groups for situational awareness and Active Directory Discovery.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-08-25
- **Author**: Mauricio Velazco, Splunk
- **ID**: 872e3063-0fc4-4e68-b2f3-f2b99184a708
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This analytic looks for the execution of `powershell.exe` with command-line argu
| [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +107,10 @@ This analytic looks for the execution of `powershell.exe` with command-line argu
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `getadgroup_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **getadgroup_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* Processes.dest
@@ -86,9 +136,6 @@ Administrators or power users may use this command for troubleshooting.
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -98,8 +145,6 @@ Administrators or power users may use this command for troubleshooting.
| 15.0 | 30 | 50 | Domain group discovery enumeration on $dest$ by $user$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1069/002/](https://attack.mitre.org/techniques/T1069/002/)
@@ -108,7 +153,7 @@ Administrators or power users may use this command for troubleshooting.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-25-getadgroup_with_powershell_script_block.md b/docs/_posts/2021-08-25-getadgroup_with_powershell_script_block.md
index e350156657..6bce78d975 100644
--- a/docs/_posts/2021-08-25-getadgroup_with_powershell_script_block.md
+++ b/docs/_posts/2021-08-25-getadgroup_with_powershell_script_block.md
@@ -26,16 +26,21 @@ tags:
The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-AdGroup` commandlet. The `Get-AdGroup` commandlet is used to return a list of all domain groups. Red Teams and adversaries may leverage this commandlet to enumerate domain groups for situational awareness and Active Directory Discovery.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-08-25
- **Author**: Mauricio Velazco, Splunk
- **ID**: e4c73d68-794b-468d-b4d0-dac1772bbae7
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,51 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
| [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -54,10 +104,10 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `getadgroup_with_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **getadgroup_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -77,9 +127,6 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -89,8 +136,6 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo
| 15.0 | 30 | 50 | Domain group discovery enumeration using PowerShell on $dest$ by $user$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1069/002/](https://attack.mitre.org/techniques/T1069/002/)
@@ -99,7 +144,7 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-25-getdomaingroup_with_powershell.md b/docs/_posts/2021-08-25-getdomaingroup_with_powershell.md
index 133978adf3..f4167d61f3 100644
--- a/docs/_posts/2021-08-25-getdomaingroup_with_powershell.md
+++ b/docs/_posts/2021-08-25-getdomaingroup_with_powershell.md
@@ -27,16 +27,21 @@ tags:
This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to query for domain groups. `Get-DomainGroup` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may leverage PowerView to enumerate domain groups for situational awareness and Active Directory Discovery.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-08-25
- **Author**: Mauricio Velazco, Splunk
- **ID**: 93c94be3-bead-4a60-860f-77ca3fe59903
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This analytic looks for the execution of `powershell.exe` with command-line argu
| [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +107,10 @@ This analytic looks for the execution of `powershell.exe` with command-line argu
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `getdomaingroup_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **getdomaingroup_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* Processes.dest
@@ -86,9 +136,6 @@ Administrators or power users may use this command for troubleshooting.
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -98,8 +145,6 @@ Administrators or power users may use this command for troubleshooting.
| 15.0 | 30 | 50 | Domain group discovery with PowerView on $dest$ by $user$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1069/002/](https://attack.mitre.org/techniques/T1069/002/)
@@ -108,7 +153,7 @@ Administrators or power users may use this command for troubleshooting.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-25-getnettcpconnection_with_powershell.md b/docs/_posts/2021-08-25-getnettcpconnection_with_powershell.md
index 89af756864..f10e734570 100644
--- a/docs/_posts/2021-08-25-getnettcpconnection_with_powershell.md
+++ b/docs/_posts/2021-08-25-getnettcpconnection_with_powershell.md
@@ -24,21 +24,71 @@ tags:
This analytic looks for the execution of `powershell.exe` with command-line utilized to get a listing of network connections on a compromised system. The `Get-NetTcpConnection` commandlet lists the current TCP connections. Red Teams and adversaries alike may use this commandlet for situational awareness and Active Directory Discovery.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-08-25
- **Author**: Mauricio Velazco, Splunk
- **ID**: e02af35c-1de5-4afe-b4be-f45aba57272b
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1049](https://attack.mitre.org/techniques/T1049/) | System Network Connections Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +102,10 @@ This analytic looks for the execution of `powershell.exe` with command-line util
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `getnettcpconnection_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **getnettcpconnection_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* Processes.dest
@@ -81,9 +131,6 @@ Administrators or power users may use this command for troubleshooting.
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -93,8 +140,6 @@ Administrators or power users may use this command for troubleshooting.
| 15.0 | 30 | 50 | Network Connection discovery on $dest$ by $user$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1049/](https://attack.mitre.org/techniques/T1049/)
@@ -103,7 +148,7 @@ Administrators or power users may use this command for troubleshooting.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell.md b/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell.md
index 2b018290fa..40b9bcec09 100644
--- a/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell.md
+++ b/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell.md
@@ -27,16 +27,21 @@ tags:
This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to query for domain groups. The `Get-WmiObject` commandlet combined with the `-class ds_group` parameter can be used to return the full list of groups in a Windows domain. Red Teams and adversaries alike may leverage WMI in this case, using PowerShell, to enumerate domain groups for situational awareness and Active Directory Discovery.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-08-25
- **Author**: Mauricio Velazco, Splunk
- **ID**: df275a44-4527-443b-b884-7600e066e3eb
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This analytic looks for the execution of `powershell.exe` with command-line argu
| [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +107,10 @@ This analytic looks for the execution of `powershell.exe` with command-line argu
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `getwmiobject_ds_group_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **getwmiobject_ds_group_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* Processes.dest
@@ -86,9 +136,6 @@ Administrators or power users may use this command for troubleshooting.
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -98,8 +145,6 @@ Administrators or power users may use this command for troubleshooting.
| 15.0 | 30 | 50 | Domain group discovery enumeration on $dest$ by $user$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1069/002/](https://attack.mitre.org/techniques/T1069/002/)
@@ -108,7 +153,7 @@ Administrators or power users may use this command for troubleshooting.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md b/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md
index 26090da327..5e4319e7de 100644
--- a/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md
+++ b/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md
@@ -26,16 +26,21 @@ tags:
The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-WmiObject` commandlet used with specific parameters . The `DS_Group` parameter leverages WMI to query for all domain groups. Red Teams and adversaries may leverage this commandlet to enumerate domain groups for situational awareness and Active Directory Discovery.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-08-25
- **Author**: Mauricio Velazco, Splunk
- **ID**: 67740bd3-1506-469c-b91d-effc322cc6e5
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,51 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
| [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -54,10 +104,10 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `getwmiobject_ds_group_with_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **getwmiobject_ds_group_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -77,9 +127,6 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -89,8 +136,6 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo
| 15.0 | 30 | 50 | Domain group discovery enumeration using PowerShell on $dest$ by $user$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1069/002/](https://attack.mitre.org/techniques/T1069/002/)
@@ -99,7 +144,7 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md b/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md
index 4409899bbd..1e5abf7b0c 100644
--- a/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md
+++ b/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md
@@ -24,21 +24,71 @@ tags:
This analytic looks for the execution of `powershell.exe` executing the Get-ADDefaultDomainPasswordPolicy commandlet used to obtain the password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate domain policies for situational awareness and Active Directory Discovery.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-08-26
- **Author**: Teoderick Contreras, Splunk
- **ID**: 36e46ebe-065a-11ec-b4c7-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1201](https://attack.mitre.org/techniques/T1201/) | Password Policy Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +102,10 @@ This analytic looks for the execution of `powershell.exe` executing the Get-ADDe
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `get_addefaultdomainpasswordpolicy_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **get_addefaultdomainpasswordpolicy_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -79,9 +129,6 @@ Administrators or power users may use this command for troubleshooting.
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -91,8 +138,6 @@ Administrators or power users may use this command for troubleshooting.
| 9.0 | 30 | 30 | an instance of process $process_name$ with commandline $process$ in $dest$ |
-
-
#### Reference
* [https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet](https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet)
@@ -102,7 +147,7 @@ Administrators or power users may use this command for troubleshooting.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell_script_block.md b/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell_script_block.md
index 05f96286de..7304dc73dd 100644
--- a/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell_script_block.md
+++ b/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell_script_block.md
@@ -23,21 +23,71 @@ tags:
The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-ADDefaultDomainPasswordPolicy` commandlet used to obtain the password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate domain policies for situational awareness and Active Directory Discovery.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-08-26
- **Author**: Teoderick Contreras, Mauricio Velazco, Splunk
- **ID**: 1ff7ccc8-065a-11ec-91e4-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1201](https://attack.mitre.org/techniques/T1201/) | Password Policy Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -50,10 +100,10 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `get_addefaultdomainpasswordpolicy_with_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **get_addefaultdomainpasswordpolicy_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -73,9 +123,6 @@ Administrators or power users may use this command for troubleshooting.
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -85,8 +132,6 @@ Administrators or power users may use this command for troubleshooting.
| 9.0 | 30 | 30 | powershell process having commandline $Message$ to query domain password policy |
-
-
#### Reference
* [https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet](https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet)
@@ -96,7 +141,7 @@ Administrators or power users may use this command for troubleshooting.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md b/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md
index 325a8fe002..7181ea5035 100644
--- a/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md
+++ b/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md
@@ -24,21 +24,71 @@ tags:
This analytic looks for the execution of `powershell.exe` executing the Get ADUserResultantPasswordPolicy commandlet used to obtain the password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate domain policies for situational awareness and Active Directory Discovery.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-08-26
- **Author**: Teoderick Contreras, Mauricio Velazco, Splunk
- **ID**: 8b5ef342-065a-11ec-b0fc-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1201](https://attack.mitre.org/techniques/T1201/) | Password Policy Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +102,10 @@ This analytic looks for the execution of `powershell.exe` executing the Get ADUs
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `get_aduserresultantpasswordpolicy_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **get_aduserresultantpasswordpolicy_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -79,9 +129,6 @@ Administrators or power users may use this command for troubleshooting.
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -91,8 +138,6 @@ Administrators or power users may use this command for troubleshooting.
| 25.0 | 50 | 50 | an instance of process $process_name$ with commandline $process$ in $dest$ |
-
-
#### Reference
* [https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet](https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet)
@@ -102,7 +147,7 @@ Administrators or power users may use this command for troubleshooting.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell_script_block.md b/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell_script_block.md
index 381fe4ba77..9a2c8c73c8 100644
--- a/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell_script_block.md
+++ b/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell_script_block.md
@@ -23,21 +23,71 @@ tags:
The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-ADUserResultantPasswordPolicy` commandlet used to obtain the password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate domain policies for situational awareness and Active Directory Discovery.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-08-26
- **Author**: Teoderick Contreras, MAuricio Velazco, Splunk
- **ID**: 737e1eb0-065a-11ec-921a-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1201](https://attack.mitre.org/techniques/T1201/) | Password Policy Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -50,10 +100,10 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `get_aduserresultantpasswordpolicy_with_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **get_aduserresultantpasswordpolicy_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -73,9 +123,6 @@ Administrators or power users may use this command for troubleshooting.
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -85,8 +132,6 @@ Administrators or power users may use this command for troubleshooting.
| 9.0 | 30 | 30 | powershell process having commandline $Message$ to query domain user password policy. |
-
-
#### Reference
* [https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet](https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet)
@@ -96,7 +141,7 @@ Administrators or power users may use this command for troubleshooting.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-26-get_domainpolicy_with_powershell.md b/docs/_posts/2021-08-26-get_domainpolicy_with_powershell.md
index bee88d9cd2..59a92beff2 100644
--- a/docs/_posts/2021-08-26-get_domainpolicy_with_powershell.md
+++ b/docs/_posts/2021-08-26-get_domainpolicy_with_powershell.md
@@ -24,21 +24,71 @@ tags:
This analytic looks for the execution of `powershell.exe` executing the `Get-DomainPolicy` commandlet used to obtain the password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate domain policies for situational awareness and Active Directory Discovery.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-08-26
- **Author**: Teoderick Contreras, Mauricio Velazco, Splunk
- **ID**: b8f9947e-065a-11ec-aafb-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1201](https://attack.mitre.org/techniques/T1201/) | Password Policy Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +102,10 @@ This analytic looks for the execution of `powershell.exe` executing the `Get-Dom
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `get_domainpolicy_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **get_domainpolicy_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -79,9 +129,6 @@ Administrators or power users may use this command for troubleshooting.
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -91,8 +138,6 @@ Administrators or power users may use this command for troubleshooting.
| 30.0 | 50 | 60 | an instance of process $process_name$ with commandline $process$ in $dest$ |
-
-
#### Reference
* [https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet](https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet)
@@ -102,7 +147,7 @@ Administrators or power users may use this command for troubleshooting.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-26-get_domainpolicy_with_powershell_script_block.md b/docs/_posts/2021-08-26-get_domainpolicy_with_powershell_script_block.md
index 8cb69d431d..7fc5d84c27 100644
--- a/docs/_posts/2021-08-26-get_domainpolicy_with_powershell_script_block.md
+++ b/docs/_posts/2021-08-26-get_domainpolicy_with_powershell_script_block.md
@@ -23,21 +23,71 @@ tags:
The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get DomainPolicy` commandlet used to obtain the password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate domain policies for situational awareness and Active Directory Discovery.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-08-26
- **Author**: Teoderick Contreras, Splunk
- **ID**: a360d2b2-065a-11ec-b0bf-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1201](https://attack.mitre.org/techniques/T1201/) | Password Policy Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -50,10 +100,10 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `get_domainpolicy_with_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **get_domainpolicy_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -73,9 +123,6 @@ Administrators or power users may use this command for troubleshooting.
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -85,8 +132,6 @@ Administrators or power users may use this command for troubleshooting.
| 30.0 | 50 | 60 | powershell process having commandline $Message$ to query domain policy. |
-
-
#### Reference
* [https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet](https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet)
@@ -96,7 +141,7 @@ Administrators or power users may use this command for troubleshooting.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-26-getdomaingroup_with_powershell_script_block.md b/docs/_posts/2021-08-26-getdomaingroup_with_powershell_script_block.md
index 7755e5aefc..669cc8eec9 100644
--- a/docs/_posts/2021-08-26-getdomaingroup_with_powershell_script_block.md
+++ b/docs/_posts/2021-08-26-getdomaingroup_with_powershell_script_block.md
@@ -26,16 +26,21 @@ tags:
The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainGroup` commandlet. `Get-DomainGroup` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. As the name suggests, `Get-DomainGroup` is used to query domain groups. Red Teams and adversaries may leverage this function to enumerate domain groups for situational awareness and Active Directory Discovery.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-08-26
- **Author**: Mauricio Velazco, Splunk
- **ID**: 09725404-a44f-4ed3-9efa-8ed5d69e4c53
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,51 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
| [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -54,10 +104,10 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `getdomaingroup_with_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **getdomaingroup_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -77,9 +127,6 @@ Administrators or power users may use this PowerView functions for troubleshooti
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -89,8 +136,6 @@ Administrators or power users may use this PowerView functions for troubleshooti
| 15.0 | 30 | 50 | Domain group discovery enumeration using PowerView on $dest$ by $user$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1069/002/](https://attack.mitre.org/techniques/T1069/002/)
@@ -99,7 +144,7 @@ Administrators or power users may use this PowerView functions for troubleshooti
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-26-password_policy_discovery_with_net.md b/docs/_posts/2021-08-26-password_policy_discovery_with_net.md
index 79998c9c58..074ac6c176 100644
--- a/docs/_posts/2021-08-26-password_policy_discovery_with_net.md
+++ b/docs/_posts/2021-08-26-password_policy_discovery_with_net.md
@@ -24,21 +24,71 @@ tags:
This analytic looks for the execution of `net.exe` or `net1.exe` with command line arguments used to obtain the domain password policy. Red Teams and adversaries may leverage `net.exe` for situational awareness and Active Directory Discovery.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-08-26
- **Author**: Teoderick Contreras, Mauricio Velazco, Splunk
- **ID**: 09336538-065a-11ec-8665-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1201](https://attack.mitre.org/techniques/T1201/) | Password Policy Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +102,10 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command li
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `password_policy_discovery_with_net_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **password_policy_discovery_with_net_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -79,9 +129,6 @@ Administrators or power users may use this command for troubleshooting.
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -91,8 +138,6 @@ Administrators or power users may use this command for troubleshooting.
| 9.0 | 30 | 30 | an instance of process $process_name$ with commandline $process$ in $dest$ |
-
-
#### Reference
* [https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet](https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet)
@@ -100,7 +145,7 @@ Administrators or power users may use this command for troubleshooting.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-26-process_creating_lnk_file_in_suspicious_location.md b/docs/_posts/2021-08-26-process_creating_lnk_file_in_suspicious_location.md
index bcb93c7faa..e2c3fb2e82 100644
--- a/docs/_posts/2021-08-26-process_creating_lnk_file_in_suspicious_location.md
+++ b/docs/_posts/2021-08-26-process_creating_lnk_file_in_suspicious_location.md
@@ -27,16 +27,21 @@ tags:
This search looks for a process launching an `*.lnk` file under `C:\User*` or `*\Local\Temp\*`. This is common behavior used by various spear phishing tools.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-08-26
- **Author**: Jose Hernandez, Splunk
- **ID**: 5d814af1-1041-47b5-a9ac-d754e82e9a26
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,58 @@ This search looks for a process launching an `*.lnk` file under `C:\User*` or `*
| [T1566.002](https://attack.mitre.org/techniques/T1566/002/) | Spearphishing Link | Initial Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Installation
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* ID.AM
+* PR.DS
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 7
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -64,10 +121,10 @@ This search looks for a process launching an `*.lnk` file under `C:\User*` or `*
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `process_creating_lnk_file_in_suspicious_location_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **process_creating_lnk_file_in_suspicious_location_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -90,10 +147,6 @@ This detection should yield little or no false positive results. It is uncommon
* [Spearphishing Attachments](/stories/spearphishing_attachments)
-#### Kill Chain Phase
-* Installation
-* Actions on Objectives
-
#### RBA
@@ -103,8 +156,6 @@ This detection should yield little or no false positive results. It is uncommon
| 63.0 | 70 | 90 | A process $process_name$ that launching .lnk file in $file_path$ in host $dest$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1566/001/](https://attack.mitre.org/techniques/T1566/001/)
@@ -113,7 +164,7 @@ This detection should yield little or no false positive results. It is uncommon
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md b/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md
index 52d1e4a538..4901512136 100644
--- a/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md
+++ b/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md
@@ -29,21 +29,71 @@ A suspicious event will have `PowerShell`, the method `POST` and `autodiscover.j
An event will look similar to `POST /autodiscover/autodiscover.json a=dsxvu@fnsso.flq/powershell/?X-Rps-CAT=VgEAVAdXaW5kb3d...` (abbreviated) \
Review the source attempting to perform this activity against your environment. In addition, review PowerShell logs and access recently granted to Exchange roles.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-08-27
- **Author**: Michael Haag, Splunk
- **ID**: 29228ab4-0762-11ec-94aa-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1190](https://attack.mitre.org/techniques/T1190/) | Exploit Public-Facing Application | Initial Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +107,10 @@ Review the source attempting to perform this activity against your environment.
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [exchange](https://github.com/splunk/security_content/blob/develop/macros/exchange.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `exchange_powershell_abuse_via_ssrf_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **exchange_powershell_abuse_via_ssrf_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -80,9 +130,6 @@ Limited false positives, however, tune as needed.
* [ProxyShell](/stories/proxyshell)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -92,8 +139,6 @@ Limited false positives, however, tune as needed.
| 80.0 | 80 | 100 | Activity related to ProxyShell has been identified on $dest$. Review events and take action accordingly. |
-
-
#### Reference
* [https://github.com/GossiTheDog/ThreatHunting/blob/master/AzureSentinel/Exchange-Powershell-via-SSRF](https://github.com/GossiTheDog/ThreatHunting/blob/master/AzureSentinel/Exchange-Powershell-via-SSRF)
@@ -103,7 +148,7 @@ Limited false positives, however, tune as needed.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-27-exchange_powershell_module_usage.md b/docs/_posts/2021-08-27-exchange_powershell_module_usage.md
index 5e02ec540e..c15a96ad84 100644
--- a/docs/_posts/2021-08-27-exchange_powershell_module_usage.md
+++ b/docs/_posts/2021-08-27-exchange_powershell_module_usage.md
@@ -31,16 +31,21 @@ Inherently, the usage of the modules is not malicious, but reviewing parallel pr
Module - New-MailboxExportRequest will begin the process of exporting contents of a primary mailbox or archive to a .pst file. \
Module - New-managementroleassignment can assign a management role to a management role group, management role assignment policy, user, or universal security group (USG).
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-08-27
- **Author**: Michael Haag
- **ID**: 2d10095e-05ae-11ec-8fdf-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -48,6 +53,52 @@ Module - New-managementroleassignment can assign a management role to a manageme
| [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -60,10 +111,10 @@ Module - New-managementroleassignment can assign a management role to a manageme
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `exchange_powershell_module_usage_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **exchange_powershell_module_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -85,10 +136,6 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo
* [ProxyShell](/stories/proxyshell)
-#### Kill Chain Phase
-* Reconnaissance
-* Exploitation
-
#### RBA
@@ -98,8 +145,6 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo
| 15.0 | 30 | 50 | Local user discovery enumeration using PowerShell on $dest$ by $user$ |
-
-
#### Reference
* [https://docs.microsoft.com/en-us/powershell/module/exchange/new-mailboxexportrequest?view=exchange-ps](https://docs.microsoft.com/en-us/powershell/module/exchange/new-mailboxexportrequest?view=exchange-ps)
@@ -111,7 +156,7 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-30-domain_controller_discovery_with_nltest.md b/docs/_posts/2021-08-30-domain_controller_discovery_with_nltest.md
index 81b680c398..f2902e7957 100644
--- a/docs/_posts/2021-08-30-domain_controller_discovery_with_nltest.md
+++ b/docs/_posts/2021-08-30-domain_controller_discovery_with_nltest.md
@@ -24,21 +24,71 @@ tags:
This analytic looks for the execution of `nltest.exe` with command-line arguments utilized to discover remote systems. The arguments `/dclist:` and '/dsgetdc:', can be used to return a list of all domain controllers. Red Teams and adversaries alike may use nltest.exe to identify domain controllers in a Windows Domain for situational awareness and Active Directory Discovery.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-08-30
- **Author**: Mauricio Velazco, Splunk
- **ID**: 41243735-89a7-4c83-bcdd-570aa78f00a1
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +102,10 @@ This analytic looks for the execution of `nltest.exe` with command-line argument
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `domain_controller_discovery_with_nltest_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **domain_controller_discovery_with_nltest_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* Processes.dest
@@ -81,9 +131,6 @@ Administrators or power users may use this command for troubleshooting.
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -93,8 +140,6 @@ Administrators or power users may use this command for troubleshooting.
| 21.0 | 30 | 70 | Domain controller discovery on $dest$ by $user$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1018/](https://attack.mitre.org/techniques/T1018/)
@@ -102,7 +147,7 @@ Administrators or power users may use this command for troubleshooting.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-30-remote_system_discovery_with_net.md b/docs/_posts/2021-08-30-remote_system_discovery_with_net.md
index 4e461dad75..e29a587403 100644
--- a/docs/_posts/2021-08-30-remote_system_discovery_with_net.md
+++ b/docs/_posts/2021-08-30-remote_system_discovery_with_net.md
@@ -24,21 +24,71 @@ tags:
This analytic looks for the execution of `net.exe` or `net1.exe` with command-line arguments utilized to discover remote systems. The argument `domain computers /domain` returns a list of all domain computers. Red Teams and adversaries alike use net.exe to identify remote systems for situational awareness and Active Directory Discovery.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-08-30
- **Author**: Mauricio Velazco, Splunk
- **ID**: 9df16706-04a2-41e2-bbfe-9b38b34409d3
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +102,10 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-li
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `remote_system_discovery_with_net_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **remote_system_discovery_with_net_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* Processes.dest
@@ -81,9 +131,6 @@ Administrators or power users may use this command for troubleshooting.
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -93,8 +140,6 @@ Administrators or power users may use this command for troubleshooting.
| 15.0 | 30 | 50 | Remote system discovery enumeration on $dest$ by $user$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1018/](https://attack.mitre.org/techniques/T1018/)
@@ -102,7 +147,7 @@ Administrators or power users may use this command for troubleshooting.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-31-petitpotam_network_share_access_request.md b/docs/_posts/2021-08-31-petitpotam_network_share_access_request.md
index 374ea328be..2a711dfc8a 100644
--- a/docs/_posts/2021-08-31-petitpotam_network_share_access_request.md
+++ b/docs/_posts/2021-08-31-petitpotam_network_share_access_request.md
@@ -27,21 +27,75 @@ To enable 5145 events via Group Policy - Computer Configuration->Polices->Window
It is possible this is not enabled by default and may need to be reviewed and enabled. \
During triage, review parallel security events to identify further suspicious activity.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-08-31
- **Author**: Michael Haag, Mauricio Velazco, Splunk
- **ID**: 95b8061a-0a67-11ec-85ec-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1187](https://attack.mitre.org/techniques/T1187/) | Forced Authentication | Credential Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -54,10 +108,10 @@ During triage, review parallel security events to identify further suspicious ac
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `petitpotam_network_share_access_request_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **petitpotam_network_share_access_request_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -79,9 +133,6 @@ False positives have been limited when the Anonymous Logon is used for Account N
* [PetitPotam NTLM Relay on Active Directory Certificate Services](/stories/petitpotam_ntlm_relay_on_active_directory_certificate_services)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -91,14 +142,6 @@ False positives have been limited when the Anonymous Logon is used for Account N
| 56.0 | 80 | 70 | A remote host is enumerating a $dest$ to identify permissions. This is a precursor event to CVE-2021-36942, PetitPotam. |
-#### CVE
-
-| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
-| ----------- | ----------- | -------------- |
-| [CVE-2021-36942](https://nvd.nist.gov/vuln/detail/CVE-2021-36942) | Windows LSA Spoofing Vulnerability | 5.0 |
-
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1187/](https://attack.mitre.org/techniques/T1187/)
@@ -108,7 +151,7 @@ False positives have been limited when the Anonymous Logon is used for Account N
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md b/docs/_posts/2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md
index 85a010a918..72ea84432a 100644
--- a/docs/_posts/2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md
+++ b/docs/_posts/2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md
@@ -24,21 +24,75 @@ tags:
The following analytic identifes Event Code 4768, A `Kerberos authentication ticket (TGT) was requested`, successfull occurs. This behavior has been identified to assist with detecting PetitPotam, CVE-2021-36942. Once an attacer obtains a computer certificate by abusing Active Directory Certificate Services in combination with PetitPotam, the next step would be to leverage the certificate for malicious purposes. One way of doing this is to request a Kerberos Ticket Granting Ticket using a tool like Rubeus. This request will generate a 4768 event with some unusual fields depending on the environment. This analytic will require tuning, we recommend filtering Account_Name to Domain Controllers for your environment.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-08-31
- **Author**: Michael Haag, Mauricio Velazco, Splunk
- **ID**: e3ef244e-0a67-11ec-abf2-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
+| ----------- | ----------- | -------------- |
+| [CVE-2021-36942](https://nvd.nist.gov/vuln/detail/CVE-2021-36942) | Windows LSA Spoofing Vulnerability | 5.0 |
+
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -51,10 +105,10 @@ The following analytic identifes Event Code 4768, A `Kerberos authentication tic
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `petitpotam_suspicious_kerberos_tgt_request_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **petitpotam_suspicious_kerberos_tgt_request_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -75,9 +129,6 @@ False positives are possible if the environment is using certificates for authen
* [PetitPotam NTLM Relay on Active Directory Certificate Services](/stories/petitpotam_ntlm_relay_on_active_directory_certificate_services)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -87,14 +138,6 @@ False positives are possible if the environment is using certificates for authen
| 56.0 | 80 | 70 | A Kerberos TGT was requested in a non-standard manner against $dest$, potentially related to CVE-2021-36942, PetitPotam. |
-#### CVE
-
-| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
-| ----------- | ----------- | -------------- |
-| [CVE-2021-36942](https://nvd.nist.gov/vuln/detail/CVE-2021-36942) | Windows LSA Spoofing Vulnerability | 5.0 |
-
-
-
#### Reference
* [https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4768](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4768)
@@ -103,7 +146,7 @@ False positives are possible if the environment is using certificates for authen
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-08-31-remote_system_discovery_with_dsquery.md b/docs/_posts/2021-08-31-remote_system_discovery_with_dsquery.md
index ac348f75b1..2257445617 100644
--- a/docs/_posts/2021-08-31-remote_system_discovery_with_dsquery.md
+++ b/docs/_posts/2021-08-31-remote_system_discovery_with_dsquery.md
@@ -24,21 +24,71 @@ tags:
This analytic looks for the execution of `dsquery.exe` with command-line arguments utilized to discover remote systems. The `computer` argument returns a list of all computers registered in the domain. Red Teams and adversaries alike engage in remote system discovery for situational awareness and Active Directory Discovery.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-08-31
- **Author**: Mauricio Velazco, Splunk
- **ID**: 9fb562f4-42f8-4139-8e11-a82edf7ed718
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
+| ----------- | ----------- | -------------- |
+| [CVE-2021-36942](https://nvd.nist.gov/vuln/detail/CVE-2021-36942) | Windows LSA Spoofing Vulnerability | 5.0 |
+
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +102,10 @@ This analytic looks for the execution of `dsquery.exe` with command-line argumen
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `remote_system_discovery_with_dsquery_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **remote_system_discovery_with_dsquery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* Processes.dest
@@ -81,9 +131,6 @@ Administrators or power users may use this command for troubleshooting.
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -93,8 +140,6 @@ Administrators or power users may use this command for troubleshooting.
| 15.0 | 30 | 50 | Remote system discovery enumeration on $dest$ by $user$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1018/](https://attack.mitre.org/techniques/T1018/)
@@ -103,7 +148,7 @@ Administrators or power users may use this command for troubleshooting.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-01-circle_ci_disable_security_step.md b/docs/_posts/2021-09-01-circle_ci_disable_security_step.md
index cede4296ad..de512ad817 100644
--- a/docs/_posts/2021-09-01-circle_ci_disable_security_step.md
+++ b/docs/_posts/2021-09-01-circle_ci_disable_security_step.md
@@ -23,21 +23,77 @@ tags:
This search looks for disable security step in CircleCI pipeline.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-09-01
- **Author**: Patrick Bareiss, Splunk
- **ID**: 72cb9de9-e98b-4ac9-80b2-5331bba6ea97
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1554](https://attack.mitre.org/techniques/T1554/) | Compromise Client Software Binary | Persistence |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.DS
+* PR.AC
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 13
+
+
+
+
+
+
+
#### Search
```
@@ -64,7 +120,7 @@ The SPL above uses the following Macros:
* [circleci](https://github.com/splunk/security_content/blob/develop/macros/circleci.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `circle_ci_disable_security_step_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **circle_ci_disable_security_step_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Lookups
The SPL above uses the following Lookups:
@@ -85,9 +141,6 @@ unknown
* [Dev Sec Ops](/stories/dev_sec_ops)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -97,13 +150,11 @@ unknown
| 72.0 | 80 | 90 | disable security step $mandatory_step$ in job $job_name$ from user $user$ |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-01-domain_controller_discovery_with_wmic.md b/docs/_posts/2021-09-01-domain_controller_discovery_with_wmic.md
index 0a19282601..08187b3666 100644
--- a/docs/_posts/2021-09-01-domain_controller_discovery_with_wmic.md
+++ b/docs/_posts/2021-09-01-domain_controller_discovery_with_wmic.md
@@ -24,21 +24,71 @@ tags:
This analytic looks for the execution of `wmic.exe` with command-line arguments utilized to discover remote systems. The arguments utilized in this command line return a list of all domain controllers in a Windows domain. Red Teams and adversaries alike use *.exe to identify remote systems for situational awareness and Active Directory Discovery.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-09-01
- **Author**: Mauricio Velazco, Splunk
- **ID**: 64c7adaa-48ee-483c-b0d6-7175bc65e6cc
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +102,10 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `domain_controller_discovery_with_wmic_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **domain_controller_discovery_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* Processes.dest
@@ -81,9 +131,6 @@ Administrators or power users may use this command for troubleshooting.
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -93,8 +140,6 @@ Administrators or power users may use this command for troubleshooting.
| 21.0 | 30 | 70 | Domain controller discovery on $dest$ by $user$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1018/](https://attack.mitre.org/techniques/T1018/)
@@ -102,7 +147,7 @@ Administrators or power users may use this command for troubleshooting.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-01-domain_group_discovery_with_dsquery.md b/docs/_posts/2021-09-01-domain_group_discovery_with_dsquery.md
index f68c15444b..ded28ae614 100644
--- a/docs/_posts/2021-09-01-domain_group_discovery_with_dsquery.md
+++ b/docs/_posts/2021-09-01-domain_group_discovery_with_dsquery.md
@@ -27,16 +27,21 @@ tags:
This analytic looks for the execution of `dsquery.exe` with command-line arguments utilized to query for domain groups. The argument `group`, returns a list of all domain groups. Red Teams and adversaries alike use may leverage dsquery.exe to enumerate domain groups for situational awareness and Active Directory Discovery.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-09-01
- **Author**: Mauricio Velazco, Splunk
- **ID**: f0c9d62f-a232-4edd-b17e-bc409fb133d4
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This analytic looks for the execution of `dsquery.exe` with command-line argumen
| [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +107,10 @@ This analytic looks for the execution of `dsquery.exe` with command-line argumen
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `domain_group_discovery_with_dsquery_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **domain_group_discovery_with_dsquery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* Processes.dest
@@ -86,9 +136,6 @@ Administrators or power users may use this command for troubleshooting.
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -98,8 +145,6 @@ Administrators or power users may use this command for troubleshooting.
| 15.0 | 30 | 50 | Domain group discovery enumeration on $dest$ by $user$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1069/002/](https://attack.mitre.org/techniques/T1069/002/)
@@ -107,7 +152,7 @@ Administrators or power users may use this command for troubleshooting.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-01-getadcomputer_with_powershell_script_block.md b/docs/_posts/2021-09-01-getadcomputer_with_powershell_script_block.md
index 2e2c5901d7..06ef4b38a0 100644
--- a/docs/_posts/2021-09-01-getadcomputer_with_powershell_script_block.md
+++ b/docs/_posts/2021-09-01-getadcomputer_with_powershell_script_block.md
@@ -23,21 +23,71 @@ tags:
The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-AdGroup` commandlet. The `Get-AdGroup` commandlet is used to return a list of all domain computers. Red Teams and adversaries may leverage this commandlet to enumerate domain computers for situational awareness and Active Directory Discovery.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-09-01
- **Author**: Mauricio Velazco, Splunk
- **ID**: a9a1da02-8e27-4bf7-a348-f4389c9da487
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -49,10 +99,10 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `getadcomputer_with_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **getadcomputer_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -72,9 +122,6 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -84,8 +131,6 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo
| 15.0 | 30 | 50 | Remote system discovery enumeration on $dest$ by $user$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1018/](https://attack.mitre.org/techniques/T1018/)
@@ -94,7 +139,7 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md b/docs/_posts/2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md
index 0f2bcafb83..e5e3068d65 100644
--- a/docs/_posts/2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md
+++ b/docs/_posts/2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md
@@ -23,21 +23,71 @@ tags:
The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-WmiObject` commandlet. The `DS_Computer` class parameter leverages WMI to query for all domain computers. Red Teams and adversaries may leverage this commandlet to enumerate domain computers for situational awareness and Active Directory Discovery.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-09-01
- **Author**: Mauricio Velazco, Splunk
- **ID**: 29b99201-723c-4118-847a-db2b3d3fb8ea
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -49,10 +99,10 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `getwmiobject_ds_computer_with_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **getwmiobject_ds_computer_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -72,9 +122,6 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -84,8 +131,6 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo
| 15.0 | 30 | 50 | Remote system discovery enumeration on $dest$ by $user$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1018/](https://attack.mitre.org/techniques/T1018/)
@@ -94,7 +139,7 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-01-github_commit_in_develop.md b/docs/_posts/2021-09-01-github_commit_in_develop.md
index c1d9289f34..295fa24353 100644
--- a/docs/_posts/2021-09-01-github_commit_in_develop.md
+++ b/docs/_posts/2021-09-01-github_commit_in_develop.md
@@ -23,21 +23,71 @@ tags:
This search is to detect a pushed or commit to develop branch. This is to avoid unwanted modification to develop without a review to the changes. Ideally in terms of devsecops the changes made in a branch and do a PR for review. of course in some cases admin of the project may did a changes directly to master branch
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-09-01
- **Author**: Teoderick Contreras, Splunk
- **ID**: f3030cb6-0b02-11ec-8f22-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1199](https://attack.mitre.org/techniques/T1199/) | Trusted Relationship | Initial Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -51,10 +101,10 @@ This search is to detect a pushed or commit to develop branch. This is to avoid
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `github_commit_in_develop_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **github_commit_in_develop_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -70,9 +120,6 @@ admin can do changes directly to develop branch
* [Dev Sec Ops](/stories/dev_sec_ops)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -82,8 +129,6 @@ admin can do changes directly to develop branch
| 9.0 | 30 | 30 | suspicious commit by $commit.commit.author.email$ to develop branch |
-
-
#### Reference
* [https://www.redhat.com/en/topics/devops/what-is-devsecops](https://www.redhat.com/en/topics/devops/what-is-devsecops)
@@ -91,7 +136,7 @@ admin can do changes directly to develop branch
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-01-github_dependabot_alert.md b/docs/_posts/2021-09-01-github_dependabot_alert.md
index b2a1d869e0..bb9da9f88c 100644
--- a/docs/_posts/2021-09-01-github_dependabot_alert.md
+++ b/docs/_posts/2021-09-01-github_dependabot_alert.md
@@ -26,16 +26,21 @@ tags:
This search looks for Dependabot Alerts in Github logs.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-09-01
- **Author**: Patrick Bareiss, Splunk
- **ID**: 05032b04-4469-4034-9df7-05f607d75cba
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,57 @@ This search looks for Dependabot Alerts in Github logs.
| [T1195](https://attack.mitre.org/techniques/T1195/) | Supply Chain Compromise | Initial Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.DS
+* PR.AC
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 13
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +113,10 @@ This search looks for Dependabot Alerts in Github logs.
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `github_dependabot_alert_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **github_dependabot_alert_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -87,9 +143,6 @@ unknown
* [Dev Sec Ops](/stories/dev_sec_ops)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -99,8 +152,6 @@ unknown
| 27.0 | 30 | 90 | Vulnerabilities found in packages used by GitHub repository $repository$ |
-
-
#### Reference
* [https://www.splunk.com/en_us/blog/tips-and-tricks/getting-github-data-with-webhooks.html](https://www.splunk.com/en_us/blog/tips-and-tricks/getting-github-data-with-webhooks.html)
@@ -108,7 +159,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md b/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md
index 9d68f6b235..6cfc74bc7e 100644
--- a/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md
+++ b/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md
@@ -26,16 +26,21 @@ tags:
This search looks for Pull Request from unknown user.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-09-01
- **Author**: Patrick Bareiss, Splunk
- **ID**: 9d7b9100-8878-4404-914e-ca5e551a641e
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,57 @@ This search looks for Pull Request from unknown user.
| [T1195](https://attack.mitre.org/techniques/T1195/) | Supply Chain Compromise | Initial Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.DS
+* PR.AC
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 13
+
+
+
+
+
+
+
#### Search
```
@@ -58,11 +114,11 @@ This search looks for Pull Request from unknown user.
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [github_known_users](https://github.com/splunk/security_content/blob/develop/macros/github_known_users.yml)
* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `github_pull_request_from_unknown_user_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **github_pull_request_from_unknown_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -89,9 +145,6 @@ unknown
* [Dev Sec Ops](/stories/dev_sec_ops)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -101,8 +154,6 @@ unknown
| 27.0 | 30 | 90 | Vulnerabilities found in packages used by GitHub repository $repository$ |
-
-
#### Reference
* [https://www.splunk.com/en_us/blog/tips-and-tricks/getting-github-data-with-webhooks.html](https://www.splunk.com/en_us/blog/tips-and-tricks/getting-github-data-with-webhooks.html)
@@ -110,7 +161,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-01-remote_system_discovery_with_adsisearcher.md b/docs/_posts/2021-09-01-remote_system_discovery_with_adsisearcher.md
index f3267d51e9..59c88fc53a 100644
--- a/docs/_posts/2021-09-01-remote_system_discovery_with_adsisearcher.md
+++ b/docs/_posts/2021-09-01-remote_system_discovery_with_adsisearcher.md
@@ -23,21 +23,71 @@ tags:
The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the `[Adsisearcher]` type accelerator being used to query Active Directory for domain computers. Red Teams and adversaries may leverage `[Adsisearcher]` to enumerate domain computers for situational awareness and Active Directory Discovery.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-09-01
- **Author**: Mauricio Velazco, Splunk
- **ID**: 70803451-0047-4e12-9d63-77fa7eb8649c
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -49,10 +99,10 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `remote_system_discovery_with_adsisearcher_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **remote_system_discovery_with_adsisearcher_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -72,9 +122,6 @@ Administrators or power users may use Adsisearcher for troubleshooting.
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -84,8 +131,6 @@ Administrators or power users may use Adsisearcher for troubleshooting.
| 15.0 | 30 | 50 | Remote system discovery enumeration on $dest$ by $user$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1018/](https://attack.mitre.org/techniques/T1018/)
@@ -94,7 +139,7 @@ Administrators or power users may use Adsisearcher for troubleshooting.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-01-remote_system_discovery_with_wmic.md b/docs/_posts/2021-09-01-remote_system_discovery_with_wmic.md
index f02807f18c..c2020345d4 100644
--- a/docs/_posts/2021-09-01-remote_system_discovery_with_wmic.md
+++ b/docs/_posts/2021-09-01-remote_system_discovery_with_wmic.md
@@ -24,21 +24,71 @@ tags:
This analytic looks for the execution of `wmic.exe` with command-line arguments utilized to discover remote systems. The arguments utilized in this command return a list of all the systems registered in the domain. Red Teams and adversaries alike may leverage WMI and wmic.exe to identify remote systems for situational awareness and Active Directory Discovery.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-09-01
- **Author**: Mauricio Velazco, Splunk
- **ID**: d82eced3-b1dc-42ab-859e-a2fc98827359
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +102,10 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `remote_system_discovery_with_wmic_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **remote_system_discovery_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* Processes.dest
@@ -81,9 +131,6 @@ Administrators or power users may use this command for troubleshooting.
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -93,8 +140,6 @@ Administrators or power users may use this command for troubleshooting.
| 15.0 | 30 | 50 | Remote system discovery enumeration on $dest$ by $user$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1018/](https://attack.mitre.org/techniques/T1018/)
@@ -103,7 +148,7 @@ Administrators or power users may use this command for troubleshooting.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-02-circle_ci_disable_security_job.md b/docs/_posts/2021-09-02-circle_ci_disable_security_job.md
index 5cb649e506..15a7466b8c 100644
--- a/docs/_posts/2021-09-02-circle_ci_disable_security_job.md
+++ b/docs/_posts/2021-09-02-circle_ci_disable_security_job.md
@@ -23,21 +23,77 @@ tags:
This search looks for disable security job in CircleCI pipeline.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-09-02
- **Author**: Patrick Bareiss, Splunk
- **ID**: 4a2fdd41-c578-4cd4-9ef7-980e352517f2
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1554](https://attack.mitre.org/techniques/T1554/) | Compromise Client Software Binary | Persistence |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.DS
+* PR.AC
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 13
+
+
+
+
+
+
+
#### Search
```
@@ -60,7 +116,7 @@ The SPL above uses the following Macros:
* [circleci](https://github.com/splunk/security_content/blob/develop/macros/circleci.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `circle_ci_disable_security_job_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **circle_ci_disable_security_job_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Lookups
The SPL above uses the following Lookups:
@@ -81,9 +137,6 @@ unknown
* [Dev Sec Ops](/stories/dev_sec_ops)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -93,13 +146,11 @@ unknown
| 72.0 | 80 | 90 | disable security job $mandatory_job$ in workflow $workflow_name$ from user $user$ |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md b/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md
index f193025325..77392f5e2f 100644
--- a/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md
+++ b/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md
@@ -24,21 +24,71 @@ tags:
This analytic identifies Get-ForestTrust from PowerSploit in order to gather domain trust information. Typically, this is utilized within a script being executed and used to enumerate the domain trust information. This grants the adversary an understanding of how large or small the domain is. During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-09-02
- **Author**: Michael Haag, Splunk
- **ID**: 584f4884-0bf1-11ec-a5ec-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1482](https://attack.mitre.org/techniques/T1482/) | Domain Trust Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +102,10 @@ This analytic identifies Get-ForestTrust from PowerSploit in order to gather dom
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `get-foresttrust_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **get-foresttrust_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -82,9 +132,6 @@ Limited false positives as this requires an active Administrator or adversary to
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -94,8 +141,6 @@ Limited false positives as this requires an active Administrator or adversary to
| 12.0 | 30 | 40 | Suspicious PowerShell Get-ForestTrust was identified on endpoint $dest$ by user $user$. |
-
-
#### Reference
* [https://powersploit.readthedocs.io/en/latest/Recon/Get-ForestTrust/](https://powersploit.readthedocs.io/en/latest/Recon/Get-ForestTrust/)
@@ -103,7 +148,7 @@ Limited false positives as this requires an active Administrator or adversary to
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-02-get-foresttrust_with_powershell_script_block.md b/docs/_posts/2021-09-02-get-foresttrust_with_powershell_script_block.md
index 11e385f0e1..54a0879385 100644
--- a/docs/_posts/2021-09-02-get-foresttrust_with_powershell_script_block.md
+++ b/docs/_posts/2021-09-02-get-foresttrust_with_powershell_script_block.md
@@ -25,21 +25,71 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
This analytic identifies Get-ForestTrust from PowerSploit in order to gather domain trust information. \
During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-09-02
- **Author**: Michael Haag, Splunk
- **ID**: 70fac80e-0bf1-11ec-9ba0-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1482](https://attack.mitre.org/techniques/T1482/) | Domain Trust Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +102,10 @@ During triage, review parallel processes using an EDR product or 4688 events. It
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `get-foresttrust_with_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **get-foresttrust_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -77,9 +127,6 @@ UPDATE_KNOWN_FALSE_POSITIVES
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -89,8 +136,6 @@ UPDATE_KNOWN_FALSE_POSITIVES
| 12.0 | 30 | 40 | Suspicious PowerShell Get-ForestTrust was identified on endpoint $ComputerName$ by user $User$. |
-
-
#### Reference
* [https://powersploit.readthedocs.io/en/latest/Recon/Get-ForestTrust/](https://powersploit.readthedocs.io/en/latest/Recon/Get-ForestTrust/)
@@ -98,7 +143,7 @@ UPDATE_KNOWN_FALSE_POSITIVES
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-02-getdomaincomputer_with_powershell_script_block.md b/docs/_posts/2021-09-02-getdomaincomputer_with_powershell_script_block.md
index c926fdd8f8..bab9ea64b1 100644
--- a/docs/_posts/2021-09-02-getdomaincomputer_with_powershell_script_block.md
+++ b/docs/_posts/2021-09-02-getdomaincomputer_with_powershell_script_block.md
@@ -23,21 +23,71 @@ tags:
The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainComputer` commandlet. `GetDomainComputer` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may use PowerView to enumerate domain computers for situational awareness and Active Directory Discovery.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-09-02
- **Author**: Mauricio Velazco, Splunk
- **ID**: f64da023-b988-4775-8d57-38e512beb56e
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -49,10 +99,10 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `getdomaincomputer_with_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **getdomaincomputer_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -72,9 +122,6 @@ Administrators or power users may use PowerView for troubleshooting.
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -84,8 +131,6 @@ Administrators or power users may use PowerView for troubleshooting.
| 24.0 | 30 | 80 | Remote system discovery with PowerView on $dest$ by $user$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1018/](https://attack.mitre.org/techniques/T1018/)
@@ -94,7 +139,7 @@ Administrators or power users may use PowerView for troubleshooting.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-02-getdomaincontroller_with_powershell_script_block.md b/docs/_posts/2021-09-02-getdomaincontroller_with_powershell_script_block.md
index e54f4bbcb3..8587fa0d68 100644
--- a/docs/_posts/2021-09-02-getdomaincontroller_with_powershell_script_block.md
+++ b/docs/_posts/2021-09-02-getdomaincontroller_with_powershell_script_block.md
@@ -23,21 +23,71 @@ tags:
The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainController` commandlet. `Get-DomainController` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may use PowerView to enumerate domain computers for situational awareness and Active Directory Discovery.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-09-02
- **Author**: Mauricio Velazco, Splunk
- **ID**: 676b600a-a94d-4951-b346-11329431e6c1
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -49,10 +99,10 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `getdomaincontroller_with_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **getdomaincontroller_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -72,9 +122,6 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -84,8 +131,6 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo
| 24.0 | 30 | 80 | Remote system discovery with PowerView on $dest$ by $user$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1018/](https://attack.mitre.org/techniques/T1018/)
@@ -94,7 +139,7 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-06-bcdedit_command_back_to_normal_mode_boot.md b/docs/_posts/2021-09-06-bcdedit_command_back_to_normal_mode_boot.md
index a6dc7c5ae1..f95cb82a9b 100644
--- a/docs/_posts/2021-09-06-bcdedit_command_back_to_normal_mode_boot.md
+++ b/docs/_posts/2021-09-06-bcdedit_command_back_to_normal_mode_boot.md
@@ -24,21 +24,71 @@ tags:
This search is to detect a suspicious bcdedit commandline to configure the host from safe mode back to normal boot configuration. This technique was seen in blackMatter ransomware where it force the compromised host to boot in safe mode to continue its encryption and bring back to normal boot using bcdedit deletevalue command. This TTP can be a good alert for host that booted from safe mode forcefully since it need to modify the boot configuration to bring it back to normal.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-09-06
- **Author**: Teoderick Contreras, Splunk
- **ID**: dc7a8004-0f18-11ec-8c54-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1490](https://attack.mitre.org/techniques/T1490/) | Inhibit System Recovery | Impact |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +102,10 @@ This search is to detect a suspicious bcdedit commandline to configure the host
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `bcdedit_command_back_to_normal_mode_boot_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **bcdedit_command_back_to_normal_mode_boot_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -77,9 +127,6 @@ unknown
* [BlackMatter Ransomware](/stories/blackmatter_ransomware)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -89,8 +136,6 @@ unknown
| 35.0 | 50 | 70 | bcdedit process with commandline $process$ to bring back to normal boot configuration the $dest$ |
-
-
#### Reference
* [https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/](https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/)
@@ -98,7 +143,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-06-change_to_safe_mode_with_network_config.md b/docs/_posts/2021-09-06-change_to_safe_mode_with_network_config.md
index 6450cb4920..9e88e01d9d 100644
--- a/docs/_posts/2021-09-06-change_to_safe_mode_with_network_config.md
+++ b/docs/_posts/2021-09-06-change_to_safe_mode_with_network_config.md
@@ -24,21 +24,71 @@ tags:
This search is to detect a suspicious bcdedit commandline to configure the host to boot in safe mode with network config. This technique was seen in blackMatter ransomware where it force the compromised host to boot in safe mode to continue its encryption and bring back to normal boot using bcdedit deletevalue command. This TTP can be a good alert for host that booted from safe mode forcefully since it need to modify the boot configuration to bring it back to normal.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-09-06
- **Author**: Teoderick Contreras, Splunk
- **ID**: 81f1dce0-0f18-11ec-a5d7-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1490](https://attack.mitre.org/techniques/T1490/) | Inhibit System Recovery | Impact |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +102,10 @@ This search is to detect a suspicious bcdedit commandline to configure the host
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `change_to_safe_mode_with_network_config_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **change_to_safe_mode_with_network_config_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -77,9 +127,6 @@ unknown
* [BlackMatter Ransomware](/stories/blackmatter_ransomware)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -89,8 +136,6 @@ unknown
| 25.0 | 50 | 50 | bcdedit process with commandline $process$ to force safemode boot the $dest$ |
-
-
#### Reference
* [https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/](https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/)
@@ -98,7 +143,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-06-correlation_by_repository_and_risk.md b/docs/_posts/2021-09-06-correlation_by_repository_and_risk.md
index 0b772e48cf..1686072b64 100644
--- a/docs/_posts/2021-09-06-correlation_by_repository_and_risk.md
+++ b/docs/_posts/2021-09-06-correlation_by_repository_and_risk.md
@@ -26,16 +26,21 @@ tags:
This search correlations detections by repository and risk_score
-- **Type**: [Correlation](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Correlation](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-09-06
- **Author**: Patrick Bareiss, Splunk
- **ID**: 8da9fdd9-6a1b-4ae0-8a34-8c25e6be9687
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,57 @@ This search correlations detections by repository and risk_score
| [T1204](https://attack.mitre.org/techniques/T1204/) | User Execution | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.DS
+* PR.AC
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 13
+
+
+
+
+
+
+
#### Search
```
@@ -58,7 +114,7 @@ This search correlations detections by repository and risk_score
The SPL above uses the following Macros:
* [signals](https://github.com/splunk/security_content/blob/develop/macros/signals.yml)
-Note that `correlation_by_repository_and_risk_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **correlation_by_repository_and_risk_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -74,9 +130,6 @@ unknown
* [Dev Sec Ops](/stories/dev_sec_ops)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -86,13 +139,11 @@ unknown
| 70.0 | 70 | 100 | Correlation triggered for user $user$ |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-06-correlation_by_user_and_risk.md b/docs/_posts/2021-09-06-correlation_by_user_and_risk.md
index 868cdd6910..3909edb3f4 100644
--- a/docs/_posts/2021-09-06-correlation_by_user_and_risk.md
+++ b/docs/_posts/2021-09-06-correlation_by_user_and_risk.md
@@ -26,16 +26,21 @@ tags:
This search correlations detections by user and risk_score
-- **Type**: [Correlation](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Correlation](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-09-06
- **Author**: Patrick Bareiss, Splunk
- **ID**: 610e12dc-b6fa-4541-825e-4a0b3b6f6773
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,57 @@ This search correlations detections by user and risk_score
| [T1204](https://attack.mitre.org/techniques/T1204/) | User Execution | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.DS
+* PR.AC
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 13
+
+
+
+
+
+
+
#### Search
```
@@ -58,7 +114,7 @@ This search correlations detections by user and risk_score
The SPL above uses the following Macros:
* [signals](https://github.com/splunk/security_content/blob/develop/macros/signals.yml)
-Note that `correlation_by_user_and_risk_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **correlation_by_user_and_risk_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -74,9 +130,6 @@ unknown
* [Dev Sec Ops](/stories/dev_sec_ops)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -86,13 +139,11 @@ unknown
| 70.0 | 70 | 100 | Correlation triggered for user $user$ |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-07-getadcomputer_with_powershell.md b/docs/_posts/2021-09-07-getadcomputer_with_powershell.md
index 262f573ad3..af3985fa64 100644
--- a/docs/_posts/2021-09-07-getadcomputer_with_powershell.md
+++ b/docs/_posts/2021-09-07-getadcomputer_with_powershell.md
@@ -24,21 +24,71 @@ tags:
This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to discover remote systems. The `Get-AdComputer' commandlet returns a list of all domain computers. Red Teams and adversaries alike may use this commandlet to identify remote systems for situational awareness and Active Directory Discovery.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-09-07
- **Author**: Mauricio Velazco, Splunk
- **ID**: c5a31f80-5888-4d81-9f78-1cc65026316e
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +102,10 @@ This analytic looks for the execution of `powershell.exe` with command-line argu
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `getadcomputer_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **getadcomputer_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* Processes.dest
@@ -81,9 +131,6 @@ Administrators or power users may use this command for troubleshooting.
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -93,8 +140,6 @@ Administrators or power users may use this command for troubleshooting.
| 15.0 | 30 | 50 | Remote system discovery enumeration on $dest$ by $user$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1018/](https://attack.mitre.org/techniques/T1018/)
@@ -102,7 +147,7 @@ Administrators or power users may use this command for troubleshooting.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-07-getdomaincomputer_with_powershell.md b/docs/_posts/2021-09-07-getdomaincomputer_with_powershell.md
index 0be25a3ee4..652c2bbf63 100644
--- a/docs/_posts/2021-09-07-getdomaincomputer_with_powershell.md
+++ b/docs/_posts/2021-09-07-getdomaincomputer_with_powershell.md
@@ -24,21 +24,71 @@ tags:
This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to discover remote systems. `Get-DomainComputer` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may leverage PowerView to enumerate domain groups for situational awareness and Active Directory Discovery.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-09-07
- **Author**: Mauricio Velazco, Splunk
- **ID**: ed550c19-712e-43f6-bd19-6f58f61b3a5e
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +102,10 @@ This analytic looks for the execution of `powershell.exe` with command-line argu
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `getdomaincomputer_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **getdomaincomputer_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* Processes.dest
@@ -81,9 +131,6 @@ Administrators or power users may use PowerView for troubleshooting.
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -93,8 +140,6 @@ Administrators or power users may use PowerView for troubleshooting.
| 24.0 | 30 | 80 | Remote system discovery enumeration on $dest$ by $user$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1018/](https://attack.mitre.org/techniques/T1018/)
@@ -102,7 +147,7 @@ Administrators or power users may use PowerView for troubleshooting.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-07-getdomaincontroller_with_powershell.md b/docs/_posts/2021-09-07-getdomaincontroller_with_powershell.md
index 286aa7e56b..70c9b0df61 100644
--- a/docs/_posts/2021-09-07-getdomaincontroller_with_powershell.md
+++ b/docs/_posts/2021-09-07-getdomaincontroller_with_powershell.md
@@ -24,21 +24,71 @@ tags:
This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to discover remote systems. `Get-DomainController` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may leverage PowerView to enumerate domain groups for situational awareness and Active Directory Discovery.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-09-07
- **Author**: Mauricio Velazco, Splunk
- **ID**: 868ee0e4-52ab-484a-833a-6d85b7c028d0
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +102,10 @@ This analytic looks for the execution of `powershell.exe` with command-line argu
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `getdomaincontroller_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **getdomaincontroller_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* Processes.dest
@@ -81,9 +131,6 @@ Administrators or power users may use PowerView for troubleshooting.
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -93,8 +140,6 @@ Administrators or power users may use PowerView for troubleshooting.
| 24.0 | 30 | 80 | Remote system discovery using PowerView on $dest$ by $user$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1018/](https://attack.mitre.org/techniques/T1018/)
@@ -103,7 +148,7 @@ Administrators or power users may use PowerView for troubleshooting.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-07-getwmiobject_ds_computer_with_powershell.md b/docs/_posts/2021-09-07-getwmiobject_ds_computer_with_powershell.md
index 836f811c00..1db32dc7a8 100644
--- a/docs/_posts/2021-09-07-getwmiobject_ds_computer_with_powershell.md
+++ b/docs/_posts/2021-09-07-getwmiobject_ds_computer_with_powershell.md
@@ -24,21 +24,71 @@ tags:
This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to discover remote systems. The `Get-WmiObject` commandlet combined with the `DS_Computer` parameter can be used to return a list of all domain computers. Red Teams and adversaries alike may leverage WMI in this case, using PowerShell, to enumerate domain groups for situational awareness and Active Directory Discovery.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-09-07
- **Author**: Mauricio Velazco, Splunk
- **ID**: 7141122c-3bc2-4aaa-ab3b-7a85a0bbefc3
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +102,10 @@ This analytic looks for the execution of `powershell.exe` with command-line argu
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `getwmiobject_ds_computer_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **getwmiobject_ds_computer_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* Processes.dest
@@ -81,9 +131,6 @@ Administrators or power users may use this command for troubleshooting.
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -93,8 +140,6 @@ Administrators or power users may use this command for troubleshooting.
| 21.0 | 30 | 70 | Remote system discovery enumeration using WMI on $dest$ by $user$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1018/](https://attack.mitre.org/techniques/T1018/)
@@ -102,7 +147,7 @@ Administrators or power users may use this command for troubleshooting.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md b/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md
index be26063d31..b0576cbb0c 100644
--- a/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md
+++ b/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md
@@ -27,16 +27,21 @@ tags:
This analytic is to detect an application try to connect and create ADSI Object to do LDAP query. Every time an application connects to the directory and attempts to create an ADSI object, the Active Directory Schema is checked for changes. If it has changed since the last connection, the schema is downloaded and stored in a cache on the local computer either in %LOCALAPPDATA%\Microsoft\Windows\SchCache or %systemroot%\SchCache. We found this a good anomaly use case to detect suspicious application like blackmatter ransomware that use ADS object api to execute ldap query. having a good list of ldap or normal AD query tool used within the network is a good start to reduce the noise.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-09-07
- **Author**: Teoderick Contreras, Splunk
- **ID**: 991eb510-0fc6-11ec-82d3-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This analytic is to detect an application try to connect and create ADSI Object
| [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -56,10 +106,10 @@ This analytic is to detect an application try to connect and create ADSI Object
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `schcache_change_by_app_connect_and_create_adsi_object_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **schcache_change_by_app_connect_and_create_adsi_object_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -81,9 +131,6 @@ normal application like mmc.exe and other ldap query tool may trigger this detec
* [blackMatter ransomware](/stories/blackmatter_ransomware)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -93,8 +140,6 @@ normal application like mmc.exe and other ldap query tool may trigger this detec
| 25.0 | 50 | 50 | process $Image$ create a file $TargetFilename$ in host $Computer$ |
-
-
#### Reference
* [https://docs.microsoft.com/en-us/windows/win32/adsi/adsi-and-uac](https://docs.microsoft.com/en-us/windows/win32/adsi/adsi-and-uac)
@@ -103,7 +148,7 @@ normal application like mmc.exe and other ldap query tool may trigger this detec
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-07-system_information_discovery_detection.md b/docs/_posts/2021-09-07-system_information_discovery_detection.md
index d1bd0c57d9..a2c924e506 100644
--- a/docs/_posts/2021-09-07-system_information_discovery_detection.md
+++ b/docs/_posts/2021-09-07-system_information_discovery_detection.md
@@ -24,21 +24,76 @@ tags:
Detect system information discovery techniques used by attackers to understand configurations of the system to further exploit it.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-09-07
- **Author**: Patrick Bareiss, Splunk
- **ID**: 8e99f89e-ae58-4ebc-bf52-ae0b1a277e72
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1082](https://attack.mitre.org/techniques/T1082/) | System Information Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 6
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -55,10 +110,10 @@ Detect system information discovery techniques used by attackers to understand c
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `system_information_discovery_detection_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **system_information_discovery_detection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -78,9 +133,6 @@ Administrators debugging servers
* [Discovery Techniques](/stories/discovery_techniques)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -90,8 +142,6 @@ Administrators debugging servers
| 15.0 | 30 | 50 | Potential system information discovery behavior on $dest$ by $User$ |
-
-
#### Reference
* [https://oscp.infosecsanyam.in/priv-escalation/windows-priv-escalation](https://oscp.infosecsanyam.in/priv-escalation/windows-priv-escalation)
@@ -99,7 +149,7 @@ Administrators debugging servers
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-08-control_loading_from_world_writable_directory.md b/docs/_posts/2021-09-08-control_loading_from_world_writable_directory.md
index f7e3717d39..3578087dc0 100644
--- a/docs/_posts/2021-09-08-control_loading_from_world_writable_directory.md
+++ b/docs/_posts/2021-09-08-control_loading_from_world_writable_directory.md
@@ -28,16 +28,21 @@ tags:
The following detection identifies control.exe loading either a .cpl or .inf from a writable directory. This is related to CVE-2021-40444. During triage, review parallel processes, parent and child, for further suspicious behaviors. In addition, capture file modifications and analyze.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-09-08
- **Author**: Michael Haag, Splunk
- **ID**: 10423ac4-10c9-11ec-8dc4-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -45,6 +50,55 @@ The following detection identifies control.exe loading either a .cpl or .inf fro
| [T1218.002](https://attack.mitre.org/techniques/T1218/002/) | Control Panel | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -58,10 +112,10 @@ The following detection identifies control.exe loading either a .cpl or .inf fro
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `control_loading_from_world_writable_directory_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **control_loading_from_world_writable_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* Processes.dest
@@ -88,9 +142,6 @@ Limited false positives will be present as control.exe does not natively load fr
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -100,14 +151,6 @@ Limited false positives will be present as control.exe does not natively load fr
| 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to load a suspicious file from disk. |
-#### CVE
-
-| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
-| ----------- | ----------- | -------------- |
-| [CVE-2021-40444](https://nvd.nist.gov/vuln/detail/CVE-2021-40444) | Microsoft MSHTML Remote Code Execution Vulnerability | 6.8 |
-
-
-
#### Reference
* [https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html](https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html)
@@ -119,7 +162,7 @@ Limited false positives will be present as control.exe does not natively load fr
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-08-create_local_admin_accounts_using_net_exe.md b/docs/_posts/2021-09-08-create_local_admin_accounts_using_net_exe.md
index db9d6bebe0..89b17543f7 100644
--- a/docs/_posts/2021-09-08-create_local_admin_accounts_using_net_exe.md
+++ b/docs/_posts/2021-09-08-create_local_admin_accounts_using_net_exe.md
@@ -27,16 +27,21 @@ tags:
This search looks for the creation of local administrator accounts using net.exe .
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-09-08
- **Author**: Bhavin Patel, Splunk
- **ID**: b89919ed-fe5f-492c-b139-151bb162040e
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
+| ----------- | ----------- | -------------- |
+| [CVE-2021-40444](https://nvd.nist.gov/vuln/detail/CVE-2021-40444) | Microsoft MSHTML Remote Code Execution Vulnerability | 6.8 |
+
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,56 @@ This search looks for the creation of local administrator accounts using net.exe
| [T1136](https://attack.mitre.org/techniques/T1136/) | Create Account | Persistence |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +112,10 @@ This search looks for the creation of local administrator accounts using net.exe
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `create_local_admin_accounts_using_net_exe_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **create_local_admin_accounts_using_net_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -87,9 +142,6 @@ Administrators often leverage net.exe to create admin accounts.
* [DHS Report TA18-074A](/stories/dhs_report_ta18-074a)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -99,13 +151,11 @@ Administrators often leverage net.exe to create admin accounts.
| 30.0 | 50 | 60 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to add a user to the local Administrators group. |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-08-office_spawning_control.md b/docs/_posts/2021-09-08-office_spawning_control.md
index a6cda175c7..551671112f 100644
--- a/docs/_posts/2021-09-08-office_spawning_control.md
+++ b/docs/_posts/2021-09-08-office_spawning_control.md
@@ -28,16 +28,21 @@ tags:
The following detection identifies control.exe spawning from an office product. This detection identifies any Windows Office Product spawning `control.exe`. In malicious instances, the command-line of `control.exe` will contain a file path to a .cpl or .inf, related to CVE-2021-40444. In this instance, we narrow our detection down to the Office suite as a parent process. During triage, review all file modifications. Capture and analyze any artifacts on disk. review parallel and child processes to identify further suspicious behavior
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-09-08
- **Author**: Michael Haag, Splunk
- **ID**: 053e027c-10c7-11ec-8437-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -45,6 +50,55 @@ The following detection identifies control.exe spawning from an office product.
| [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -58,10 +112,10 @@ The following detection identifies control.exe spawning from an office product.
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `office_spawning_control_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **office_spawning_control_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* Processes.dest
@@ -88,9 +142,6 @@ Limited false positives should be present.
* [Microsoft MSHTML Remote Code Execution CVE-2021-40444](/stories/microsoft_mshtml_remote_code_execution_cve-2021-40444)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -100,14 +151,6 @@ Limited false positives should be present.
| 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ clicking a suspicious attachment. |
-#### CVE
-
-| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
-| ----------- | ----------- | -------------- |
-| [CVE-2021-40444](https://nvd.nist.gov/vuln/detail/CVE-2021-40444) | Microsoft MSHTML Remote Code Execution Vulnerability | 6.8 |
-
-
-
#### Reference
* [https://strontic.github.io/xcyclopedia/library/control.exe-1F13E714A0FEA8887707DFF49287996F.html](https://strontic.github.io/xcyclopedia/library/control.exe-1F13E714A0FEA8887707DFF49287996F.html)
@@ -120,7 +163,7 @@ Limited false positives should be present.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md b/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md
index 74e18fdf05..0586fc46a3 100644
--- a/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md
+++ b/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md
@@ -28,16 +28,21 @@ tags:
The following hunting detection identifies rundll32.exe with `control_rundll` within the command-line, loading a .cpl or another file type. Developed in relation to CVE-2021-40444. Rundll32.exe can also be used to execute Control Panel Item files (.cpl) through the undocumented shell32.dll functions Control_RunDLL and Control_RunDLLAsUser. Double-clicking a .cpl file also causes rundll32.exe to execute. \ This is written to be a bit more broad by not including .cpl. \ During triage, review parallel processes to identify any further suspicious behavior.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-09-08
- **Author**: Michael Haag, Splunk
- **ID**: c8e7ced0-10c5-11ec-8b03-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
+| ----------- | ----------- | -------------- |
+| [CVE-2021-40444](https://nvd.nist.gov/vuln/detail/CVE-2021-40444) | Microsoft MSHTML Remote Code Execution Vulnerability | 6.8 |
+
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -45,6 +50,55 @@ The following hunting detection identifies rundll32.exe with `control_rundll` wi
| [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -58,11 +112,11 @@ The following hunting detection identifies rundll32.exe with `control_rundll` wi
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `rundll32_control_rundll_hunt_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **rundll32_control_rundll_hunt_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* Processes.dest
@@ -90,9 +144,6 @@ This is a hunting detection, meant to provide a understanding of how voluminous
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -102,14 +153,6 @@ This is a hunting detection, meant to provide a understanding of how voluminous
| 15.0 | 30 | 50 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to load a suspicious file from disk. |
-#### CVE
-
-| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
-| ----------- | ----------- | -------------- |
-| [CVE-2021-40444](https://nvd.nist.gov/vuln/detail/CVE-2021-40444) | Microsoft MSHTML Remote Code Execution Vulnerability | 6.8 |
-
-
-
#### Reference
* [https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html](https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html)
@@ -122,7 +165,7 @@ This is a hunting detection, meant to provide a understanding of how voluminous
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md b/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md
index bfb51c8dad..90e713da54 100644
--- a/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md
+++ b/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md
@@ -28,16 +28,21 @@ tags:
The following detection identifies rundll32.exe with `control_rundll` within the command-line, loading a .cpl or another file type from windows\temp, programdata, or appdata. Developed in relation to CVE-2021-40444. Rundll32.exe can also be used to execute Control Panel Item files (.cpl) through the undocumented shell32.dll functions Control_RunDLL and Control_RunDLLAsUser. Double-clicking a .cpl file also causes rundll32.exe to execute. This is written to be a bit more broad by not including .cpl. The paths are specified, add more as needed. During triage, review parallel processes to identify any further suspicious behavior.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-09-08
- **Author**: Michael Haag, Splunk
- **ID**: 1adffe86-10c3-11ec-8ce6-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
+| ----------- | ----------- | -------------- |
+| [CVE-2021-40444](https://nvd.nist.gov/vuln/detail/CVE-2021-40444) | Microsoft MSHTML Remote Code Execution Vulnerability | 6.8 |
+
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -45,6 +50,55 @@ The following detection identifies rundll32.exe with `control_rundll` within the
| [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -58,11 +112,11 @@ The following detection identifies rundll32.exe with `control_rundll` within the
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `rundll32_control_rundll_world_writable_directory_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **rundll32_control_rundll_world_writable_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* Processes.dest
@@ -90,9 +144,6 @@ This may be tuned, or a new one related, by adding .cpl to command-line. However
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -102,14 +153,6 @@ This may be tuned, or a new one related, by adding .cpl to command-line. However
| 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to load a suspicious file from disk. |
-#### CVE
-
-| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
-| ----------- | ----------- | -------------- |
-| [CVE-2021-40444](https://nvd.nist.gov/vuln/detail/CVE-2021-40444) | Microsoft MSHTML Remote Code Execution Vulnerability | 6.8 |
-
-
-
#### Reference
* [https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html](https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html)
@@ -122,7 +165,7 @@ This may be tuned, or a new one related, by adding .cpl to command-line. However
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-09-extraction_of_registry_hives.md b/docs/_posts/2021-09-09-extraction_of_registry_hives.md
index 53cb859799..06c0639f90 100644
--- a/docs/_posts/2021-09-09-extraction_of_registry_hives.md
+++ b/docs/_posts/2021-09-09-extraction_of_registry_hives.md
@@ -27,16 +27,21 @@ tags:
The following analytic identifies the use of `reg.exe` exporting Windows Registry hives containing credentials. Adversaries may use this technique to export registry hives for offline credential access attacks. Typically found executed from a untrusted process or script. Upon execution, a file will be written to disk.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-09-09
- **Author**: Michael Haag, Splunk
- **ID**: 8bbb7d58-b360-11eb-ba21-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
+| ----------- | ----------- | -------------- |
+| [CVE-2021-40444](https://nvd.nist.gov/vuln/detail/CVE-2021-40444) | Microsoft MSHTML Remote Code Execution Vulnerability | 6.8 |
+
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ The following analytic identifies the use of `reg.exe` exporting Windows Registr
| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,11 +107,11 @@ The following analytic identifies the use of `reg.exe` exporting Windows Registr
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_reg](https://github.com/splunk/security_content/blob/develop/macros/process_reg.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `extraction_of_registry_hives_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **extraction_of_registry_hives_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -89,9 +139,6 @@ It is possible some agent based products will generate false positives. Filter a
* [Credential Dumping](/stories/credential_dumping)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -101,8 +148,6 @@ It is possible some agent based products will generate false positives. Filter a
| 56.0 | 80 | 70 | Suspicious use of `reg.exe` exporting Windows Registry hives containing credentials executed on $dest$ by user $user$, with a parent process of $parent_process_id$ |
-
-
#### Reference
* [https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html](https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html)
@@ -111,7 +156,7 @@ It is possible some agent based products will generate false positives. Filter a
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-09-mshtml_module_load_in_office_product.md b/docs/_posts/2021-09-09-mshtml_module_load_in_office_product.md
index 9ae8ae4dc4..6fe995e38e 100644
--- a/docs/_posts/2021-09-09-mshtml_module_load_in_office_product.md
+++ b/docs/_posts/2021-09-09-mshtml_module_load_in_office_product.md
@@ -28,16 +28,21 @@ tags:
The following detection identifies the module load of mshtml.dll into an Office product. This behavior has been related to CVE-2021-40444, whereas the malicious document will load ActiveX, which activates the MSHTML component. The vulnerability resides in the MSHTML component. During triage, identify parallel processes and capture any file modifications for analysis.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-09-09
- **Author**: Michael Haag, Splunk
- **ID**: 5f1c168e-118b-11ec-84ff-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -45,6 +50,55 @@ The following detection identifies the module load of mshtml.dll into an Office
| [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -58,10 +112,10 @@ The following detection identifies the module load of mshtml.dll into an Office
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `mshtml_module_load_in_office_product_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **mshtml_module_load_in_office_product_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -83,9 +137,6 @@ Limited false positives will be present, however, tune as necessary.
* [Microsoft MSHTML Remote Code Execution CVE-2021-40444](/stories/microsoft_mshtml_remote_code_execution_cve-2021-40444)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -95,14 +146,6 @@ Limited false positives will be present, however, tune as necessary.
| 80.0 | 80 | 100 | An instance of $process_name$ was identified on endpoint $dest$ loading mshtml.dll. |
-#### CVE
-
-| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
-| ----------- | ----------- | -------------- |
-| [CVE-2021-40444](https://nvd.nist.gov/vuln/detail/CVE-2021-40444) | Microsoft MSHTML Remote Code Execution Vulnerability | 6.8 |
-
-
-
#### Reference
* [https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/](https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/)
@@ -112,7 +155,7 @@ Limited false positives will be present, however, tune as necessary.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-10-getnettcpconnection_with_powershell_script_block.md b/docs/_posts/2021-09-10-getnettcpconnection_with_powershell_script_block.md
index 5f5e2cb598..6379015a2f 100644
--- a/docs/_posts/2021-09-10-getnettcpconnection_with_powershell_script_block.md
+++ b/docs/_posts/2021-09-10-getnettcpconnection_with_powershell_script_block.md
@@ -23,21 +23,71 @@ tags:
The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-NetTcpconnection ` commandlet. This commandlet is used to return a listing of network connections on a compromised system. Red Teams and adversaries alike may use this commandlet for situational awareness and Active Directory Discovery.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-09-10
- **Author**: Mauricio Velazco, Splunk
- **ID**: 091712ff-b02a-4d43-82ed-34765515d95d
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
+| ----------- | ----------- | -------------- |
+| [CVE-2021-40444](https://nvd.nist.gov/vuln/detail/CVE-2021-40444) | Microsoft MSHTML Remote Code Execution Vulnerability | 6.8 |
+
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1049](https://attack.mitre.org/techniques/T1049/) | System Network Connections Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -49,10 +99,10 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `getnettcpconnection_with_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **getnettcpconnection_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -72,9 +122,6 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -84,8 +131,6 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo
| 15.0 | 30 | 50 | Network Connection discovery on $dest$ by $user$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1049/](https://attack.mitre.org/techniques/T1049/)
@@ -94,7 +139,7 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-10-network_connection_discovery_with_arp.md b/docs/_posts/2021-09-10-network_connection_discovery_with_arp.md
index 66aaad292d..15e62a9286 100644
--- a/docs/_posts/2021-09-10-network_connection_discovery_with_arp.md
+++ b/docs/_posts/2021-09-10-network_connection_discovery_with_arp.md
@@ -24,21 +24,71 @@ tags:
This analytic looks for the execution of `arp.exe` utilized to get a listing of network connections on a compromised system. Red Teams and adversaries alike may use arp.exe for situational awareness and Active Directory Discovery.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-09-10
- **Author**: Mauricio Velazco, Splunk
- **ID**: ae008c0f-83bd-4ed4-9350-98d4328e15d2
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1049](https://attack.mitre.org/techniques/T1049/) | System Network Connections Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +102,10 @@ This analytic looks for the execution of `arp.exe` utilized to get a listing of
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `network_connection_discovery_with_arp_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **network_connection_discovery_with_arp_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* Processes.dest
@@ -81,9 +131,6 @@ Administrators or power users may use this command for troubleshooting.
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -93,8 +140,6 @@ Administrators or power users may use this command for troubleshooting.
| 15.0 | 30 | 50 | Network Connection discovery on $dest$ by $user$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1049/](https://attack.mitre.org/techniques/T1049/)
@@ -102,7 +147,7 @@ Administrators or power users may use this command for troubleshooting.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-10-network_connection_discovery_with_net.md b/docs/_posts/2021-09-10-network_connection_discovery_with_net.md
index d80bc07f6a..2dcd1588cd 100644
--- a/docs/_posts/2021-09-10-network_connection_discovery_with_net.md
+++ b/docs/_posts/2021-09-10-network_connection_discovery_with_net.md
@@ -24,21 +24,71 @@ tags:
This analytic looks for the execution of `net.exe` with command-line arguments utilized to get a listing of network connections on a compromised system. Red Teams and adversaries alike may use net.exe for situational awareness and Active Directory Discovery.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-09-10
- **Author**: Mauricio Velazco, Splunk
- **ID**: 640337e5-6e41-4b7f-af06-9d9eab5e1e2d
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1049](https://attack.mitre.org/techniques/T1049/) | System Network Connections Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +102,10 @@ This analytic looks for the execution of `net.exe` with command-line arguments u
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `network_connection_discovery_with_net_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **network_connection_discovery_with_net_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* Processes.dest
@@ -81,9 +131,6 @@ Administrators or power users may use this command for troubleshooting.
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -93,8 +140,6 @@ Administrators or power users may use this command for troubleshooting.
| 15.0 | 30 | 50 | Network Connection discovery on $dest$ by $user$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1049/](https://attack.mitre.org/techniques/T1049/)
@@ -102,7 +147,7 @@ Administrators or power users may use this command for troubleshooting.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-10-network_connection_discovery_with_netstat.md b/docs/_posts/2021-09-10-network_connection_discovery_with_netstat.md
index cdd50f112c..137f00e536 100644
--- a/docs/_posts/2021-09-10-network_connection_discovery_with_netstat.md
+++ b/docs/_posts/2021-09-10-network_connection_discovery_with_netstat.md
@@ -24,21 +24,71 @@ tags:
This analytic looks for the execution of `netstat.exe` with command-line arguments utilized to get a listing of network connections on a compromised system. Red Teams and adversaries alike may use netstat.exe for situational awareness and Active Directory Discovery.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-09-10
- **Author**: Mauricio Velazco, Splunk
- **ID**: 2cf5cc25-f39a-436d-a790-4857e5995ede
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1049](https://attack.mitre.org/techniques/T1049/) | System Network Connections Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +102,10 @@ This analytic looks for the execution of `netstat.exe` with command-line argumen
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `network_connection_discovery_with_netstat_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **network_connection_discovery_with_netstat_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* Processes.dest
@@ -81,9 +131,6 @@ Administrators or power users may use this command for troubleshooting.
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -93,8 +140,6 @@ Administrators or power users may use this command for troubleshooting.
| 15.0 | 30 | 50 | Network Connection discovery on $dest$ by $user$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1049/](https://attack.mitre.org/techniques/T1049/)
@@ -102,7 +147,7 @@ Administrators or power users may use this command for troubleshooting.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-10-office_product_writing_cab_or_inf.md b/docs/_posts/2021-09-10-office_product_writing_cab_or_inf.md
index 2d4c64a21e..2aa8e80891 100644
--- a/docs/_posts/2021-09-10-office_product_writing_cab_or_inf.md
+++ b/docs/_posts/2021-09-10-office_product_writing_cab_or_inf.md
@@ -28,16 +28,21 @@ tags:
The following analytic identifies behavior related to CVE-2021-40444. Whereas the malicious document will load ActiveX and download the remote payload (.inf, .cab). During triage, review parallel processes and further activity on endpoint to identify additional patterns. Retrieve the file modifications and analyze further.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-09-10
- **Author**: Michael Haag, Splunk
- **ID**: f48cd1d4-125a-11ec-a447-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -45,6 +50,55 @@ The following analytic identifies behavior related to CVE-2021-40444. Whereas th
| [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -64,7 +118,7 @@ The following analytic identifies behavior related to CVE-2021-40444. Whereas th
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `office_product_writing_cab_or_inf_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **office_product_writing_cab_or_inf_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -87,9 +141,6 @@ The query is structured in a way that `action` (read, create) is not defined. Re
* [Microsoft MSHTML Remote Code Execution CVE-2021-40444](/stories/microsoft_mshtml_remote_code_execution_cve-2021-40444)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -99,14 +150,6 @@ The query is structured in a way that `action` (read, create) is not defined. Re
| 80.0 | 80 | 100 | An instance of $process_name$ was identified on $dest$ writing an inf or cab file to this. This is not typical of $process_name$. |
-#### CVE
-
-| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
-| ----------- | ----------- | -------------- |
-| [CVE-2021-40444](https://nvd.nist.gov/vuln/detail/CVE-2021-40444) | Microsoft MSHTML Remote Code Execution Vulnerability | 6.8 |
-
-
-
#### Reference
* [https://twitter.com/vxunderground/status/1436326057179860992?s=20](https://twitter.com/vxunderground/status/1436326057179860992?s=20)
@@ -117,7 +160,7 @@ The query is structured in a way that `action` (read, create) is not defined. Re
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-13-getcurrent_user_with_powershell.md b/docs/_posts/2021-09-13-getcurrent_user_with_powershell.md
index 7f0b4e026e..e138e64cf9 100644
--- a/docs/_posts/2021-09-13-getcurrent_user_with_powershell.md
+++ b/docs/_posts/2021-09-13-getcurrent_user_with_powershell.md
@@ -24,21 +24,71 @@ tags:
This analytic looks for the execution of `powerhsell.exe` with command-line arguments that execute the `GetCurrent` method of the WindowsIdentity .NET class. This method returns an object that represents the current Windows user. Red Teams and adversaries may leverage this method to identify the logged user on a compromised endpoint for situational awareness and Active Directory Discovery.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-09-13
- **Author**: Mauricio Velazco, Splunk
- **ID**: 7eb9c3d5-c98c-4088-acc5-8240bad15379
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
+| ----------- | ----------- | -------------- |
+| [CVE-2021-40444](https://nvd.nist.gov/vuln/detail/CVE-2021-40444) | Microsoft MSHTML Remote Code Execution Vulnerability | 6.8 |
+
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1033](https://attack.mitre.org/techniques/T1033/) | System Owner/User Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +102,10 @@ This analytic looks for the execution of `powerhsell.exe` with command-line argu
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `getcurrent_user_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **getcurrent_user_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -82,9 +132,6 @@ Administrators or power users may use this command for troubleshooting.
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -94,8 +141,6 @@ Administrators or power users may use this command for troubleshooting.
| 15.0 | 30 | 50 | System user discovery on $dest$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1033/](https://attack.mitre.org/techniques/T1033/)
@@ -103,7 +148,7 @@ Administrators or power users may use this command for troubleshooting.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-13-getcurrent_user_with_powershell_script_block.md b/docs/_posts/2021-09-13-getcurrent_user_with_powershell_script_block.md
index 25d69b1a95..c9b55ec456 100644
--- a/docs/_posts/2021-09-13-getcurrent_user_with_powershell_script_block.md
+++ b/docs/_posts/2021-09-13-getcurrent_user_with_powershell_script_block.md
@@ -23,21 +23,71 @@ tags:
The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `GetCurrent` method of the WindowsIdentity .NET class. This method returns an object that represents the current Windows user. Red Teams and adversaries may leverage this method to identify the logged user on a compromised endpoint for situational awareness and Active Directory Discovery.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-09-13
- **Author**: Mauricio Velazco, Splunk
- **ID**: 80879283-c30f-44f7-8471-d1381f6d437a
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1033](https://attack.mitre.org/techniques/T1033/) | System Owner/User Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -49,10 +99,10 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `getcurrent_user_with_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **getcurrent_user_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -74,9 +124,6 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -86,8 +133,6 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo
| 15.0 | 30 | 50 | System user discovery on $dest$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1033/](https://attack.mitre.org/techniques/T1033/)
@@ -96,7 +141,7 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-13-jscript_execution_using_cscript_app.md b/docs/_posts/2021-09-13-jscript_execution_using_cscript_app.md
index 38bb145871..3b7b2966f0 100644
--- a/docs/_posts/2021-09-13-jscript_execution_using_cscript_app.md
+++ b/docs/_posts/2021-09-13-jscript_execution_using_cscript_app.md
@@ -27,16 +27,21 @@ tags:
This search is to detect a execution of jscript using cscript process. Commonly when a user run jscript file it was executed by wscript.exe application. This technique was seen in FIN7 js implant to execute its malicious script using cscript process. This behavior is uncommon and a good artifacts to check further anomalies within the network
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-09-13
- **Author**: Teoderick Contreras, Splunk
- **ID**: 002f1e24-146e-11ec-a470-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This search is to detect a execution of jscript using cscript process. Commonly
| [T1059.007](https://attack.mitre.org/techniques/T1059/007/) | JavaScript | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +107,10 @@ This search is to detect a execution of jscript using cscript process. Commonly
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `jscript_execution_using_cscript_app_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **jscript_execution_using_cscript_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +134,6 @@ unknown
* [Remcos](/stories/remcos)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -96,8 +143,6 @@ unknown
| 49.0 | 70 | 70 | Process name $process_name$ with commandline $process$ to execute jscript in $dest$ |
-
-
#### Reference
* [https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html](https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html)
@@ -106,7 +151,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md b/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md
index 87c84d1a97..d466c29b33 100644
--- a/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md
+++ b/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md
@@ -27,16 +27,21 @@ tags:
This search is to detect a suspicious MS scripting process such as wscript.exe or cscript.exe that loading ldap module to process ldap query. This behavior was seen in FIN7 implant where it uses javascript to execute ldap query to parse host information that will send to its C2 server. this anomaly detections is a good initial step to hunt further a suspicious ldap query or ldap related events to the host that may give you good information regarding ldap or AD information processing or might be a attacker.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-09-13
- **Author**: Teoderick Contreras, Splunk
- **ID**: 0b0c40dc-14a6-11ec-b267-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This search is to detect a suspicious MS scripting process such as wscript.exe o
| [T1059.007](https://attack.mitre.org/techniques/T1059/007/) | JavaScript | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -56,10 +106,10 @@ This search is to detect a suspicious MS scripting process such as wscript.exe o
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `ms_scripting_process_loading_ldap_module_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **ms_scripting_process_loading_ldap_module_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -82,9 +132,6 @@ automation scripting language may used by network operator to do ldap query.
* [FIN7](/stories/fin7)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -94,8 +141,6 @@ automation scripting language may used by network operator to do ldap query.
| 9.0 | 30 | 30 | $process_name$ loading ldap modules $ImageLoaded$ in $dest$ |
-
-
#### Reference
* [https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html](https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html)
@@ -104,7 +149,7 @@ automation scripting language may used by network operator to do ldap query.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md b/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md
index 77e09a0e83..25a5d34c04 100644
--- a/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md
+++ b/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md
@@ -27,16 +27,21 @@ tags:
This search is to detect a suspicious MS scripting process such as wscript.exe or cscript.exe that loading wmi module to process wmi query. This behavior was seen in FIN7 implant where it uses javascript to execute wmi query to parse host information that will send to its C2 server. this anomaly detections is a good initial step to hunt further a suspicious wmi query or wmi related events to the host that may give you good information regarding process that are commonly using wmi query or modules or might be an attacker using this technique.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-09-13
- **Author**: Teoderick Contreras, Splunk
- **ID**: 2eba3d36-14a6-11ec-a682-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This search is to detect a suspicious MS scripting process such as wscript.exe o
| [T1059.007](https://attack.mitre.org/techniques/T1059/007/) | JavaScript | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -56,10 +106,10 @@ This search is to detect a suspicious MS scripting process such as wscript.exe o
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `ms_scripting_process_loading_wmi_module_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **ms_scripting_process_loading_wmi_module_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -82,9 +132,6 @@ automation scripting language may used by network operator to do ldap query.
* [FIN7](/stories/fin7)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -94,8 +141,6 @@ automation scripting language may used by network operator to do ldap query.
| 9.0 | 30 | 30 | $process_name$ loading wmi modules $ImageLoaded$ in $dest$ |
-
-
#### Reference
* [https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html](https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html)
@@ -104,7 +149,7 @@ automation scripting language may used by network operator to do ldap query.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-13-office_application_drop_executable.md b/docs/_posts/2021-09-13-office_application_drop_executable.md
index ae032ca54b..0be5e7f52a 100644
--- a/docs/_posts/2021-09-13-office_application_drop_executable.md
+++ b/docs/_posts/2021-09-13-office_application_drop_executable.md
@@ -27,16 +27,21 @@ tags:
This search is to detect a suspicious MS office application that drop or create executables or script in the host. This behavior is commonly seen in spear phishing office attachment where it drop malicious files or script to compromised the host. It might be some normal macro may drop script or tools as part of automation but still this behavior is reallly suspicious and not commonly seen in normal office application
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-09-13
- **Author**: Teoderick Contreras, Michael Haag Splunk
- **ID**: 73ce70c4-146d-11ec-9184-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This search is to detect a suspicious MS office application that drop or create
| [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -65,7 +115,7 @@ This search is to detect a suspicious MS office application that drop or create
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `office_application_drop_executable_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **office_application_drop_executable_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -86,9 +136,6 @@ office macro for automation may do this behavior
* [FIN7](/stories/fin7)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -98,8 +145,6 @@ office macro for automation may do this behavior
| 64.0 | 80 | 80 | process $process_name$ drops a file $TargetFilename$ in host $dest$ |
-
-
#### Reference
* [https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html](https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html)
@@ -108,7 +153,7 @@ office macro for automation may do this behavior
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-13-system_user_discovery_with_query.md b/docs/_posts/2021-09-13-system_user_discovery_with_query.md
index 3ca8d926e0..2ad7dbf583 100644
--- a/docs/_posts/2021-09-13-system_user_discovery_with_query.md
+++ b/docs/_posts/2021-09-13-system_user_discovery_with_query.md
@@ -24,21 +24,71 @@ tags:
This analytic looks for the execution of `query.exe` with command-line arguments utilized to discover the logged user. Red Teams and adversaries alike may leverage `query.exe` to identify system users on a compromised endpoint for situational awareness and Active Directory Discovery.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-09-13
- **Author**: Mauricio Velazco, Splunk
- **ID**: ad03bfcf-8a91-4bc2-a500-112993deba87
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1033](https://attack.mitre.org/techniques/T1033/) | System Owner/User Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +102,10 @@ This analytic looks for the execution of `query.exe` with command-line arguments
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `system_user_discovery_with_query_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **system_user_discovery_with_query_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -82,9 +132,6 @@ Administrators or power users may use this command for troubleshooting.
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -94,8 +141,6 @@ Administrators or power users may use this command for troubleshooting.
| 15.0 | 30 | 50 | System user discovery on $dest$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1033/](https://attack.mitre.org/techniques/T1033/)
@@ -103,7 +148,7 @@ Administrators or power users may use this command for troubleshooting.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-13-system_user_discovery_with_whoami.md b/docs/_posts/2021-09-13-system_user_discovery_with_whoami.md
index 82d8e67ae8..00563ff01e 100644
--- a/docs/_posts/2021-09-13-system_user_discovery_with_whoami.md
+++ b/docs/_posts/2021-09-13-system_user_discovery_with_whoami.md
@@ -24,21 +24,71 @@ tags:
This analytic looks for the execution of `whoami.exe` without any arguments. This windows native binary prints out the current logged user. Red Teams and adversaries alike may leverage `whoami.exe` to identify system users on a compromised endpoint for situational awareness and Active Directory Discovery.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-09-13
- **Author**: Mauricio Velazco, Splunk
- **ID**: 894fc43e-6f50-47d5-a68b-ee9ee23e18f4
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1033](https://attack.mitre.org/techniques/T1033/) | System Owner/User Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +102,10 @@ This analytic looks for the execution of `whoami.exe` without any arguments. Thi
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `system_user_discovery_with_whoami_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **system_user_discovery_with_whoami_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -82,9 +132,6 @@ Administrators or power users may use this command for troubleshooting.
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -94,8 +141,6 @@ Administrators or power users may use this command for troubleshooting.
| 15.0 | 30 | 50 | System user discovery on $dest$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1033/](https://attack.mitre.org/techniques/T1033/)
@@ -103,7 +148,7 @@ Administrators or power users may use this command for troubleshooting.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell.md b/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell.md
index b72d4ff517..b2b7f846f6 100644
--- a/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell.md
+++ b/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell.md
@@ -24,21 +24,71 @@ tags:
This analytic looks for the execution of `powershell.exe` with command-line arguments that leverage PowerShell environment variables to identify the current logged user. Red Teams and adversaries may leverage this method to identify the logged user on a compromised endpoint for situational awareness and Active Directory Discovery.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-09-13
- **Author**: Mauricio Velazco, Splunk
- **ID**: 0cdf318b-a0dd-47d7-b257-c621c0247de8
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1033](https://attack.mitre.org/techniques/T1033/) | System Owner/User Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +102,10 @@ This analytic looks for the execution of `powershell.exe` with command-line argu
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `user_discovery_with_env_vars_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **user_discovery_with_env_vars_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -82,9 +132,6 @@ Administrators or power users may use this command for troubleshooting.
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -94,8 +141,6 @@ Administrators or power users may use this command for troubleshooting.
| 15.0 | 30 | 50 | System user discovery on $dest$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1033/](https://attack.mitre.org/techniques/T1033/)
@@ -103,7 +148,7 @@ Administrators or power users may use this command for troubleshooting.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell_script_block.md b/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell_script_block.md
index 4749f8bf41..97b7343e2b 100644
--- a/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell_script_block.md
+++ b/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell_script_block.md
@@ -23,21 +23,71 @@ tags:
The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the use of PowerShell environment variables to identify the current logged user. Red Teams and adversaries may leverage this method to identify the logged user on a compromised endpoint for situational awareness and Active Directory Discovery.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-09-13
- **Author**: Mauricio Velazco, Splunk
- **ID**: 77f41d9e-b8be-47e3-ab35-5776f5ec1d20
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1033](https://attack.mitre.org/techniques/T1033/) | System Owner/User Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -49,10 +99,10 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `user_discovery_with_env_vars_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **user_discovery_with_env_vars_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -74,9 +124,6 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -86,8 +133,6 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo
| 15.0 | 30 | 50 | System user discovery on $dest$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1033/](https://attack.mitre.org/techniques/T1033/)
@@ -95,7 +140,7 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md b/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md
index dd2aba13e3..a3f25d5dae 100644
--- a/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md
+++ b/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md
@@ -24,21 +24,71 @@ tags:
This search is to detect a suspicious wmic.exe process or renamed wmic process to execute malicious xsl file. This technique was seen in FIN7 to execute its malicous jscript using the .xsl as the loader with the help of wmic.exe process. This TTP is really a good indicator for you to hunt further for FIN7 or other attacker that known to used this technique.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-09-13
- **Author**: Teoderick Contreras, Splunk
- **ID**: 004e32e2-146d-11ec-a83f-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1220](https://attack.mitre.org/techniques/T1220/) | XSL Script Processing | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,11 +102,11 @@ This search is to detect a suspicious wmic.exe process or renamed wmic process t
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `xsl_script_execution_with_wmic_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **xsl_script_execution_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -80,9 +130,6 @@ unknown
* [Suspicious WMI Use](/stories/suspicious_wmi_use)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -92,8 +139,6 @@ unknown
| 49.0 | 70 | 70 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ utilizing wmic to load a XSL script. |
-
-
#### Reference
* [https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html](https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html)
@@ -104,7 +149,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md b/docs/_posts/2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md
index f4db6c0335..4bf3e11d30 100644
--- a/docs/_posts/2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md
+++ b/docs/_posts/2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md
@@ -27,16 +27,21 @@ tags:
The following analytic identifies a non-standard parent process (not matching CMD, PowerShell, or Explorer) spawning `ipconfig.exe` or `systeminfo.exe`. This particular behavior was seen in FIN7's JSSLoader .NET payload. This is also typically seen when an adversary is injected into another process performing different discovery techniques. This event stands out as a TTP since these tools are commonly executed with a shell application or Explorer parent, and not by another application. This TTP is a good indicator for an adversary gathering host information, but one possible false positive might be an automated tool used by a system administator.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-09-14
- **Author**: Teoderick Contreras, Splunk
- **ID**: 6c3f7dd8-153c-11ec-ac2d-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ The following analytic identifies a non-standard parent process (not matching CM
| [T1059.007](https://attack.mitre.org/techniques/T1059/007/) | JavaScript | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +107,10 @@ The following analytic identifies a non-standard parent process (not matching CM
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `cmdline_tool_not_executed_in_cmd_shell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **cmdline_tool_not_executed_in_cmd_shell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -87,9 +137,6 @@ A network operator or systems administrator may utilize an automated host discov
* [FIN7](/stories/fin7)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -99,8 +146,6 @@ A network operator or systems administrator may utilize an automated host discov
| 56.0 | 70 | 80 | A non-standard parent process $parent_process_name$ spawned child process $process_name$ to execute command-line tool on $dest$. |
-
-
#### Reference
* [https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html](https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html)
@@ -109,7 +154,7 @@ A network operator or systems administrator may utilize an automated host discov
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-14-get_wmiobject_group_discovery.md b/docs/_posts/2021-09-14-get_wmiobject_group_discovery.md
index 9f30914cbe..6195a6221a 100644
--- a/docs/_posts/2021-09-14-get_wmiobject_group_discovery.md
+++ b/docs/_posts/2021-09-14-get_wmiobject_group_discovery.md
@@ -27,16 +27,21 @@ tags:
The following hunting analytic identifies the use of `Get-WMIObject Win32_Group` being used with PowerShell to identify local groups on the endpoint. \ Typically, by itself, is not malicious but may raise suspicion based on time of day, endpoint and username. \ During triage, review parallel processes and identify any further suspicious behavior.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-09-14
- **Author**: Michael Haag, Splunk
- **ID**: 5434f670-155d-11ec-8cca-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ The following hunting analytic identifies the use of `Get-WMIObject Win32_Group`
| [T1069.001](https://attack.mitre.org/techniques/T1069/001/) | Local Groups | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +107,10 @@ The following hunting analytic identifies the use of `Get-WMIObject Win32_Group`
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `get_wmiobject_group_discovery_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **get_wmiobject_group_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -87,9 +137,6 @@ False positives may be present. Tune as needed.
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -99,8 +146,6 @@ False positives may be present. Tune as needed.
| 15.0 | 30 | 50 | System group discovery on $dest$ by $user$. |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1069/001/](https://attack.mitre.org/techniques/T1069/001/)
@@ -109,7 +154,7 @@ False positives may be present. Tune as needed.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-14-get_wmiobject_group_discovery_with_script_block_logging.md b/docs/_posts/2021-09-14-get_wmiobject_group_discovery_with_script_block_logging.md
index ee4935e9dc..d831dda2a3 100644
--- a/docs/_posts/2021-09-14-get_wmiobject_group_discovery_with_script_block_logging.md
+++ b/docs/_posts/2021-09-14-get_wmiobject_group_discovery_with_script_block_logging.md
@@ -28,16 +28,21 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
This analytic identifies the usage of `Get-WMIObject Win32_Group`, which is typically used as a way to identify groups on the endpoint. Typically, by itself, is not malicious but may raise suspicion based on time of day, endpoint and username. \
During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-09-14
- **Author**: Michael Haag, Splunk
- **ID**: 69df7f7c-155d-11ec-a055-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -45,6 +50,51 @@ During triage, review parallel processes using an EDR product or 4688 events. It
| [T1069.001](https://attack.mitre.org/techniques/T1069/001/) | Local Groups | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +107,10 @@ During triage, review parallel processes using an EDR product or 4688 events. It
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `get_wmiobject_group_discovery_with_script_block_logging_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **get_wmiobject_group_discovery_with_script_block_logging_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -80,9 +130,6 @@ False positives may be present. Tune as needed.
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -92,8 +139,6 @@ False positives may be present. Tune as needed.
| 15.0 | 30 | 50 | System group discovery enumeration on $dest$ by $user$. |
-
-
#### Reference
* [https://www.splunk.com/en_us/blog/security/powershell-detections-threat-research-release-august-2021.html](https://www.splunk.com/en_us/blog/security/powershell-detections-threat-research-release-august-2021.html)
@@ -106,7 +151,7 @@ False positives may be present. Tune as needed.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-14-net_localgroup_discovery.md b/docs/_posts/2021-09-14-net_localgroup_discovery.md
index 8099831fc0..c227813936 100644
--- a/docs/_posts/2021-09-14-net_localgroup_discovery.md
+++ b/docs/_posts/2021-09-14-net_localgroup_discovery.md
@@ -27,16 +27,21 @@ tags:
The following hunting analytic will identify the use of localgroup discovery using `net localgroup`. During triage, review parallel processes and identify any further suspicious behavior.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-09-14
- **Author**: Michael Haag, Splunk
- **ID**: 54f5201e-155b-11ec-a6e2-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ The following hunting analytic will identify the use of localgroup discovery usi
| [T1069.001](https://attack.mitre.org/techniques/T1069/001/) | Local Groups | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +107,10 @@ The following hunting analytic will identify the use of localgroup discovery usi
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `net_localgroup_discovery_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **net_localgroup_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -88,9 +138,6 @@ False positives may be present. Tune as needed.
* [Windows Discovery Techniques](/stories/windows_discovery_techniques)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -100,8 +147,6 @@ False positives may be present. Tune as needed.
| 15.0 | 30 | 50 | Local group discovery on $dest$ by $user$. |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1069/001/](https://attack.mitre.org/techniques/T1069/001/)
@@ -110,7 +155,7 @@ False positives may be present. Tune as needed.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-14-powershell_get_localgroup_discovery.md b/docs/_posts/2021-09-14-powershell_get_localgroup_discovery.md
index 42a4924419..9a1ea5802b 100644
--- a/docs/_posts/2021-09-14-powershell_get_localgroup_discovery.md
+++ b/docs/_posts/2021-09-14-powershell_get_localgroup_discovery.md
@@ -27,16 +27,21 @@ tags:
The following hunting analytic identifies the use of `get-localgroup` being used with PowerShell to identify local groups on the endpoint. During triage, review parallel processes and identify any further suspicious behavior.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-09-14
- **Author**: Michael Haag, Splunk
- **ID**: b71adfcc-155b-11ec-9413-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ The following hunting analytic identifies the use of `get-localgroup` being used
| [T1069.001](https://attack.mitre.org/techniques/T1069/001/) | Local Groups | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +107,10 @@ The following hunting analytic identifies the use of `get-localgroup` being used
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `powershell_get_localgroup_discovery_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **powershell_get_localgroup_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -87,9 +137,6 @@ False positives may be present. Tune as needed.
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -99,8 +146,6 @@ False positives may be present. Tune as needed.
| 15.0 | 30 | 50 | Local group discovery on $dest$ by $user$. |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1069/001/](https://attack.mitre.org/techniques/T1069/001/)
@@ -109,7 +154,7 @@ False positives may be present. Tune as needed.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-14-powershell_get_localgroup_discovery_with_script_block_logging.md b/docs/_posts/2021-09-14-powershell_get_localgroup_discovery_with_script_block_logging.md
index 723da307db..a5eb79605f 100644
--- a/docs/_posts/2021-09-14-powershell_get_localgroup_discovery_with_script_block_logging.md
+++ b/docs/_posts/2021-09-14-powershell_get_localgroup_discovery_with_script_block_logging.md
@@ -28,16 +28,21 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
This analytic identifies PowerShell cmdlet - `get-localgroup` being ran. Typically, by itself, is not malicious but may raise suspicion based on time of day, endpoint and username. \
During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-09-14
- **Author**: Michael Haag, Splunk
- **ID**: d7c6ad22-155c-11ec-bb64-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -45,6 +50,51 @@ During triage, review parallel processes using an EDR product or 4688 events. It
| [T1069.001](https://attack.mitre.org/techniques/T1069/001/) | Local Groups | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +107,10 @@ During triage, review parallel processes using an EDR product or 4688 events. It
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `powershell_get_localgroup_discovery_with_script_block_logging_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **powershell_get_localgroup_discovery_with_script_block_logging_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -80,9 +130,6 @@ False positives may be present. Tune as needed.
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -92,8 +139,6 @@ False positives may be present. Tune as needed.
| 15.0 | 30 | 50 | Local group discovery on $dest$ by $user$. |
-
-
#### Reference
* [https://www.splunk.com/en_us/blog/security/powershell-detections-threat-research-release-august-2021.html](https://www.splunk.com/en_us/blog/security/powershell-detections-threat-research-release-august-2021.html)
@@ -106,7 +151,7 @@ False positives may be present. Tune as needed.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-14-wmic_group_discovery.md b/docs/_posts/2021-09-14-wmic_group_discovery.md
index 819b24538a..899fc48279 100644
--- a/docs/_posts/2021-09-14-wmic_group_discovery.md
+++ b/docs/_posts/2021-09-14-wmic_group_discovery.md
@@ -29,16 +29,21 @@ The following hunting analytic identifies the use of `wmic.exe` enumerating loca
Typically, by itself, is not malicious but may raise suspicion based on time of day, endpoint and username. \
During triage, review parallel processes and identify any further suspicious behavior.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-09-14
- **Author**: Michael Haag, Splunk
- **ID**: 83317b08-155b-11ec-8e00-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,51 @@ During triage, review parallel processes and identify any further suspicious beh
| [T1069.001](https://attack.mitre.org/techniques/T1069/001/) | Local Groups | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -59,10 +109,10 @@ During triage, review parallel processes and identify any further suspicious beh
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `wmic_group_discovery_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **wmic_group_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -89,9 +139,6 @@ Administrators or power users may use this command for troubleshooting.
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -101,8 +148,6 @@ Administrators or power users may use this command for troubleshooting.
| 15.0 | 30 | 50 | Local group discovery on $dest$ by $user$. |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1069/001/](https://attack.mitre.org/techniques/T1069/001/)
@@ -111,7 +156,7 @@ Administrators or power users may use this command for troubleshooting.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-15-check_elevated_cmd_using_whoami.md b/docs/_posts/2021-09-15-check_elevated_cmd_using_whoami.md
index af97af64b5..cfede24e2d 100644
--- a/docs/_posts/2021-09-15-check_elevated_cmd_using_whoami.md
+++ b/docs/_posts/2021-09-15-check_elevated_cmd_using_whoami.md
@@ -24,21 +24,71 @@ tags:
This search is to detect a suspicious whoami execution to check if the cmd or shell instance process is with elevated privileges. This technique was seen in FIN7 js implant where it execute this as part of its data collection to the infected machine to check if the running shell cmd process is elevated or not. This TTP is really a good alert for known attacker that recon on the targetted host. This command is not so commonly executed by a normal user or even an admin to check if a process is elevated.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-09-15
- **Author**: Teoderick Contreras, Splunk
- **ID**: a9079b18-1633-11ec-859c-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1033](https://attack.mitre.org/techniques/T1033/) | System Owner/User Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +102,10 @@ This search is to detect a suspicious whoami execution to check if the cmd or sh
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `check_elevated_cmd_using_whoami_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **check_elevated_cmd_using_whoami_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -78,9 +128,6 @@ unknown
* [FIN7](/stories/fin7)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -90,13 +137,11 @@ unknown
| 56.0 | 70 | 80 | Process name $process_name$ with commandline $process$ in $dest$ |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-15-non_chrome_process_accessing_chrome_default_dir.md b/docs/_posts/2021-09-15-non_chrome_process_accessing_chrome_default_dir.md
index 8daefff4ae..7faccae078 100644
--- a/docs/_posts/2021-09-15-non_chrome_process_accessing_chrome_default_dir.md
+++ b/docs/_posts/2021-09-15-non_chrome_process_accessing_chrome_default_dir.md
@@ -27,16 +27,21 @@ tags:
This search is to detect an anomaly event of non-chrome process accessing the files in chrome user default folder. This folder contains all the sqlite database of the chrome browser related to users login, history, cookies and etc. Most of the RAT, trojan spy as well as FIN7 jssloader try to parse the those sqlite database to collect information on the compromised host. This SACL Event (4663) need to be enabled to tthe firefox profile directory to be eable to use this. Since you monitoring this access to the folder a noise coming from firefox need to be filter and also sqlite db browser and explorer .exe to make this detection more stable.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-09-15
- **Author**: Teoderick Contreras, Splunk
- **ID**: 81263de4-160a-11ec-944f-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This search is to detect an anomaly event of non-chrome process accessing the fi
| [T1555.003](https://attack.mitre.org/techniques/T1555/003/) | Credentials from Web Browsers | Credential Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -56,10 +106,10 @@ This search is to detect an anomaly event of non-chrome process accessing the fi
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `non_chrome_process_accessing_chrome_default_dir_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **non_chrome_process_accessing_chrome_default_dir_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -85,9 +135,6 @@ other browser not listed related to firefox may catch by this rule.
* [Remcos](/stories/remcos)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -97,13 +144,11 @@ other browser not listed related to firefox may catch by this rule.
| 35.0 | 50 | 70 | a non firefox browser process $process_name$ accessing $Object_Name$ |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-15-non_firefox_process_access_firefox_profile_dir.md b/docs/_posts/2021-09-15-non_firefox_process_access_firefox_profile_dir.md
index 40fcb53a17..bc541ca2ed 100644
--- a/docs/_posts/2021-09-15-non_firefox_process_access_firefox_profile_dir.md
+++ b/docs/_posts/2021-09-15-non_firefox_process_access_firefox_profile_dir.md
@@ -27,16 +27,21 @@ tags:
This search is to detect an anomaly event of non-firefox process accessing the files in profile folder. This folder contains all the sqlite database of the firefox browser related to users login, history, cookies and etc. Most of the RAT, trojan spy as well as FIN7 jssloader try to parse the those sqlite database to collect information on the compromised host. This SACL Event (4663) need to be enabled to tthe firefox profile directory to be eable to use this. Since you monitoring this access to the folder a noise coming from firefox need to be filter and also sqlite db browser and explorer .exe to make this detection more stable.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-09-15
- **Author**: Teoderick Contreras, Splunk
- **ID**: e6fc13b0-1609-11ec-b533-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This search is to detect an anomaly event of non-firefox process accessing the f
| [T1555.003](https://attack.mitre.org/techniques/T1555/003/) | Credentials from Web Browsers | Credential Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -56,10 +106,10 @@ This search is to detect an anomaly event of non-firefox process accessing the f
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `non_firefox_process_access_firefox_profile_dir_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **non_firefox_process_access_firefox_profile_dir_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -85,9 +135,6 @@ other browser not listed related to firefox may catch by this rule.
* [Remcos](/stories/remcos)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -97,13 +144,11 @@ other browser not listed related to firefox may catch by this rule.
| 35.0 | 50 | 70 | a non firefox browser process $process_name$ accessing $Object_Name$ |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-16-account_discovery_with_net_app.md b/docs/_posts/2021-09-16-account_discovery_with_net_app.md
index d9fa7aebb5..64ae29ee01 100644
--- a/docs/_posts/2021-09-16-account_discovery_with_net_app.md
+++ b/docs/_posts/2021-09-16-account_discovery_with_net_app.md
@@ -27,16 +27,21 @@ tags:
this search is to detect a potential account discovery series of command used by several malware or attack to recon the target machine. This technique is also seen in some note worthy malware like trickbot where it runs a cmd process, or even drop its module that will execute the said series of net command. This series of command are good correlation search and indicator of attacker recon if seen in the machines within a none technical user or department (HR, finance, ceo and etc) network.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-09-16
- **Author**: Teoderick Contreras, Splunk
- **ID**: 339805ce-ac30-11eb-b87d-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ this search is to detect a potential account discovery series of command used by
| [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -58,11 +108,11 @@ this search is to detect a potential account discovery series of command used by
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `account_discovery_with_net_app_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **account_discovery_with_net_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -90,9 +140,6 @@ admin or power user may used this series of command.
* [IcedID](/stories/icedid)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -102,8 +149,6 @@ admin or power user may used this series of command.
| 5.0 | 10 | 50 | Suspicious $process_name$ usage detected on endpoint $dest$ by user $user$. |
-
-
#### Reference
* [https://labs.vipre.com/trickbot-and-its-modules/](https://labs.vipre.com/trickbot-and-its-modules/)
@@ -113,7 +158,7 @@ admin or power user may used this series of command.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md b/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md
index 87ce609f40..1c8666c377 100644
--- a/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md
+++ b/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md
@@ -27,16 +27,21 @@ tags:
Attempt To Add Certificate To Untrusted Store
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-09-16
- **Author**: Patrick Bareiss, Rico Valdez, Splunk
- **ID**: 6bc5243e-ef36-45dc-9b12-f4a6be131159
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,60 @@ Attempt To Add Certificate To Untrusted Store
| [T1553](https://attack.mitre.org/techniques/T1553/) | Subvert Trust Controls | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Installation
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+* PR.IP
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -57,11 +116,11 @@ Attempt To Add Certificate To Untrusted Store
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `attempt_to_add_certificate_to_untrusted_store_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **attempt_to_add_certificate_to_untrusted_store_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -85,10 +144,6 @@ There may be legitimate reasons for administrators to add a certificate to the u
* [Disabling Security Tools](/stories/disabling_security_tools)
-#### Kill Chain Phase
-* Installation
-* Actions on Objectives
-
#### RBA
@@ -98,8 +153,6 @@ There may be legitimate reasons for administrators to add a certificate to the u
| 35.0 | 70 | 50 | An instance of $parent_process_name$ spawning $process_name$ was identified attempting to add a certificate to the store on endpoint $dest$ by user $user$. |
-
-
#### Reference
* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1553.004/T1553.004.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1553.004/T1553.004.md)
@@ -107,7 +160,7 @@ There may be legitimate reasons for administrators to add a certificate to the u
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md b/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md
index be33e61885..7c06697df9 100644
--- a/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md
+++ b/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md
@@ -27,16 +27,21 @@ tags:
Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-09-16
- **Author**: Patrick Bareiss, Splunk
- **ID**: e9fb4a59-c5fb-440a-9f24-191fbc6b2911
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,57 @@ Monitor for execution of reg.exe with parameters specifying an export of keys th
| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -57,12 +113,12 @@ Monitor for execution of reg.exe with parameters specifying an export of keys th
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_reg](https://github.com/splunk/security_content/blob/develop/macros/process_reg.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
-Note that `attempted_credential_dump_from_registry_via_reg_exe_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **attempted_credential_dump_from_registry_via_reg_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -91,9 +147,6 @@ None identified.
* [Windows Registry Abuse](/stories/windows_registry_abuse)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -103,8 +156,6 @@ None identified.
| 90.0 | 90 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to export the registry keys. |
-
-
#### Reference
* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets)
@@ -112,7 +163,7 @@ None identified.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-16-batch_file_write_to_system32.md b/docs/_posts/2021-09-16-batch_file_write_to_system32.md
index c42d3e881c..9f525a1942 100644
--- a/docs/_posts/2021-09-16-batch_file_write_to_system32.md
+++ b/docs/_posts/2021-09-16-batch_file_write_to_system32.md
@@ -27,16 +27,21 @@ tags:
The search looks for a batch file (.bat) written to the Windows system directory tree.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-09-16
- **Author**: Michael Haag, Rico Valdez, Splunk
- **ID**: 503d17cb-9eab-4cf8-a20e-01d5c6987ae3
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,56 @@ The search looks for a batch file (.bat) written to the Windows system directory
| [T1204.002](https://attack.mitre.org/techniques/T1204/002/) | Malicious File | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Delivery
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -63,7 +118,7 @@ The search looks for a batch file (.bat) written to the Windows system directory
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `batch_file_write_to_system32_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **batch_file_write_to_system32_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -86,9 +141,6 @@ It is possible for this search to generate a notable event for a batch file writ
* [SamSam Ransomware](/stories/samsam_ransomware)
-#### Kill Chain Phase
-* Delivery
-
#### RBA
@@ -98,13 +150,11 @@ It is possible for this search to generate a notable event for a batch file writ
| 63.0 | 70 | 90 | A file - $file_name$ was written to system32 has occurred on endpoint $dest$ by user $user$. |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-16-bits_job_persistence.md b/docs/_posts/2021-09-16-bits_job_persistence.md
index 84bdfed09c..2d4fdb42fb 100644
--- a/docs/_posts/2021-09-16-bits_job_persistence.md
+++ b/docs/_posts/2021-09-16-bits_job_persistence.md
@@ -25,21 +25,71 @@ tags:
The following query identifies Microsoft Background Intelligent Transfer Service utility `bitsadmin.exe` scheduling a BITS job to persist on an endpoint. The query identifies the parameters used to create, resume or add a file to a BITS job. Typically seen combined in a oneliner or ran in sequence. If identified, review the BITS job created and capture any files written to disk. It is possible for BITS to be used to upload files and this may require further network data analysis to identify. You can use `bitsadmin /list /verbose` to list out the jobs during investigation.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-09-16
- **Author**: Michael Haag, Splunk
- **ID**: e97a5ffe-90bf-11eb-928a-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1197](https://attack.mitre.org/techniques/T1197/) | BITS Jobs | Defense Evasion, Persistence |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -53,11 +103,11 @@ The following query identifies Microsoft Background Intelligent Transfer Service
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_bitsadmin](https://github.com/splunk/security_content/blob/develop/macros/process_bitsadmin.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `bits_job_persistence_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **bits_job_persistence_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -85,9 +135,6 @@ Limited false positives will be present. Typically, applications will use `BitsA
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -97,8 +144,6 @@ Limited false positives will be present. Typically, applications will use `BitsA
| 56.0 | 70 | 80 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to persist using BITS. |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1197/](https://attack.mitre.org/techniques/T1197/)
@@ -109,7 +154,7 @@ Limited false positives will be present. Typically, applications will use `BitsA
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-16-bitsadmin_download_file.md b/docs/_posts/2021-09-16-bitsadmin_download_file.md
index f7526ee87a..23db7765d2 100644
--- a/docs/_posts/2021-09-16-bitsadmin_download_file.md
+++ b/docs/_posts/2021-09-16-bitsadmin_download_file.md
@@ -28,16 +28,21 @@ tags:
The following query identifies Microsoft Background Intelligent Transfer Service utility `bitsadmin.exe` using the `transfer` parameter to download a remote object. In addition, look for `download` or `upload` on the command-line, the switches are not required to perform a transfer. Capture any files downloaded. Review the reputation of the IP or domain used. Typically once executed, a follow on command will be used to execute the dropped file. Note that the network connection or file modification events related will not spawn or create from `bitsadmin.exe`, but the artifacts will appear in a parallel process of `svchost.exe` with a command-line similar to `svchost.exe -k netsvcs -s BITS`. It's important to review all parallel and child processes to capture any behaviors and artifacts. In some suspicious and malicious instances, BITS jobs will be created. You can use `bitsadmin /list /verbose` to list out the jobs during investigation.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-09-16
- **Author**: Michael Haag, Splunk
- **ID**: 80630ff4-8e4c-11eb-aab5-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -45,6 +50,51 @@ The following query identifies Microsoft Background Intelligent Transfer Service
| [T1105](https://attack.mitre.org/techniques/T1105/) | Ingress Tool Transfer | Command And Control |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -58,11 +108,11 @@ The following query identifies Microsoft Background Intelligent Transfer Service
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_bitsadmin](https://github.com/splunk/security_content/blob/develop/macros/process_bitsadmin.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `bitsadmin_download_file_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **bitsadmin_download_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -92,9 +142,6 @@ Limited false positives, however it may be required to filter based on parent pr
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -104,8 +151,6 @@ Limited false positives, however it may be required to filter based on parent pr
| 49.0 | 70 | 70 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a file. |
-
-
#### Reference
* [https://github.com/redcanaryco/atomic-red-team/blob/8eb52117b748d378325f7719554a896e37bccec7/atomics/T1105/T1105.md#atomic-test-9---windows---bitsadmin-bits-download](https://github.com/redcanaryco/atomic-red-team/blob/8eb52117b748d378325f7719554a896e37bccec7/atomics/T1105/T1105.md#atomic-test-9---windows---bitsadmin-bits-download)
@@ -116,7 +161,7 @@ Limited false positives, however it may be required to filter based on parent pr
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md b/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md
index 77dfd8bc75..d2c24cb583 100644
--- a/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md
+++ b/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md
@@ -27,16 +27,21 @@ tags:
This search detects the use of wmic and Powershell to create a shadow copy.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-09-16
- **Author**: Patrick Bareiss, Splunk
- **ID**: 2ed8b538-d284-449a-be1d-82ad1dbd186b
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,56 @@ This search detects the use of wmic and Powershell to create a shadow copy.
| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -57,12 +112,12 @@ This search detects the use of wmic and Powershell to create a shadow copy.
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `creation_of_shadow_copy_with_wmic_and_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **creation_of_shadow_copy_with_wmic_and_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -90,9 +145,6 @@ Legtimate administrator usage of wmic to create a shadow copy.
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -102,8 +154,6 @@ Legtimate administrator usage of wmic to create a shadow copy.
| 81.0 | 90 | 90 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to create a shadow copy to perform offline password cracking. |
-
-
#### Reference
* [https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf](https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf)
@@ -111,7 +161,7 @@ Legtimate administrator usage of wmic to create a shadow copy.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md b/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md
index f5350eadb7..61583f829d 100644
--- a/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md
+++ b/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md
@@ -27,16 +27,21 @@ tags:
This search detects credential dumping using copy command from a shadow copy.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-09-16
- **Author**: Patrick Bareiss, Splunk
- **ID**: d8c406fe-23d2-45f3-a983-1abe7b83ff3b
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,56 @@ This search detects credential dumping using copy command from a shadow copy.
| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -58,10 +113,10 @@ This search detects credential dumping using copy command from a shadow copy.
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
-Note that `credential_dumping_via_copy_command_from_shadow_copy_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **credential_dumping_via_copy_command_from_shadow_copy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -88,9 +143,6 @@ unknown
* [Credential Dumping](/stories/credential_dumping)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -100,8 +152,6 @@ unknown
| 81.0 | 90 | 90 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to copy SAM and NTDS.dit for offline password cracking. |
-
-
#### Reference
* [https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf](https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf)
@@ -109,7 +159,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md b/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md
index 78ea597fc6..33451ed69f 100644
--- a/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md
+++ b/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md
@@ -27,16 +27,21 @@ tags:
This search detects the creation of a symlink to a shadow copy.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-09-16
- **Author**: Patrick Bareiss, Splunk
- **ID**: c5eac648-fae0-4263-91a6-773df1f4c903
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,56 @@ This search detects the creation of a symlink to a shadow copy.
| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -58,10 +113,10 @@ This search detects the creation of a symlink to a shadow copy.
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
-Note that `credential_dumping_via_symlink_to_shadow_copy_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **credential_dumping_via_symlink_to_shadow_copy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -88,9 +143,6 @@ unknown
* [Credential Dumping](/stories/credential_dumping)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -100,8 +152,6 @@ unknown
| 81.0 | 90 | 90 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to create symlink to a shadow copy to grab credentials. |
-
-
#### Reference
* [https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf](https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf)
@@ -109,7 +159,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-16-detect_html_help_renamed.md b/docs/_posts/2021-09-16-detect_html_help_renamed.md
index 1109f6a50d..460d449fd2 100644
--- a/docs/_posts/2021-09-16-detect_html_help_renamed.md
+++ b/docs/_posts/2021-09-16-detect_html_help_renamed.md
@@ -27,16 +27,21 @@ tags:
The following analytic identifies a renamed instance of hh.exe (HTML Help) executing a Compiled HTML Help (CHM). This particular technique will load Windows script code from a compiled help file. CHM files may contain nearly any file type embedded, but only execute html/htm. Upon a successful execution, the following script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe upon execution. The "htm" and "html" file extensions were the only extensions observed to be supported for the execution of Shortcut commands or WSH script code. During investigation, identify script content origination. Validate it is the legitimate version of hh.exe by reviewing the PE metadata. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-09-16
- **Author**: Michael Haag, Splunk
- **ID**: 62fed254-513b-460e-953d-79771493a9f3
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,56 @@ The following analytic identifies a renamed instance of hh.exe (HTML Help) execu
| [T1218.001](https://attack.mitre.org/techniques/T1218/001/) | Compiled HTML File | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -57,11 +112,11 @@ The following analytic identifies a renamed instance of hh.exe (HTML Help) execu
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_hh](https://github.com/splunk/security_content/blob/develop/macros/process_hh.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_html_help_renamed_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_html_help_renamed_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -89,9 +144,6 @@ Although unlikely a renamed instance of hh.exe will be used legitimately, filter
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -101,8 +153,6 @@ Although unlikely a renamed instance of hh.exe will be used legitimately, filter
| 80.0 | 80 | 100 | The following $process_name$ has been identified as renamed, spawning from $parent_process_name$. |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1218/001/](https://attack.mitre.org/techniques/T1218/001/)
@@ -112,7 +162,7 @@ Although unlikely a renamed instance of hh.exe will be used legitimately, filter
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md b/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md
index 85d55bf310..70ba92f123 100644
--- a/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md
+++ b/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md
@@ -27,16 +27,21 @@ tags:
The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTML Help (CHM) file from a remote url. This particular technique will load Windows script code from a compiled help file. CHM files may contain nearly any file type embedded, but only execute html/htm. Upon a successful execution, the following script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe upon execution. The "htm" and "html" file extensions were the only extensions observed to be supported for the execution of Shortcut commands or WSH script code. During investigation, identify script content origination. Review reputation of remote IP and domain. Some instances, it is worth decompiling the .chm file to review its original contents. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-09-16
- **Author**: Michael Haag, Splunk
- **ID**: 8c5835b9-39d9-438b-817c-95f14c69a31e
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,56 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM
| [T1218.001](https://attack.mitre.org/techniques/T1218/001/) | Compiled HTML File | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -57,11 +112,11 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_hh](https://github.com/splunk/security_content/blob/develop/macros/process_hh.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_html_help_url_in_command_line_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_html_help_url_in_command_line_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -89,9 +144,6 @@ Although unlikely, some legitimate applications may retrieve a CHM remotely, fil
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -101,8 +153,6 @@ Although unlikely, some legitimate applications may retrieve a CHM remotely, fil
| 90.0 | 90 | 100 | An instance of $parent_proces_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ contacting a remote destination to potentally download a malicious payload. |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1218/001/](https://attack.mitre.org/techniques/T1218/001/)
@@ -115,7 +165,7 @@ Although unlikely, some legitimate applications may retrieve a CHM remotely, fil
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md b/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md
index 1b192f90e0..60e92b6fbc 100644
--- a/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md
+++ b/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md
@@ -27,16 +27,21 @@ tags:
The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTML Help (CHM) file using InfoTech Storage Handlers. This particular technique will load Windows script code from a compiled help file, using InfoTech Storage Handlers. itss.dll will load upon execution. Three InfoTech Storage handlers are supported - ms-its, its, mk:@MSITStore. ITSS may be used to launch a specific html/htm file from within a CHM file. CHM files may contain nearly any file type embedded. Upon a successful execution, the following script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe upon execution. The "htm" and "html" file extensions were the only extensions observed to be supported for the execution of Shortcut commands or WSH script code. During investigation, identify script content origination. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-09-16
- **Author**: Michael Haag, Splunk
- **ID**: 0b2eefa5-5508-450d-b970-3dd2fb761aec
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,56 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM
| [T1218.001](https://attack.mitre.org/techniques/T1218/001/) | Compiled HTML File | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -57,11 +112,11 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_hh](https://github.com/splunk/security_content/blob/develop/macros/process_hh.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_html_help_using_infotech_storage_handlers_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_html_help_using_infotech_storage_handlers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -89,9 +144,6 @@ It is rare to see instances of InfoTech Storage Handlers being used, but it does
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -101,8 +153,6 @@ It is rare to see instances of InfoTech Storage Handlers being used, but it does
| 72.0 | 80 | 90 | $process_name$ has been identified using Infotech Storage Handlers to load a specific file within a CHM on $dest$ under user $user$. |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1218/001/](https://attack.mitre.org/techniques/T1218/001/)
@@ -115,7 +165,7 @@ It is rare to see instances of InfoTech Storage Handlers being used, but it does
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md b/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md
index 488bc7c932..bd840b3f26 100644
--- a/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md
+++ b/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md
@@ -27,16 +27,21 @@ tags:
The following analytic identifies "mshta.exe" execution with inline protocol handlers. "JavaScript", "VBScript", and "About" are the only supported options when invoking HTA content directly on the command-line. The search will return the first time and last time these command-line arguments were used for these executions, as well as the target system, the user, process "mshta.exe" and its parent process.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-09-16
- **Author**: Bhavin Patel, Michael Haag, Splunk
- **ID**: a0873b32-5b68-11eb-ae93-0242ac130002
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,56 @@ The following analytic identifies "mshta.exe" execution with inline protocol han
| [T1218.005](https://attack.mitre.org/techniques/T1218/005/) | Mshta | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -57,11 +112,11 @@ The following analytic identifies "mshta.exe" execution with inline protocol han
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_mshta_inline_hta_execution_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_mshta_inline_hta_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -89,9 +144,6 @@ Although unlikely, some legitimate applications may exhibit this behavior, trigg
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -101,8 +153,6 @@ Although unlikely, some legitimate applications may exhibit this behavior, trigg
| 90.0 | 90 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ executing with inline HTA, indicative of defense evasion. |
-
-
#### Reference
* [https://github.com/redcanaryco/AtomicTestHarnesses](https://github.com/redcanaryco/AtomicTestHarnesses)
@@ -112,7 +162,7 @@ Although unlikely, some legitimate applications may exhibit this behavior, trigg
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-16-detect_mshta_renamed.md b/docs/_posts/2021-09-16-detect_mshta_renamed.md
index a7311dfbc8..05ffb568a6 100644
--- a/docs/_posts/2021-09-16-detect_mshta_renamed.md
+++ b/docs/_posts/2021-09-16-detect_mshta_renamed.md
@@ -27,16 +27,21 @@ tags:
The following analytic identifies renamed instances of mshta.exe executing. Mshta.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. This analytic utilizes the internal name of the PE to identify if is the legitimate mshta binary. Further analysis should be performed to review the executed content and validation it is the real mshta.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-09-16
- **Author**: Michael Haag, Splunk
- **ID**: 8f45fcf0-5b68-11eb-ae93-0242ac130002
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,56 @@ The following analytic identifies renamed instances of mshta.exe executing. Msht
| [T1218.005](https://attack.mitre.org/techniques/T1218/005/) | Mshta | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -57,11 +112,11 @@ The following analytic identifies renamed instances of mshta.exe executing. Msht
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_mshta_renamed_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_mshta_renamed_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -89,9 +144,6 @@ Although unlikely, some legitimate applications may use a moved copy of mshta.ex
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -101,8 +153,6 @@ Although unlikely, some legitimate applications may use a moved copy of mshta.ex
| 80.0 | 80 | 100 | The following $process_name$ has been identified as renamed, spawning from $parent_process_name$. |
-
-
#### Reference
* [https://github.com/redcanaryco/AtomicTestHarnesses](https://github.com/redcanaryco/AtomicTestHarnesses)
@@ -111,7 +161,7 @@ Although unlikely, some legitimate applications may use a moved copy of mshta.ex
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md b/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md
index 9772df3b54..608c69a9cc 100644
--- a/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md
+++ b/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md
@@ -27,16 +27,21 @@ tags:
This analytic identifies when Microsoft HTML Application Host (mshta.exe) utility is used to make remote http connections. Adversaries may use mshta.exe to proxy the download and execution of remote .hta files. The analytic identifies command line arguments of http and https being used. This technique is commonly used by malicious software to bypass preventative controls. The search will return the first time and last time these command-line arguments were used for these executions, as well as the target system, the user, process "rundll32.exe" and its parent process.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-09-16
- **Author**: Michael Haag, Splunk
- **ID**: 9b3af1e6-5b68-11eb-ae93-0242ac130002
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,56 @@ This analytic identifies when Microsoft HTML Application Host (mshta.exe) utilit
| [T1218.005](https://attack.mitre.org/techniques/T1218/005/) | Mshta | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -57,11 +112,11 @@ This analytic identifies when Microsoft HTML Application Host (mshta.exe) utilit
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_mshta_url_in_command_line_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_mshta_url_in_command_line_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -89,9 +144,6 @@ It is possible legitimate applications may perform this behavior and will need t
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -101,8 +153,6 @@ It is possible legitimate applications may perform this behavior and will need t
| 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $est$ by user $user$ attempting to access a remote destination to download an additional payload. |
-
-
#### Reference
* [https://github.com/redcanaryco/AtomicTestHarnesses](https://github.com/redcanaryco/AtomicTestHarnesses)
@@ -112,7 +162,7 @@ It is possible legitimate applications may perform this behavior and will need t
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md b/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md
index 160ea38aeb..d6fe2a985e 100644
--- a/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md
+++ b/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md
@@ -27,16 +27,21 @@ tags:
This search looks for events where `PsExec.exe` is run with the `accepteula` flag in the command line. PsExec is a built-in Windows utility that enables you to execute processes on other systems. It is fully interactive for console applications. This tool is widely used for launching interactive command prompts on remote systems. Threat actors leverage this extensively for executing code on compromised systems. If an attacker is running PsExec for the first time, they will be prompted to accept the end-user license agreement (EULA), which can be passed as the argument `accepteula` within the command line.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-09-16
- **Author**: Bhavin Patel, Splunk
- **ID**: 27c3a83d-cada-47c6-9042-67baf19d2574
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,56 @@ This search looks for events where `PsExec.exe` is run with the `accepteula` fla
| [T1021.002](https://attack.mitre.org/techniques/T1021/002/) | SMB/Windows Admin Shares | Lateral Movement |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -57,11 +112,11 @@ This search looks for events where `PsExec.exe` is run with the `accepteula` fla
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_psexec](https://github.com/splunk/security_content/blob/develop/macros/process_psexec.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_psexec_with_accepteula_flag_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_psexec_with_accepteula_flag_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -92,9 +147,6 @@ Administrators can leverage PsExec for accessing remote systems and might pass `
* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -104,13 +156,11 @@ Administrators can leverage PsExec for accessing remote systems and might pass `
| 35.0 | 50 | 70 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ running the utility for possibly the first time. |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-16-detect_renamed_7-zip.md b/docs/_posts/2021-09-16-detect_renamed_7-zip.md
index 7a0384440c..cdd806c7cf 100644
--- a/docs/_posts/2021-09-16-detect_renamed_7-zip.md
+++ b/docs/_posts/2021-09-16-detect_renamed_7-zip.md
@@ -27,16 +27,21 @@ tags:
The following analytic identifies renamed 7-Zip usage using Sysmon. At this stage of an attack, review parallel processes and file modifications for data that is staged or potentially have been exfiltrated. This analytic utilizes the OriginalFileName to capture the renamed process. During triage, validate this is the legitimate version of `7zip` by reviewing the PE metadata. In addition, review parallel processes for further suspicious behavior.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-09-16
- **Author**: Michael Haag, Splunk
- **ID**: 4057291a-b8cf-11eb-95fe-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ The following analytic identifies renamed 7-Zip usage using Sysmon. At this stag
| [T1560](https://attack.mitre.org/techniques/T1560/) | Archive Collected Data | Collection |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +107,10 @@ The following analytic identifies renamed 7-Zip usage using Sysmon. At this stag
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_renamed_7-zip_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_renamed_7-zip_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -87,9 +137,6 @@ Limited false positives, however this analytic will need to be modified for each
* [Collection and Staging](/stories/collection_and_staging)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -99,8 +146,6 @@ Limited false positives, however this analytic will need to be modified for each
| 27.0 | 30 | 90 | The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$. |
-
-
#### Reference
* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1560.001/T1560.001.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1560.001/T1560.001.md)
@@ -108,7 +153,7 @@ Limited false positives, however this analytic will need to be modified for each
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-16-detect_renamed_psexec.md b/docs/_posts/2021-09-16-detect_renamed_psexec.md
index 443bebaf14..40318f4d2a 100644
--- a/docs/_posts/2021-09-16-detect_renamed_psexec.md
+++ b/docs/_posts/2021-09-16-detect_renamed_psexec.md
@@ -27,16 +27,21 @@ tags:
The following analytic identifies renamed instances of `PsExec.exe` being utilized on an endpoint. Most instances, it is highly probable to capture `Psexec.exe` or other SysInternal utility usage with the command-line argument of `-accepteula`. During triage, validate this is the legitimate version of `PsExec` by reviewing the PE metadata. In addition, review parallel processes for further suspicious behavior.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-09-16
- **Author**: Michael Haag, Splunk
- **ID**: 683e6196-b8e8-11eb-9a79-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ The following analytic identifies renamed instances of `PsExec.exe` being utiliz
| [T1569.002](https://attack.mitre.org/techniques/T1569/002/) | Service Execution | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,11 +107,11 @@ The following analytic identifies renamed instances of `PsExec.exe` being utiliz
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_psexec](https://github.com/splunk/security_content/blob/develop/macros/process_psexec.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_renamed_psexec_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_renamed_psexec_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -92,9 +142,6 @@ Limited false positives should be present. It is possible some third party appli
* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -104,8 +151,6 @@ Limited false positives should be present. It is possible some third party appli
| 27.0 | 30 | 90 | The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$. |
-
-
#### Reference
* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1569.002/T1569.002.yaml](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1569.002/T1569.002.yaml)
@@ -114,7 +159,7 @@ Limited false positives should be present. It is possible some third party appli
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-16-detect_renamed_rclone.md b/docs/_posts/2021-09-16-detect_renamed_rclone.md
index c5eec05b17..08d288f6b1 100644
--- a/docs/_posts/2021-09-16-detect_renamed_rclone.md
+++ b/docs/_posts/2021-09-16-detect_renamed_rclone.md
@@ -23,21 +23,71 @@ tags:
The following analytic identifies the usage of `rclone.exe`, renamed, being used to exfiltrate data to a remote destination. RClone has been used by multiple ransomware groups to exfiltrate data. In many instances, it will be downloaded from the legitimate site and executed accordingly. During triage, isolate the endpoint and begin to review parallel processes for additional behavior. At this stage, the adversary may have staged data to be exfiltrated.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-09-16
- **Author**: Michael Haag, Splunk
- **ID**: 6dca1124-b3ec-11eb-9328-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1020](https://attack.mitre.org/techniques/T1020/) | Automated Exfiltration | Exfiltration |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -51,10 +101,10 @@ The following analytic identifies the usage of `rclone.exe`, renamed, being used
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_renamed_rclone_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_renamed_rclone_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -82,9 +132,6 @@ False positives should be limited as this analytic identifies renamed instances
* [Ransomware](/stories/ransomware)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -94,8 +141,6 @@ False positives should be limited as this analytic identifies renamed instances
| 27.0 | 30 | 90 | The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$. |
-
-
#### Reference
* [https://redcanary.com/blog/rclone-mega-extortion/](https://redcanary.com/blog/rclone-mega-extortion/)
@@ -105,7 +150,7 @@ False positives should be limited as this analytic identifies renamed instances
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-16-detect_renamed_winrar.md b/docs/_posts/2021-09-16-detect_renamed_winrar.md
index cc818d4d12..b7382fef74 100644
--- a/docs/_posts/2021-09-16-detect_renamed_winrar.md
+++ b/docs/_posts/2021-09-16-detect_renamed_winrar.md
@@ -27,16 +27,21 @@ tags:
The following analtyic identifies renamed instances of `WinRAR.exe`. In most cases, it is not common for WinRAR to be used renamed, however it is common to be installed by a third party application and executed from a non-standard path. During triage, validate additional metadata from the binary that this is `WinRAR`. Review parallel processes and file modifications.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-09-16
- **Author**: Michael Haag, Splunk
- **ID**: 1b7bfb2c-b8e6-11eb-99ac-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ The following analtyic identifies renamed instances of `WinRAR.exe`. In most cas
| [T1560](https://attack.mitre.org/techniques/T1560/) | Archive Collected Data | Collection |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +107,10 @@ The following analtyic identifies renamed instances of `WinRAR.exe`. In most cas
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_renamed_winrar_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_renamed_winrar_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -87,9 +137,6 @@ Unknown. It is possible third party applications use renamed instances of WinRAR
* [Collection and Staging](/stories/collection_and_staging)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -99,8 +146,6 @@ Unknown. It is possible third party applications use renamed instances of WinRAR
| 27.0 | 30 | 90 | The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$. |
-
-
#### Reference
* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1560.001/T1560.001.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1560.001/T1560.001.md)
@@ -108,7 +153,7 @@ Unknown. It is possible third party applications use renamed instances of WinRAR
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-16-dump_lsass_via_procdump.md b/docs/_posts/2021-09-16-dump_lsass_via_procdump.md
index d0fd543f6b..d264a0a768 100644
--- a/docs/_posts/2021-09-16-dump_lsass_via_procdump.md
+++ b/docs/_posts/2021-09-16-dump_lsass_via_procdump.md
@@ -28,16 +28,21 @@ tags:
Detect procdump.exe dumping the lsass process. This query looks for both -mm and -ma usage. -mm will produce a mini dump file and -ma will write a dump file with all process memory. Both are highly suspect and should be reviewed. This query does not monitor for the internal name (original_file_name=procdump) of the PE or look for procdump64.exe. Modify the query as needed.\
During triage, confirm this is procdump.exe executing. If it is the first time a Sysinternals utility has been ran, it is possible there will be a -accepteula on the command line. Review other endpoint data sources for cross process (injection) into lsass.exe.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-09-16
- **Author**: Michael Haag, Splunk
- **ID**: 3742ebfe-64c2-11eb-ae93-0242ac130002
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -45,6 +50,57 @@ During triage, confirm this is procdump.exe executing. If it is the first time a
| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -58,11 +114,11 @@ During triage, confirm this is procdump.exe executing. If it is the first time a
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_procdump](https://github.com/splunk/security_content/blob/develop/macros/process_procdump.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `dump_lsass_via_procdump_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **dump_lsass_via_procdump_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -86,9 +142,6 @@ None identified.
* [HAFNIUM Group](/stories/hafnium_group)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -98,8 +151,6 @@ None identified.
| 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified attempting to dump lsass.exe on endpoint $dest$ by user $user$. |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1003/001/](https://attack.mitre.org/techniques/T1003/001/)
@@ -109,7 +160,7 @@ None identified.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-16-local_account_discovery_with_net.md b/docs/_posts/2021-09-16-local_account_discovery_with_net.md
index 8b50301451..e7a843e35e 100644
--- a/docs/_posts/2021-09-16-local_account_discovery_with_net.md
+++ b/docs/_posts/2021-09-16-local_account_discovery_with_net.md
@@ -27,16 +27,21 @@ tags:
This analytic looks for the execution of `net.exe` or `net1.exe` with command-line arguments utilized to query for local users. The two arguments `user` and 'users', return a list of all local users. Red Teams and adversaries alike use net.exe to enumerate users for situational awareness and Active Directory Discovery.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-09-16
- **Author**: Mauricio Velazco, Splunk
- **ID**: 5d0d4830-0133-11ec-bae3-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-li
| [T1087.001](https://attack.mitre.org/techniques/T1087/001/) | Local Account | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,11 +107,11 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-li
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `local_account_discovery_with_net_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **local_account_discovery_with_net_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -77,9 +127,6 @@ Administrators or power users may use this command for troubleshooting.
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -89,8 +136,6 @@ Administrators or power users may use this command for troubleshooting.
| 15.0 | 30 | 50 | Local user discovery enumeration on $dest$ by $user$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1087/001/](https://attack.mitre.org/techniques/T1087/001/)
@@ -98,7 +143,7 @@ Administrators or power users may use this command for troubleshooting.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md b/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md
index 569b8dba8c..e54711cdfa 100644
--- a/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md
+++ b/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md
@@ -27,16 +27,21 @@ tags:
This analytic looks for the execution of `wmic.exe` with command-line arguments utilized to query for local users. The argument `useraccount` is used to leverage WMI to return a list of all local users. Red Teams and adversaries alike use net.exe to enumerate users for situational awareness and Active Directory Discovery.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-09-16
- **Author**: Mauricio Velazco, Splunk
- **ID**: 4902d7aa-0134-11ec-9d65-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments
| [T1087.001](https://attack.mitre.org/techniques/T1087/001/) | Local Account | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,11 +107,11 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `local_account_discovery_with_wmic_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **local_account_discovery_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -77,9 +127,6 @@ Administrators or power users may use this command for troubleshooting.
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -89,8 +136,6 @@ Administrators or power users may use this command for troubleshooting.
| 15.0 | 30 | 50 | Local user discovery enumeration on $dest$ by $user$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1087/001/](https://attack.mitre.org/techniques/T1087/001/)
@@ -98,7 +143,7 @@ Administrators or power users may use this command for troubleshooting.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-16-office_product_spawning_wmic.md b/docs/_posts/2021-09-16-office_product_spawning_wmic.md
index af12772d54..f494214095 100644
--- a/docs/_posts/2021-09-16-office_product_spawning_wmic.md
+++ b/docs/_posts/2021-09-16-office_product_spawning_wmic.md
@@ -27,16 +27,21 @@ tags:
The following detection identifies the latest behavior utilized by Ursnif malware family. This detection identifies any Windows Office Product spawning `wmic.exe`. In malicious instances, the command-line of `wmic.exe` will contain `wmic process call create`. In addition, Threat Research has released a detection identifying the use of `wmic process call create` on the command-line of `wmic.exe`. In this instance, we narrow our detection down to the Office suite as a parent process. During triage, review all file modifications. Capture and analyze any artifacts on disk. The Office Product, or `wmic.exe` will have reached out to a remote destination, capture and block the IPs or domain. Review additional parallel processes for further activity.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-09-16
- **Author**: Michael Haag, Splunk
- **ID**: ffc236d6-a6c9-11eb-95f1-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ The following detection identifies the latest behavior utilized by Ursnif malwar
| [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,11 +107,11 @@ The following detection identifies the latest behavior utilized by Ursnif malwar
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `office_product_spawning_wmic_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **office_product_spawning_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -89,9 +139,6 @@ No false positives known. Filter as needed.
* [FIN7](/stories/fin7)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -101,8 +148,6 @@ No false positives known. Filter as needed.
| 63.0 | 70 | 90 | office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ in host $dest$ |
-
-
#### Reference
* [https://app.any.run/tasks/fb894ab8-a966-4b72-920b-935f41756afd/](https://app.any.run/tasks/fb894ab8-a966-4b72-920b-935f41756afd/)
@@ -112,7 +157,7 @@ No false positives known. Filter as needed.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-16-processes_launching_netsh.md b/docs/_posts/2021-09-16-processes_launching_netsh.md
index b2a15fd3c8..f1098a5fe4 100644
--- a/docs/_posts/2021-09-16-processes_launching_netsh.md
+++ b/docs/_posts/2021-09-16-processes_launching_netsh.md
@@ -27,16 +27,21 @@ tags:
This search looks for processes launching netsh.exe. Netsh is a command-line scripting utility that allows you to, either locally or remotely, display or modify the network configuration of a computer that is currently running. Netsh can be used as a persistence proxy technique to execute a helper DLL when netsh.exe is executed. In this search, we are looking for processes spawned by netsh.exe and executing commands via the command line.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-09-16
- **Author**: Michael Haag, Josef Kuepker, Splunk
- **ID**: b89919ed-fe5f-492c-b139-95dbb162040e
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,56 @@ This search looks for processes launching netsh.exe. Netsh is a command-line scr
| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -57,11 +112,11 @@ This search looks for processes launching netsh.exe. Netsh is a command-line scr
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `processes_launching_netsh_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **processes_launching_netsh_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -85,9 +140,6 @@ Some VPN applications are known to launch netsh.exe. Outside of these instances,
* [DHS Report TA18-074A](/stories/dhs_report_ta18-074a)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -97,13 +149,11 @@ Some VPN applications are known to launch netsh.exe. Outside of these instances,
| 42.0 | 60 | 70 | A process $process_name$ that tries to execute netsh commandline $process$ in host $dest$ |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-20-office_document_spawned_child_process_to_download.md b/docs/_posts/2021-09-20-office_document_spawned_child_process_to_download.md
index 7ee6b47c4f..2101d93e7b 100644
--- a/docs/_posts/2021-09-20-office_document_spawned_child_process_to_download.md
+++ b/docs/_posts/2021-09-20-office_document_spawned_child_process_to_download.md
@@ -27,16 +27,21 @@ tags:
This search is to detect potential malicious office document executing lolbin child process to download payload or other malware. Since most of the attacker abused the capability of office document to execute living on land application to blend it to the normal noise in the infected machine to cover its track.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-09-20
- **Author**: Teoderick Contreras, Splunk
- **ID**: 6fed27d2-9ec7-11eb-8fe4-aa665a019aa3
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This search is to detect potential malicious office document executing lolbin ch
| [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +107,10 @@ This search is to detect potential malicious office document executing lolbin ch
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `office_document_spawned_child_process_to_download_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **office_document_spawned_child_process_to_download_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -87,9 +137,6 @@ Default browser not in the filter list.
* [Spearphishing Attachments](/stories/spearphishing_attachments)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -99,8 +146,6 @@ Default browser not in the filter list.
| 35.0 | 70 | 50 | Office document spawning suspicious child process on $dest$ |
-
-
#### Reference
* [https://app.any.run/tasks/92d7ef61-bfd7-4c92-bc15-322172b4ebec/#](https://app.any.run/tasks/92d7ef61-bfd7-4c92-bc15-322172b4ebec/#)
@@ -108,7 +153,7 @@ Default browser not in the filter list.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-20-suspicious_microsoft_workflow_compiler_rename.md b/docs/_posts/2021-09-20-suspicious_microsoft_workflow_compiler_rename.md
index cbb31e7847..d00fa64fff 100644
--- a/docs/_posts/2021-09-20-suspicious_microsoft_workflow_compiler_rename.md
+++ b/docs/_posts/2021-09-20-suspicious_microsoft_workflow_compiler_rename.md
@@ -30,16 +30,21 @@ tags:
The following analytic identifies a renamed instance of microsoft.workflow.compiler.exe. Microsoft.workflow.compiler.exe is natively found in C:\Windows\Microsoft.NET\Framework64\v4.0.30319 and is rarely utilized. When investigating, identify the executed code on disk and review. A spawned child process from microsoft.workflow.compiler.exe is uncommon. In any instance, microsoft.workflow.compiler.exe spawning from an Office product or any living off the land binary is highly suspect.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-09-20
- **Author**: Michael Haag, Splunk
- **ID**: f0db4464-55d9-11eb-ae93-0242ac130002
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -49,6 +54,56 @@ The following analytic identifies a renamed instance of microsoft.workflow.compi
| [T1036.003](https://attack.mitre.org/techniques/T1036/003/) | Rename System Utilities | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -62,11 +117,11 @@ The following analytic identifies a renamed instance of microsoft.workflow.compi
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_microsoftworkflowcompiler](https://github.com/splunk/security_content/blob/develop/macros/process_microsoftworkflowcompiler.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `suspicious_microsoft_workflow_compiler_rename_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **suspicious_microsoft_workflow_compiler_rename_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -96,9 +151,6 @@ Although unlikely, some legitimate applications may use a moved copy of microsof
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -108,8 +160,6 @@ Although unlikely, some legitimate applications may use a moved copy of microsof
| 63.0 | 70 | 90 | Suspicious renamed microsoft.workflow.compiler.exe binary ran on $dest$ by $user$ |
-
-
#### Reference
* [https://lolbas-project.github.io/lolbas/Binaries/Microsoft.Workflow.Compiler/](https://lolbas-project.github.io/lolbas/Binaries/Microsoft.Workflow.Compiler/)
@@ -118,7 +168,7 @@ Although unlikely, some legitimate applications may use a moved copy of microsof
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-21-remcos_rat_file_creation_in_remcos_folder.md b/docs/_posts/2021-09-21-remcos_rat_file_creation_in_remcos_folder.md
index 7f4a00ec73..c2bdeb5212 100644
--- a/docs/_posts/2021-09-21-remcos_rat_file_creation_in_remcos_folder.md
+++ b/docs/_posts/2021-09-21-remcos_rat_file_creation_in_remcos_folder.md
@@ -24,21 +24,71 @@ tags:
This search is to detect file creation in remcos folder in appdata which is the keylog and clipboard logs that will be send to its c2 server. This is really a good TTP indicator that there is a remcos rat in the system that do keylogging, clipboard grabbing and audio recording.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-09-21
- **Author**: Teoderick Contreras, Splunk
- **ID**: 25ae862a-1ac3-11ec-94a1-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1113](https://attack.mitre.org/techniques/T1113/) | Screen Capture | Collection |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +102,10 @@ This search is to detect file creation in remcos folder in appdata which is the
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `remcos_rat_file_creation_in_remcos_folder_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **remcos_rat_file_creation_in_remcos_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -75,9 +125,6 @@ unknown
* [Remcos](/stories/remcos)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -87,8 +134,6 @@ unknown
| 100.0 | 100 | 100 | file $file_name$ created in $file_path$ of $dest$ |
-
-
#### Reference
* [https://success.trendmicro.com/solution/1123281-remcos-malware-information](https://success.trendmicro.com/solution/1123281-remcos-malware-information)
@@ -97,7 +142,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-21-suspicious_image_creation_in_appdata_folder.md b/docs/_posts/2021-09-21-suspicious_image_creation_in_appdata_folder.md
index 0c6ae8cd81..809181e1fe 100644
--- a/docs/_posts/2021-09-21-suspicious_image_creation_in_appdata_folder.md
+++ b/docs/_posts/2021-09-21-suspicious_image_creation_in_appdata_folder.md
@@ -24,21 +24,71 @@ tags:
This search is to detect a suspicious creation of image in appdata folder made by process that also has a file reference in appdata folder. This technique was seen in remcos rat that capture screenshot of the compromised machine and place it in the appdata and will be send to its C2 server. This TTP is really a good indicator to check that process because it is in suspicious folder path and image files are not commonly created by user in this folder path.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-09-21
- **Author**: Teoderick Contreras, Splunk
- **ID**: f6f904c4-1ac0-11ec-806b-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1113](https://attack.mitre.org/techniques/T1113/) | Screen Capture | Collection |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -56,7 +106,7 @@ This search is to detect a suspicious creation of image in appdata folder made b
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `suspicious_image_creation_in_appdata_folder_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **suspicious_image_creation_in_appdata_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -79,9 +129,6 @@ unknown
* [Remcos](/stories/remcos)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -91,8 +138,6 @@ unknown
| 49.0 | 70 | 70 | process $process_name$ creating image file $file_path$ in $dest$ |
-
-
#### Reference
* [https://success.trendmicro.com/solution/1123281-remcos-malware-information](https://success.trendmicro.com/solution/1123281-remcos-malware-information)
@@ -101,7 +146,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-21-suspicious_wav_file_in_appdata_folder.md b/docs/_posts/2021-09-21-suspicious_wav_file_in_appdata_folder.md
index d3fca2e240..18f133b3ce 100644
--- a/docs/_posts/2021-09-21-suspicious_wav_file_in_appdata_folder.md
+++ b/docs/_posts/2021-09-21-suspicious_wav_file_in_appdata_folder.md
@@ -24,21 +24,71 @@ tags:
This analytic is to detect a suspicious creation of .wav file in appdata folder. This behavior was seen in Remcos RAT malware where it put the audio recording in the appdata\audio folde as part of data collection. this recording can be send to its C2 server as part of its exfiltration to the compromised machine. creation of wav files in this folder path is not a ussual disk place used by user to save audio format file.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-09-21
- **Author**: Teoderick Contreras, Splunk
- **ID**: 5be109e6-1ac5-11ec-b421-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1113](https://attack.mitre.org/techniques/T1113/) | Screen Capture | Collection |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -56,7 +106,7 @@ This analytic is to detect a suspicious creation of .wav file in appdata folder.
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `suspicious_wav_file_in_appdata_folder_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **suspicious_wav_file_in_appdata_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -79,9 +129,6 @@ unknown
* [Remcos](/stories/remcos)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -91,8 +138,6 @@ unknown
| 49.0 | 70 | 70 | process $process_name$ creating image file $file_path$ in $dest$ |
-
-
#### Reference
* [https://success.trendmicro.com/solution/1123281-remcos-malware-information](https://success.trendmicro.com/solution/1123281-remcos-malware-information)
@@ -101,7 +146,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-27-change_default_file_association.md b/docs/_posts/2021-09-27-change_default_file_association.md
index 48505010ea..4d935feed9 100644
--- a/docs/_posts/2021-09-27-change_default_file_association.md
+++ b/docs/_posts/2021-09-27-change_default_file_association.md
@@ -29,16 +29,21 @@ tags:
This analytic is developed to detect suspicious registry modification to change the default file association of windows to malicious payload. This techninique was seen in some APT where it modify the default process to run file association, like .txt to notepad.exe. Instead notepad.exe it will point to a Script or other payload that will load malicious command to the compromised host.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-09-27
- **Author**: Teoderick Contreras, Splunk
- **ID**: 462d17d8-1f71-11ec-ad07-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,51 @@ This analytic is developed to detect suspicious registry modification to change
| [T1546](https://attack.mitre.org/techniques/T1546/) | Event Triggered Execution | Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -59,10 +109,10 @@ This analytic is developed to detect suspicious registry modification to change
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `change_default_file_association_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **change_default_file_association_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -85,9 +135,6 @@ unknown
* [Windows Registry Abuse](/stories/windows_registry_abuse)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -97,8 +144,6 @@ unknown
| 80.0 | 80 | 100 | modified/added/deleted registry entry $Registry.registry_path$ in $dest$ |
-
-
#### Reference
* [https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/privilege-escalation/untitled-3/accessibility-features](https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/privilege-escalation/untitled-3/accessibility-features)
@@ -106,7 +151,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-27-logon_script_event_trigger_execution.md b/docs/_posts/2021-09-27-logon_script_event_trigger_execution.md
index a09415322d..531281d931 100644
--- a/docs/_posts/2021-09-27-logon_script_event_trigger_execution.md
+++ b/docs/_posts/2021-09-27-logon_script_event_trigger_execution.md
@@ -29,16 +29,21 @@ tags:
This search is to detect a suspicious modification of registry entry to persist and gain privilege escalation upon booting up of compromised host. This technique was seen in several APT and malware where it modify UserInitMprLogonScript registry entry to its malicious payload to be executed upon boot up of the machine.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-09-27
- **Author**: Teoderick Contreras, Splunk
- **ID**: 4c38c264-1f74-11ec-b5fa-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,51 @@ This search is to detect a suspicious modification of registry entry to persist
| [T1037.001](https://attack.mitre.org/techniques/T1037/001/) | Logon Script (Windows) | Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -59,10 +109,10 @@ This search is to detect a suspicious modification of registry entry to persist
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `logon_script_event_trigger_execution_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **logon_script_event_trigger_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +134,6 @@ unknown
* [Windows Privilege Escalation](/stories/windows_privilege_escalation)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -96,8 +143,6 @@ unknown
| 80.0 | 80 | 100 | modified/added/deleted registry entry $Registry.registry_path$ in $dest$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1037/001](https://attack.mitre.org/techniques/T1037/001)
@@ -105,7 +150,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-27-screensaver_event_trigger_execution.md b/docs/_posts/2021-09-27-screensaver_event_trigger_execution.md
index d5942f0aba..a7608a770c 100644
--- a/docs/_posts/2021-09-27-screensaver_event_trigger_execution.md
+++ b/docs/_posts/2021-09-27-screensaver_event_trigger_execution.md
@@ -29,16 +29,21 @@ tags:
This analytic is developed to detect possible event trigger execution through screensaver registry entry modification for persistence or privilege escalation. This technique was seen in several APT and malware where they put the malicious payload path to the SCRNSAVE.EXE registry key to redirect the execution to their malicious payload path. This TTP is a good indicator that some attacker may modify this entry for their persistence and privilege escalation.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-09-27
- **Author**: Teoderick Contreras, Splunk
- **ID**: 58cea3ec-1f6d-11ec-8560-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,51 @@ This analytic is developed to detect possible event trigger execution through sc
| [T1546.002](https://attack.mitre.org/techniques/T1546/002/) | Screensaver | Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -59,10 +109,10 @@ This analytic is developed to detect possible event trigger execution through sc
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `screensaver_event_trigger_execution_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **screensaver_event_trigger_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -85,9 +135,6 @@ unknown
* [Windows Registry Abuse](/stories/windows_registry_abuse)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -97,8 +144,6 @@ unknown
| 72.0 | 80 | 90 | modified/added/deleted registry entry $Registry.registry_path$ in $dest$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1546/002/](https://attack.mitre.org/techniques/T1546/002/)
@@ -107,7 +152,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-28-print_processor_registry_autostart.md b/docs/_posts/2021-09-28-print_processor_registry_autostart.md
index fca646fc11..038eaba732 100644
--- a/docs/_posts/2021-09-28-print_processor_registry_autostart.md
+++ b/docs/_posts/2021-09-28-print_processor_registry_autostart.md
@@ -31,16 +31,21 @@ We have not been able to test, simulate, or build datasets for this object. Use
This analytic is to detect a suspicious modification or new registry entry regarding print processor. This registry is known to be abuse by turla or other APT to gain persistence and privilege escalation to the compromised machine. This is done by adding the malicious dll payload on the new created key in this registry that will be executed as it restarted the spoolsv.exe process and services.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-09-28
- **Author**: Teoderick Contreras, Splunk
- **ID**: 1f5b68aa-2037-11ec-898e-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -48,6 +53,51 @@ This analytic is to detect a suspicious modification or new registry entry regar
| [T1547](https://attack.mitre.org/techniques/T1547/) | Boot or Logon Autostart Execution | Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -61,10 +111,10 @@ This analytic is to detect a suspicious modification or new registry entry regar
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `print_processor_registry_autostart_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **print_processor_registry_autostart_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -86,9 +136,6 @@ possible new printer installation may add driver component on this registry.
* [Windows Privilege Escalation](/stories/windows_privilege_escalation)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -98,8 +145,6 @@ possible new printer installation may add driver component on this registry.
| 80.0 | 80 | 100 | modified/added/deleted registry entry $Registry.registry_path$ in $dest$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1547/012/](https://attack.mitre.org/techniques/T1547/012/)
@@ -108,7 +153,7 @@ possible new printer installation may add driver component on this registry.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-09-29-verclsid_clsid_execution.md b/docs/_posts/2021-09-29-verclsid_clsid_execution.md
index b0eb14f513..23f7c281a4 100644
--- a/docs/_posts/2021-09-29-verclsid_clsid_execution.md
+++ b/docs/_posts/2021-09-29-verclsid_clsid_execution.md
@@ -27,16 +27,21 @@ tags:
This analytic is to detect a possible abuse of verclsid to execute malicious file through generate CLSID. This process is a normal application of windows to verify the CLSID COM object before it is instantiated by Windows Explorer. This hunting query can be a good pivot point to analyze what is he CLSID or COM object pointing too to check if it is a valid application or not.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-09-29
- **Author**: Teoderick Contreras, Splunk
- **ID**: 61e9a56a-20fa-11ec-8ba3-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This analytic is to detect a possible abuse of verclsid to execute malicious fil
| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,11 +107,11 @@ This analytic is to detect a possible abuse of verclsid to execute malicious fil
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_verclsid](https://github.com/splunk/security_content/blob/develop/macros/process_verclsid.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `verclsid_clsid_execution_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **verclsid_clsid_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -88,9 +138,6 @@ windows can used this application for its normal COM object validation.
* [Unusual Processes](/stories/unusual_processes)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -100,8 +147,6 @@ windows can used this application for its normal COM object validation.
| 25.0 | 50 | 50 | process $process_name$ to execute possible clsid commandline $process$ in $dest$ |
-
-
#### Reference
* [https://gist.github.com/NickTyrer/0598b60112eaafe6d07789f7964290d5](https://gist.github.com/NickTyrer/0598b60112eaafe6d07789f7964290d5)
@@ -110,7 +155,7 @@ windows can used this application for its normal COM object validation.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-10-01-vbscript_execution_using_wscript_app.md b/docs/_posts/2021-10-01-vbscript_execution_using_wscript_app.md
index 2e26b51d1b..7c3c0c36bf 100644
--- a/docs/_posts/2021-10-01-vbscript_execution_using_wscript_app.md
+++ b/docs/_posts/2021-10-01-vbscript_execution_using_wscript_app.md
@@ -27,16 +27,21 @@ tags:
This analytic is to detect a suspicious wscript commandline to execute vbscript. This technique was seen in several malware to execute malicious vbs file using wscript application. commonly vbs script is associated to cscript process and this can be a technique to evade process parent child detections or even some av script emulation system.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-10-01
- **Author**: Teoderick Contreras, Splunk
- **ID**: 35159940-228f-11ec-8a49-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This analytic is to detect a suspicious wscript commandline to execute vbscript.
| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +107,10 @@ This analytic is to detect a suspicious wscript commandline to execute vbscript.
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `vbscript_execution_using_wscript_app_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **vbscript_execution_using_wscript_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -88,9 +138,6 @@ unknown
* [Remcos](/stories/remcos)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -100,8 +147,6 @@ unknown
| 49.0 | 70 | 70 | Process name $process_name$ with commandline $process$ to execute vbsscript |
-
-
#### Reference
* [https://www.joesandbox.com/analysis/369332/0/html](https://www.joesandbox.com/analysis/369332/0/html)
@@ -109,7 +154,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md b/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md
index e13326204c..80ad4f52c8 100644
--- a/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md
+++ b/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md
@@ -27,16 +27,21 @@ tags:
This analytic is to detect a suspicious child process of MSBuild spawned by Windows Script Host - cscript or wscript. This behavior or event are commonly seen and used by malware or adversaries to execute malicious msbuild process using malicious script in the compromised host. During triage, review parallel processes and identify any file modifications. MSBuild may load a script from the same path without having command-line arguments.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-10-04
- **Author**: Teoderick Contreras, Splunk
- **ID**: 213b3148-24ea-11ec-93a2-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This analytic is to detect a suspicious child process of MSBuild spawned by Wind
| [T1127](https://attack.mitre.org/techniques/T1127/) | Trusted Developer Utilities Proxy Execution | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,11 +107,11 @@ This analytic is to detect a suspicious child process of MSBuild spawned by Wind
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `msbuild_suspicious_spawned_by_script_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **msbuild_suspicious_spawned_by_script_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -83,9 +133,6 @@ False positives should be limited as developers do not spawn MSBuild via a WSH.
* [Trusted Developer Utilities Proxy Execution MSBuild](/stories/trusted_developer_utilities_proxy_execution_msbuild)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -95,8 +142,6 @@ False positives should be limited as developers do not spawn MSBuild via a WSH.
| 49.0 | 70 | 70 | Msbuild.exe process spawned by $parent_process_name$ on $dest$ executed by $user$ |
-
-
#### Reference
* [https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/#](https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/#)
@@ -104,7 +149,7 @@ False positives should be limited as developers do not spawn MSBuild via a WSH.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md b/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md
index a2f2286514..0b848f73e6 100644
--- a/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md
+++ b/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md
@@ -27,16 +27,21 @@ tags:
This analytic is to detect a loading of dll using regsvr32 application with silent parameter and dllinstall execution. This technique was seen in several RAT malware similar to remcos, njrat and adversaries to load their malicious DLL on the compromised machine. This TTP may executed by normal 3rd party application so it is better to pivot by the parent process, parent command-line and command-line of the file that execute this regsvr32.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-10-04
- **Author**: Teoderick Contreras, Splunk
- **ID**: f421c250-24e7-11ec-bc43-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This analytic is to detect a loading of dll using regsvr32 application with sile
| [T1218.010](https://attack.mitre.org/techniques/T1218/010/) | Regsvr32 | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -59,11 +109,11 @@ This analytic is to detect a loading of dll using regsvr32 application with sile
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `regsvr32_silent_and_install_param_dll_loading_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **regsvr32_silent_and_install_param_dll_loading_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -94,9 +144,6 @@ Other third part application may used this parameter but not so common in base w
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -106,8 +153,6 @@ Other third part application may used this parameter but not so common in base w
| 36.0 | 60 | 60 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to load a DLL using the silent and dllinstall parameter. |
-
-
#### Reference
* [https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/#](https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/#)
@@ -116,7 +161,7 @@ Other third part application may used this parameter but not so common in base w
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-10-05-detect_exchange_web_shell.md b/docs/_posts/2021-10-05-detect_exchange_web_shell.md
index b1f7ad1ef1..a0bb42b16f 100644
--- a/docs/_posts/2021-10-05-detect_exchange_web_shell.md
+++ b/docs/_posts/2021-10-05-detect_exchange_web_shell.md
@@ -30,16 +30,21 @@ tags:
The following query identifies suspicious .aspx created in 3 paths identified by Microsoft as known drop locations for Exchange exploitation related to HAFNIUM group and recently disclosed vulnerablity named ProxyShell. Paths include: `\HttpProxy\owa\auth\`, `\inetpub\wwwroot\aspnet_client\`, and `\HttpProxy\OAB\`. Upon triage, the suspicious .aspx file will likely look obvious on the surface. inspect the contents for script code inside. Identify additional log sources, IIS included, to review source and other potential exploitation. It is often the case that a particular threat is only applicable to a specific subset of systems in your environment. Typically analytics to detect those threats are written without the benefit of being able to only target those systems as well. Writing analytics against all systems when those behaviors are limited to identifiable subsets of those systems is suboptimal. Consider the case ProxyShell vulnerability on Microsoft Exchange Servers. With asset information, a hunter can limit their analytics to systems that have been identified as Exchange servers. A hunter may start with the theory that the exchange server is communicating with new systems that it has not previously. If this theory is run against all publicly facing systems, the amount of noise it will generate will likely render this theory untenable. However, using the asset information to limit this analytic to just the Exchange servers will reduce the noise allowing the hunter to focus only on the systems where this behavioral change is relevant.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-10-05
- **Author**: Michael Haag, Shannon Davis, David Dorsey, Splunk
- **ID**: 8c14eeee-2af1-4a4b-bda8-228da0f4862a
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -49,6 +54,51 @@ The following query identifies suspicious .aspx created in 3 paths identified by
| [T1190](https://attack.mitre.org/techniques/T1190/) | Exploit Public-Facing Application | Initial Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -68,7 +118,7 @@ The following query identifies suspicious .aspx created in 3 paths identified by
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `detect_exchange_web_shell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_exchange_web_shell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -90,9 +140,6 @@ The query is structured in a way that `action` (read, create) is not defined. Re
* [ProxyShell](/stories/proxyshell)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -102,8 +149,6 @@ The query is structured in a way that `action` (read, create) is not defined. Re
| 81.0 | 90 | 90 | A file - $file_name$ was written to disk that is related to IIS exploitation previously performed by HAFNIUM. Review further file modifications on endpoint $dest$ by user $user$. |
-
-
#### Reference
* [https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/MSTICIoCs-ExchangeServerVulnerabilitiesDisclosedMarch2021.csv](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/MSTICIoCs-ExchangeServerVulnerabilitiesDisclosedMarch2021.csv)
@@ -114,7 +159,7 @@ The query is structured in a way that `action` (read, create) is not defined. Re
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-10-05-malicious_inprocserver32_modification.md b/docs/_posts/2021-10-05-malicious_inprocserver32_modification.md
index d66f2e7caa..5d213c80d5 100644
--- a/docs/_posts/2021-10-05-malicious_inprocserver32_modification.md
+++ b/docs/_posts/2021-10-05-malicious_inprocserver32_modification.md
@@ -27,16 +27,21 @@ tags:
The following analytic identifies a process modifying the registry with a known malicious CLSID under InProcServer32. Most COM classes are registered with the operating system and are identified by a GUID that represents the Class Identifier (CLSID) within the registry (usually under HKLM\\Software\\Classes\\CLSID or HKCU\\Software\\Classes\\CLSID). Behind the implementation of a COM class is the server (some binary) that is referenced within registry keys under the CLSID. The LocalServer32 key represents a path to an executable (exe) implementation, and the InprocServer32 key represents a path to a dynamic link library (DLL) implementation (Bohops). During triage, review parallel processes for suspicious activity. Pivot on the process GUID to see the full timeline of events. Analyze the value and look for file modifications. Being this is looking for inprocserver32, a DLL found in the value will most likely be loaded by a parallel process.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-10-05
- **Author**: Michael Haag, Splunk
- **ID**: 127c8d08-25ff-11ec-9223-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ The following analytic identifies a process modifying the registry with a known
| [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -62,10 +112,10 @@ The following analytic identifies a process modifying the registry with a known
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `malicious_inprocserver32_modification_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **malicious_inprocserver32_modification_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -88,9 +138,6 @@ False positives should be limited, filter as needed. In our test case, Remcos us
* [Remcos](/stories/remcos)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -100,8 +147,6 @@ False positives should be limited, filter as needed. In our test case, Remcos us
| 80.0 | 80 | 100 | The $process_name$ was identified on endpoint $dest$ modifying the registry with a known malicious clsid under InProcServer32. |
-
-
#### Reference
* [https://bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/](https://bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/)
@@ -111,7 +156,7 @@ False positives should be limited, filter as needed. In our test case, Remcos us
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-10-05-process_writing_dynamicwrapperx.md b/docs/_posts/2021-10-05-process_writing_dynamicwrapperx.md
index ef4e8f1ee3..a466d1f6bb 100644
--- a/docs/_posts/2021-10-05-process_writing_dynamicwrapperx.md
+++ b/docs/_posts/2021-10-05-process_writing_dynamicwrapperx.md
@@ -27,16 +27,21 @@ tags:
DynamicWrapperX is an ActiveX component that can be used in a script to call Windows API functions, but it requires the dynwrapx.dll to be installed and registered. With that, a binary writing dynwrapx.dll to disk and registering it into the registry is highly suspect. Why is it needed? In most malicious instances, it will be written to disk at a non-standard location. During triage, review parallel processes and pivot on the process_guid. Review the registry for any suspicious modifications meant to load dynwrapx.dll. Identify any suspicious module loads of dynwrapx.dll. This will identify the process that will invoke vbs/wscript/cscript.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-10-05
- **Author**: Michael Haag, Splunk
- **ID**: b0a078e4-2601-11ec-9aec-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ DynamicWrapperX is an ActiveX component that can be used in a script to call Win
| [T1559.001](https://attack.mitre.org/techniques/T1559/001/) | Component Object Model | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -62,10 +112,10 @@ DynamicWrapperX is an ActiveX component that can be used in a script to call Win
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `process_writing_dynamicwrapperx_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **process_writing_dynamicwrapperx_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -87,9 +137,6 @@ False positives should be limited, however it is possible to filter by Processes
* [Remcos](/stories/remcos)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -99,8 +146,6 @@ False positives should be limited, however it is possible to filter by Processes
| 80.0 | 80 | 100 | An instance of $process_name$ was identified on endpoint $dest$ downloading the DynamicWrapperX dll. |
-
-
#### Reference
* [https://blog.f-secure.com/hunting-for-koadic-a-com-based-rootkit/](https://blog.f-secure.com/hunting-for-koadic-a-com-based-rootkit/)
@@ -112,7 +157,7 @@ False positives should be limited, however it is possible to filter by Processes
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-10-05-rundll32_shimcache_flush.md b/docs/_posts/2021-10-05-rundll32_shimcache_flush.md
index e449b46247..0a449794a3 100644
--- a/docs/_posts/2021-10-05-rundll32_shimcache_flush.md
+++ b/docs/_posts/2021-10-05-rundll32_shimcache_flush.md
@@ -24,21 +24,71 @@ tags:
This analytic is to detect a suspicious rundll32 commandline to clear shim cache. This technique is a anti-forensic technique to clear the cache taht are one important artifacts in terms of digital forensic during attacks or incident. This TTP is a good indicator that someone tries to evade some tools and clear foothold on the machine.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-10-05
- **Author**: Teoderick Contreras, Splunk
- **ID**: a913718a-25b6-11ec-96d3-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,11 +102,11 @@ This analytic is to detect a suspicious rundll32 commandline to clear shim cache
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `rundll32_shimcache_flush_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **rundll32_shimcache_flush_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +134,6 @@ unknown
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -96,8 +143,6 @@ unknown
| 80.0 | 80 | 100 | rundll32 process execute $process$ to clear shim cache in $dest$ |
-
-
#### Reference
* [https://blueteamops.medium.com/shimcache-flush-89daff28d15e](https://blueteamops.medium.com/shimcache-flush-89daff28d15e)
@@ -105,7 +150,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-10-05-suspicious_copy_on_system32.md b/docs/_posts/2021-10-05-suspicious_copy_on_system32.md
index 1feb84d2a8..d29ff00567 100644
--- a/docs/_posts/2021-10-05-suspicious_copy_on_system32.md
+++ b/docs/_posts/2021-10-05-suspicious_copy_on_system32.md
@@ -27,16 +27,21 @@ tags:
This analytic is to detect a suspicious copy of file from systemroot folder of the windows OS. This technique is commonly used by APT or other malware as part of execution (LOLBIN) to run its malicious code using the available legitimate tool in OS. this type of event may seen or may execute of normal user in some instance but this is really a anomaly that needs to be check within the network.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-10-05
- **Author**: Teoderick Contreras, Splunk
- **ID**: ce633e56-25b2-11ec-9e76-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This analytic is to detect a suspicious copy of file from systemroot folder of t
| [T1036](https://attack.mitre.org/techniques/T1036/) | Masquerading | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,11 +107,11 @@ This analytic is to detect a suspicious copy of file from systemroot folder of t
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_copy](https://github.com/splunk/security_content/blob/develop/macros/process_copy.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `suspicious_copy_on_system32_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **suspicious_copy_on_system32_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -88,9 +138,6 @@ every user may do this event but very un-ussual.
* [Unusual Processes](/stories/unusual_processes)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -100,8 +147,6 @@ every user may do this event but very un-ussual.
| 63.0 | 70 | 90 | execution of copy exe to copy file from $process$ in $dest$ |
-
-
#### Reference
* [https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120](https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120)
@@ -109,7 +154,7 @@ every user may do this event but very un-ussual.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-10-05-winhlp32_spawning_a_process.md b/docs/_posts/2021-10-05-winhlp32_spawning_a_process.md
index 7b44650cf8..ba25a484ff 100644
--- a/docs/_posts/2021-10-05-winhlp32_spawning_a_process.md
+++ b/docs/_posts/2021-10-05-winhlp32_spawning_a_process.md
@@ -25,21 +25,71 @@ tags:
The following analytic identifies winhlp32.exe, found natively in `c:\windows\`, spawning a child process that loads a file out of appdata, programdata, or temp. Winhlp32.exe has a rocky past in that multiple vulnerabilities were found and added to MetaSploit. WinHlp32.exe is required to display 32-bit Help files that have the ".hlp" file name extension. This particular instance is related to a Remcos sample where dynwrapx.dll is added to the registry under inprocserver32, and later module loaded by winhlp32.exe to spawn wscript.exe and load a vbs or file from disk. During triage, review parallel processes to identify further suspicious behavior. Review module loads for unsuspecting unsigned modules. Capture any file modifications and analyze.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-10-05
- **Author**: Michael Haag, Splunk
- **ID**: d17dae9e-2618-11ec-b9f5-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -53,10 +103,10 @@ The following analytic identifies winhlp32.exe, found natively in `c:\windows\`,
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `winhlp32_spawning_a_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **winhlp32_spawning_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -83,9 +133,6 @@ False positives should be limited as winhlp32.exe is typically not used with the
* [Remcos](/stories/remcos)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -95,8 +142,6 @@ False positives should be limited as winhlp32.exe is typically not used with the
| 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$, and is not typical activity for this process. |
-
-
#### Reference
* [https://www.exploit-db.com/exploits/16541](https://www.exploit-db.com/exploits/16541)
@@ -106,7 +151,7 @@ False positives should be limited as winhlp32.exe is typically not used with the
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-10-06-dns_query_length_with_high_standard_deviation.md b/docs/_posts/2021-10-06-dns_query_length_with_high_standard_deviation.md
index cbb1421c47..2c694027ef 100644
--- a/docs/_posts/2021-10-06-dns_query_length_with_high_standard_deviation.md
+++ b/docs/_posts/2021-10-06-dns_query_length_with_high_standard_deviation.md
@@ -27,16 +27,21 @@ tags:
This search allows you to identify DNS requests and compute the standard deviation on the length of the names being resolved, then filter on two times the standard deviation to show you those queries that are unusually large for your environment.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Network_Resolution](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkResolution)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Network_Resolution](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkResolution)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-10-06
- **Author**: Bhavin Patel, Splunk
- **ID**: 1a67f15a-f4ff-4170-84e9-08cf6f75d6f5
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,58 @@ This search allows you to identify DNS requests and compute the standard deviati
| [T1048](https://attack.mitre.org/techniques/T1048/) | Exfiltration Over Alternative Protocol | Exfiltration |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Command & Control
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.AE
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+* CIS 12
+
+
+
+
+
+
+
#### Search
```
@@ -66,7 +123,7 @@ This search allows you to identify DNS requests and compute the standard deviati
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `dns_query_length_with_high_standard_deviation_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **dns_query_length_with_high_standard_deviation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -85,9 +142,6 @@ It's possible there can be long domain names that are legitimate.
* [Command and Control](/stories/command_and_control)
-#### Kill Chain Phase
-* Command & Control
-
#### RBA
@@ -97,13 +151,11 @@ It's possible there can be long domain names that are legitimate.
| 56.0 | 70 | 80 | A dns query $query$ with 2 time standard deviation of name len of the dns query in host $host$ |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-10-06-sdelete_application_execution.md b/docs/_posts/2021-10-06-sdelete_application_execution.md
index 90f91b4108..85c2e6cbb9 100644
--- a/docs/_posts/2021-10-06-sdelete_application_execution.md
+++ b/docs/_posts/2021-10-06-sdelete_application_execution.md
@@ -30,16 +30,21 @@ tags:
This analytic is to detect the execution of sdelete.exe application sysinternal tools. This tool is one of the most use tool of malware and adversaries to remove or clear their tracks and artifact in the targetted host. This tool is designed to delete securely a file in file system that remove the forensic evidence on the machine. A good TTP query to check why user execute this application which is not a common practice.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-10-06
- **Author**: Teoderick Contreras, Splunk
- **ID**: 31702fc0-2682-11ec-85c3-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -49,6 +54,51 @@ This analytic is to detect the execution of sdelete.exe application sysinternal
| [T1070](https://attack.mitre.org/techniques/T1070/) | Indicator Removal on Host | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -62,11 +112,11 @@ This analytic is to detect the execution of sdelete.exe application sysinternal
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_sdelete](https://github.com/splunk/security_content/blob/develop/macros/process_sdelete.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `sdelete_application_execution_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **sdelete_application_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -93,9 +143,6 @@ user may execute and use this application
* [Masquerading - Rename System Utilities](/stories/masquerading_-_rename_system_utilities)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -105,8 +152,6 @@ user may execute and use this application
| 49.0 | 70 | 70 | sdelete process $process_name$ executed in $dest$ |
-
-
#### Reference
* [https://app.any.run/tasks/956f50be-2c13-465a-ac00-6224c14c5f89/](https://app.any.run/tasks/956f50be-2c13-465a-ac00-6224c14c5f89/)
@@ -114,7 +159,7 @@ user may execute and use this application
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-10-06-wscript_or_cscript_suspicious_child_process.md b/docs/_posts/2021-10-06-wscript_or_cscript_suspicious_child_process.md
index 4ee26e1dcd..ba70937134 100644
--- a/docs/_posts/2021-10-06-wscript_or_cscript_suspicious_child_process.md
+++ b/docs/_posts/2021-10-06-wscript_or_cscript_suspicious_child_process.md
@@ -37,16 +37,21 @@ tags:
This analytic identifies a suspicious spawned process by WScript or CScript process. This technique was a common technique used by adversaries and malware to execute different LOLBIN, other scripts like PowerShell or spawn a suspended process to inject its code as a defense evasion. This TTP may detect some normal script that using several application tool that are in the list of the child process it detects but a good pivot and indicator that a script is may execute suspicious code.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-10-06
- **Author**: Teoderick Contreras, Splunk
- **ID**: 1f35e1da-267b-11ec-90a9-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -58,6 +63,51 @@ This analytic identifies a suspicious spawned process by WScript or CScript proc
| [T1134](https://attack.mitre.org/techniques/T1134/) | Access Token Manipulation | Defense Evasion, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -71,10 +121,10 @@ This analytic identifies a suspicious spawned process by WScript or CScript proc
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `wscript_or_cscript_suspicious_child_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **wscript_or_cscript_suspicious_child_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -104,9 +154,6 @@ Administrators may create vbs or js script that use several tool as part of its
* [WhisperGate](/stories/whispergate)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -116,8 +163,6 @@ Administrators may create vbs or js script that use several tool as part of its
| 49.0 | 70 | 70 | wscript or cscript parent process spawned $process_name$ in $dest$ |
-
-
#### Reference
* [https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120](https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120)
@@ -126,7 +171,7 @@ Administrators may create vbs or js script that use several tool as part of its
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-10-11-suspicious_wevtutil_usage.md b/docs/_posts/2021-10-11-suspicious_wevtutil_usage.md
index 759014c7e0..caf2f1a03f 100644
--- a/docs/_posts/2021-10-11-suspicious_wevtutil_usage.md
+++ b/docs/_posts/2021-10-11-suspicious_wevtutil_usage.md
@@ -27,16 +27,21 @@ tags:
The wevtutil.exe application is the windows event log utility. This searches for wevtutil.exe with parameters for clearing the application, security, setup, trace or system event logs.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-10-11
- **Author**: David Dorsey, Michael Haag, Splunk
- **ID**: 2827c0fd-e1be-4868-ae25-59d28e0f9d4f
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,62 @@ The wevtutil.exe application is the windows event log utility. This searches for
| [T1070](https://attack.mitre.org/techniques/T1070/) | Indicator Removal on Host | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.DP
+* PR.IP
+* PR.PT
+* PR.AC
+* PR.AT
+* DE.AE
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 6
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +118,10 @@ The wevtutil.exe application is the windows event log utility. This searches for
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `suspicious_wevtutil_usage_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **suspicious_wevtutil_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -83,9 +144,6 @@ The wevtutil.exe application is a legitimate Windows event log utility. Administ
* [Clop Ransomware](/stories/clop_ransomware)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -95,8 +153,6 @@ The wevtutil.exe application is a legitimate Windows event log utility. Administ
| 28.0 | 40 | 70 | Wevtutil.exe being used to clear Event Logs on $dest$ by $user$ |
-
-
#### Reference
* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.001/T1070.001.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.001/T1070.001.md)
@@ -104,7 +160,7 @@ The wevtutil.exe application is a legitimate Windows event log utility. Administ
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_powershell.md b/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_powershell.md
index 6d2c42ab42..cb3dcd3623 100644
--- a/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_powershell.md
+++ b/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_powershell.md
@@ -27,21 +27,71 @@ A service principal name (SPN) is a unique identifier of a service instance. SPN
The following analytic identifies the use of KerberosRequestorSecurityToken class within the script block. Using .NET System.IdentityModel.Tokens.KerberosRequestorSecurityToken class in PowerShell is the equivelant of using setspn.exe. \
During triage, review parallel processes for further suspicious activity.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-10-14
- **Author**: Michael Haag, Splunk
- **ID**: 13243068-2d38-11ec-8908-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1558.003](https://attack.mitre.org/techniques/T1558/003/) | Kerberoasting | Credential Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -54,10 +104,10 @@ During triage, review parallel processes for further suspicious activity.
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `serviceprincipalnames_discovery_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **serviceprincipalnames_discovery_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -85,9 +135,6 @@ False positives should be limited, however filter as needed.
* [Active Directory Kerberos Attacks](/stories/active_directory_kerberos_attacks)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -97,8 +144,6 @@ False positives should be limited, however filter as needed.
| 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to identify service principle names. |
-
-
#### Reference
* [https://docs.microsoft.com/en-us/windows/win32/ad/service-principal-names](https://docs.microsoft.com/en-us/windows/win32/ad/service-principal-names)
@@ -119,7 +164,7 @@ False positives should be limited, however filter as needed.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md b/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md
index 027ea244a6..35960549ea 100644
--- a/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md
+++ b/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md
@@ -31,21 +31,71 @@ Values \
1. -F = perform queries at the forest, rather than domain level 1. -T = perform query on the specified domain or forest (when -F is also used) 1. -Q = query for existence of SPN \
During triage, review parallel processes for further suspicious activity.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-10-14
- **Author**: Michael Haag, Splunk
- **ID**: ae8b3efc-2d2e-11ec-8b57-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1558.003](https://attack.mitre.org/techniques/T1558/003/) | Kerberoasting | Credential Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -60,10 +110,10 @@ During triage, review parallel processes for further suspicious activity.
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [process_setspn](https://github.com/splunk/security_content/blob/develop/macros/process_setspn.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [process_setspn](https://github.com/splunk/security_content/blob/develop/macros/process_setspn.yml)
-Note that `serviceprincipalnames_discovery_with_setspn_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **serviceprincipalnames_discovery_with_setspn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -91,9 +141,6 @@ False positives may be caused by Administrators resetting SPNs or querying for S
* [Active Directory Kerberos Attacks](/stories/active_directory_kerberos_attacks)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -103,8 +150,6 @@ False positives may be caused by Administrators resetting SPNs or querying for S
| 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to identify service principle names. |
-
-
#### Reference
* [https://docs.microsoft.com/en-us/windows/win32/ad/service-principal-names](https://docs.microsoft.com/en-us/windows/win32/ad/service-principal-names)
@@ -120,7 +165,7 @@ False positives may be caused by Administrators resetting SPNs or querying for S
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-10-18-disable_schedule_task.md b/docs/_posts/2021-10-18-disable_schedule_task.md
index 8e24e1c464..2943b0a04b 100644
--- a/docs/_posts/2021-10-18-disable_schedule_task.md
+++ b/docs/_posts/2021-10-18-disable_schedule_task.md
@@ -27,16 +27,21 @@ tags:
This analytic is to detect a suspicious commandline to disable existing schedule task. This technique is used by adversaries or commodity malware like IceID to disable security application (AV products) in the targetted host to evade detections. This TTP is a good pivot to check further why and what other process run before and after this detection. check which process execute the commandline and what task is disabled. parent child process is quite valuable in this scenario too.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-10-18
- **Author**: Teoderick Contreras, Splunk
- **ID**: db596056-3019-11ec-a9ff-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This analytic is to detect a suspicious commandline to disable existing schedule
| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +107,10 @@ This analytic is to detect a suspicious commandline to disable existing schedule
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `disable_schedule_task_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **disable_schedule_task_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -81,9 +131,6 @@ admin may disable problematic schedule task
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -93,8 +140,6 @@ admin may disable problematic schedule task
| 56.0 | 70 | 80 | schtask process with commandline $process$ to disable schedule task in $dest$ |
-
-
#### Reference
* [https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/](https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/)
@@ -102,7 +147,7 @@ admin may disable problematic schedule task
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md b/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md
index 65e1be8764..54892ffba6 100644
--- a/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md
+++ b/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md
@@ -26,21 +26,71 @@ The following analytic identifies the use of Windows Curl.exe downloading a file
-O or --output is used when a file is to be downloaded and placed in a specified location. \
During triage, review parallel processes for further behavior. In addition, identify if the download was successful. If a file was downloaded, capture and analyze.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-10-19
- **Author**: Michael Haag, Splunk
- **ID**: c32f091e-30db-11ec-8738-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1105](https://attack.mitre.org/techniques/T1105/) | Ingress Tool Transfer | Command And Control |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -54,11 +104,11 @@ During triage, review parallel processes for further behavior. In addition, iden
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_curl](https://github.com/splunk/security_content/blob/develop/macros/process_curl.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `windows_curl_download_to_suspicious_path_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **windows_curl_download_to_suspicious_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -86,9 +136,6 @@ It is possible Administrators or super users will use Curl for legitimate purpos
* [Ingress Tool Transfer](/stories/ingress_tool_transfer)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -98,8 +145,6 @@ It is possible Administrators or super users will use Curl for legitimate purpos
| 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ to download a file to a suspicious directory. |
-
-
#### Reference
* [https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/](https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/)
@@ -109,7 +154,7 @@ It is possible Administrators or super users will use Curl for legitimate purpos
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-10-19-winevent_windows_task_scheduler_event_action_started.md b/docs/_posts/2021-10-19-winevent_windows_task_scheduler_event_action_started.md
index 4f1dc13b81..5af6decbb8 100644
--- a/docs/_posts/2021-10-19-winevent_windows_task_scheduler_event_action_started.md
+++ b/docs/_posts/2021-10-19-winevent_windows_task_scheduler_event_action_started.md
@@ -26,21 +26,71 @@ tags:
The following hunting analytic assists with identifying suspicious tasks that have been registered and ran in Windows using EventID 200 (action run) and 201 (action completed). It is recommended to filter based on ActionName by specifying specific paths not used in your environment. After some basic tuning, this may be effective in capturing evasive ways to register tasks on Windows. Review parallel events related to tasks being scheduled. EventID 106 will generate when a new task is generated, however, that does not mean it ran. Capture any files on disk and analyze.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-10-19
- **Author**: Michael Haag, Splunk
- **ID**: b3632472-310b-11ec-9aab-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1053.005](https://attack.mitre.org/techniques/T1053/005/) | Scheduled Task | Execution, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -54,10 +104,10 @@ The following hunting analytic assists with identifying suspicious tasks that ha
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [wineventlog_task_scheduler](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_task_scheduler.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `winevent_windows_task_scheduler_event_action_started_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **winevent_windows_task_scheduler_event_action_started_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -79,9 +129,6 @@ False positives will be present. Filter based on ActionName paths or specify key
* [Windows Persistence Techniques](/stories/windows_persistence_techniques)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -91,8 +138,6 @@ False positives will be present. Filter based on ActionName paths or specify key
| 80.0 | 80 | 100 | A Scheduled Task was scheduled and ran on $dest$. |
-
-
#### Reference
* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1053.005/T1053.005.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1053.005/T1053.005.md)
@@ -101,7 +146,7 @@ False positives will be present. Filter based on ActionName paths or specify key
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-10-20-wmic_noninteractive_app_uninstallation.md b/docs/_posts/2021-10-20-wmic_noninteractive_app_uninstallation.md
index e26bb74d62..19d164fe8a 100644
--- a/docs/_posts/2021-10-20-wmic_noninteractive_app_uninstallation.md
+++ b/docs/_posts/2021-10-20-wmic_noninteractive_app_uninstallation.md
@@ -27,16 +27,21 @@ tags:
This analytic is to detect a suspicious wmic commandlined that uninstall application non interactively. This technique was seen in IceID to uninstall av products to the compromised host to bypassed and evade detections. This Hunting query maybe a good indicator that some process tries to uninstall application using wmic which is not a common behavior. This approach may seen in some script or third part appication to uninstall their application but it is a good thing to check what it uninstall and why.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-10-20
- **Author**: Teoderick Contreras, Splunk
- **ID**: bff0e7a0-317f-11ec-ab4e-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This analytic is to detect a suspicious wmic commandlined that uninstall applica
| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +107,10 @@ This analytic is to detect a suspicious wmic commandlined that uninstall applica
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `wmic_noninteractive_app_uninstallation_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **wmic_noninteractive_app_uninstallation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -87,9 +137,6 @@ third party application may use this approach to uninstall there application
* [IceID](/stories/iceid)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -99,8 +146,6 @@ third party application may use this approach to uninstall there application
| 25.0 | 50 | 50 | wmic $process$ with commandline $process$ in $dest$ |
-
-
#### Reference
* [https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/](https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/)
@@ -108,7 +153,7 @@ third party application may use this approach to uninstall there application
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-10-24-gdrive_suspicious_file_sharing.md b/docs/_posts/2021-10-24-gdrive_suspicious_file_sharing.md
index 94f4514948..b866a2bf67 100644
--- a/docs/_posts/2021-10-24-gdrive_suspicious_file_sharing.md
+++ b/docs/_posts/2021-10-24-gdrive_suspicious_file_sharing.md
@@ -25,21 +25,71 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search can help the detection of compromised accounts or internal users sharing potentially malicious/classified documents with users outside your organization via GSuite file sharing .
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-10-24
- **Author**: Rod Soto, Teoderick Contreras
- **ID**: a7131dae-34e3-11ec-a2de-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1566](https://attack.mitre.org/techniques/T1566/) | Phishing | Initial Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -55,7 +105,7 @@ This search can help the detection of compromised accounts or internal users sha
The SPL above uses the following Macros:
* [gsuite_drive](https://github.com/splunk/security_content/blob/develop/macros/gsuite_drive.yml)
-Note that `gdrive_suspicious_file_sharing_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **gdrive_suspicious_file_sharing_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -77,9 +127,6 @@ This is an anomaly search, you must specify your domain in the parameters so it
* [Data Exfiltration](/stories/data_exfiltration)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -89,8 +136,6 @@ This is an anomaly search, you must specify your domain in the parameters so it
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
* [https://www.splunk.com/en_us/blog/security/investigating-gsuite-phishing-attacks-with-splunk.html](https://www.splunk.com/en_us/blog/security/investigating-gsuite-phishing-attacks-with-splunk.html)
@@ -98,7 +143,7 @@ This is an anomaly search, you must specify your domain in the parameters so it
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-10-24-gsuite_suspicious_calendar_invite.md b/docs/_posts/2021-10-24-gsuite_suspicious_calendar_invite.md
index 62a16b9f29..7f9cbaa0e5 100644
--- a/docs/_posts/2021-10-24-gsuite_suspicious_calendar_invite.md
+++ b/docs/_posts/2021-10-24-gsuite_suspicious_calendar_invite.md
@@ -25,21 +25,71 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search can help the detection of compromised accounts or internal users sending suspcious calendar invites via GSuite calendar. These invites may contain malicious links or attachments.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-10-24
- **Author**: Rod Soto, Teoderick Contreras
- **ID**: 03cdd68a-34fb-11ec-9bd3-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1566](https://attack.mitre.org/techniques/T1566/) | Phishing | Initial Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -56,7 +106,7 @@ This search can help the detection of compromised accounts or internal users sen
The SPL above uses the following Macros:
* [gsuite_calendar](https://github.com/splunk/security_content/blob/develop/macros/gsuite_calendar.yml)
-Note that `gsuite_suspicious_calendar_invite_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **gsuite_suspicious_calendar_invite_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -76,9 +126,6 @@ This search will also produce normal activity statistics. Fields such as email,
* [Spearphishing Attachments](/stories/spearphishing_attachments)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -88,8 +135,6 @@ This search will also produce normal activity statistics. Fields such as email,
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
* [https://www.techrepublic.com/article/how-to-avoid-the-dreaded-google-calendar-malicious-invite-issue/](https://www.techrepublic.com/article/how-to-avoid-the-dreaded-google-calendar-malicious-invite-issue/)
@@ -98,7 +143,7 @@ This search will also produce normal activity statistics. Fields such as email,
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-11-03-windows_adfind_exe.md b/docs/_posts/2021-11-03-windows_adfind_exe.md
index 2172d48449..2d33a7e038 100644
--- a/docs/_posts/2021-11-03-windows_adfind_exe.md
+++ b/docs/_posts/2021-11-03-windows_adfind_exe.md
@@ -24,21 +24,76 @@ tags:
This search looks for the execution of `adfind.exe` with command-line arguments that it uses by default. Specifically the filter or search functions. It also considers the arguments necessary like objectcategory, see readme for more details: https://www.joeware.net/freetools/tools/adfind/usage.htm. This has been seen used before by Wizard Spider, FIN6 and actors whom also launched SUNBURST. AdFind.exe is usually used a recon tool to enumare a domain controller.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-11-03
- **Author**: Jose Hernandez, Bhavin Patel, Splunk
- **ID**: bd3b0187-189b-46c0-be45-f52da2bae67f
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +107,10 @@ This search looks for the execution of `adfind.exe` with command-line arguments
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `windows_adfind_exe_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **windows_adfind_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -79,9 +134,6 @@ administrators rarely use adfind, usually not used for legitimate reasons
* [Domain Trust Discovery](/stories/domain_trust_discovery)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -91,8 +143,6 @@ administrators rarely use adfind, usually not used for legitimate reasons
| 25.0 | 50 | 50 | Windows AdFind Exe |
-
-
#### Reference
* [https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/](https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/)
@@ -101,7 +151,7 @@ administrators rarely use adfind, usually not used for legitimate reasons
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-11-04-attacker_tools_on_endpoint.md b/docs/_posts/2021-11-04-attacker_tools_on_endpoint.md
index 94a49b9412..66f2db97da 100644
--- a/docs/_posts/2021-11-04-attacker_tools_on_endpoint.md
+++ b/docs/_posts/2021-11-04-attacker_tools_on_endpoint.md
@@ -33,16 +33,21 @@ tags:
This search looks for execution of commonly used attacker tools on an endpoint.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-11-04
- **Author**: Bhavin Patel, Splunk
- **ID**: a51bfe1a-94f0-48cc-b4e4-16a110145893
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -54,6 +59,58 @@ This search looks for execution of commonly used attacker tools on an endpoint.
| [T1595](https://attack.mitre.org/techniques/T1595/) | Active Scanning | Reconnaissance |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Installation
+* Command & Control
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* ID.AM
+* PR.DS
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 2
+
+
+
+
+
+
+
#### Search
```
@@ -69,10 +126,10 @@ This search looks for execution of commonly used attacker tools on an endpoint.
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `attacker_tools_on_endpoint_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **attacker_tools_on_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Lookups
The SPL above uses the following Lookups:
@@ -99,11 +156,6 @@ Some administrator activity can be potentially triggered, please add those users
* [Unusual Processes](/stories/unusual_processes)
-#### Kill Chain Phase
-* Installation
-* Command & Control
-* Actions on Objectives
-
#### RBA
@@ -113,13 +165,11 @@ Some administrator activity can be potentially triggered, please add those users
| 64.0 | 80 | 80 | An attacker tool $process_name$,listed in attacker_tools.csv is executed on host $dest$ by User $user$. This process $process_name$ is known to do- $description$ |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md b/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md
index 7fcd760277..66e1b03764 100644
--- a/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md
+++ b/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md
@@ -28,21 +28,71 @@ The following analytic identifies the use of Windows Curl.exe uploading a file t
HTTP multipart formposts are done with `-F`, but this appears to not be compatible with the Windows version of Curl. Will update if identified adversary tradecraft. \
Adversaries may use one of the three methods based on the remote destination and what they are attempting to upload (zip vs txt). During triage, review parallel processes for further behavior. In addition, identify if the upload was successful in network logs. If a file was uploaded, isolate the endpoint and review.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-11-10
- **Author**: Michael Haag, Splunk
- **ID**: 42f8f1a2-4228-11ec-aade-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1105](https://attack.mitre.org/techniques/T1105/) | Ingress Tool Transfer | Command And Control |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -56,11 +106,11 @@ Adversaries may use one of the three methods based on the remote destination and
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_curl](https://github.com/splunk/security_content/blob/develop/macros/process_curl.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `windows_curl_upload_to_remote_destination_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **windows_curl_upload_to_remote_destination_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -87,9 +137,6 @@ False positives may be limited to source control applications and may be require
* [Ingress Tool Transfer](/stories/ingress_tool_transfer)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -99,8 +146,6 @@ False positives may be limited to source control applications and may be require
| 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ uploading a file to a remote destination. |
-
-
#### Reference
* [https://everything.curl.dev/usingcurl/uploads](https://everything.curl.dev/usingcurl/uploads)
@@ -110,7 +155,7 @@ False positives may be limited to source control applications and may be require
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-11-10-windows_service_creation_on_remote_endpoint.md b/docs/_posts/2021-11-10-windows_service_creation_on_remote_endpoint.md
index fcd2e80acb..2ce2d86564 100644
--- a/docs/_posts/2021-11-10-windows_service_creation_on_remote_endpoint.md
+++ b/docs/_posts/2021-11-10-windows_service_creation_on_remote_endpoint.md
@@ -29,16 +29,21 @@ tags:
This analytic looks for the execution of `sc.exe` with command-line arguments utilized to create a Windows Service on a remote endpoint. Red Teams and adversaries alike may abuse the Service Control Manager for lateral movement and remote code execution.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-11-10
- **Author**: Mauricio Velazco, Splunk
- **ID**: e0eea4fa-4274-11ec-882b-3e22fbd008af
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,51 @@ This analytic looks for the execution of `sc.exe` with command-line arguments ut
| [T1543.003](https://attack.mitre.org/techniques/T1543/003/) | Windows Service | Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -59,10 +109,10 @@ This analytic looks for the execution of `sc.exe` with command-line arguments ut
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `windows_service_creation_on_remote_endpoint_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **windows_service_creation_on_remote_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -89,9 +139,6 @@ Administrators may create Windows Services on remote systems, but this activity
* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -101,8 +148,6 @@ Administrators may create Windows Services on remote systems, but this activity
| 54.0 | 90 | 60 | A Windows Service was created on a remote endpoint from $dest |
-
-
#### Reference
* [https://docs.microsoft.com/en-us/windows/win32/services/service-control-manager](https://docs.microsoft.com/en-us/windows/win32/services/service-control-manager)
@@ -112,7 +157,7 @@ Administrators may create Windows Services on remote systems, but this activity
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-11-10-windows_service_initiation_on_remote_endpoint.md b/docs/_posts/2021-11-10-windows_service_initiation_on_remote_endpoint.md
index b9aa422bfd..d50220cb14 100644
--- a/docs/_posts/2021-11-10-windows_service_initiation_on_remote_endpoint.md
+++ b/docs/_posts/2021-11-10-windows_service_initiation_on_remote_endpoint.md
@@ -29,16 +29,21 @@ tags:
This analytic looks for the execution of `sc.exe` with command-line arguments utilized to start a Windows Service on a remote endpoint. Red Teams and adversaries alike may abuse the Service Control Manager for lateral movement and remote code execution.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-11-10
- **Author**: Mauricio Velazco, Splunk
- **ID**: 3f519894-4276-11ec-ab02-3e22fbd008af
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,51 @@ This analytic looks for the execution of `sc.exe` with command-line arguments ut
| [T1543.003](https://attack.mitre.org/techniques/T1543/003/) | Windows Service | Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -59,10 +109,10 @@ This analytic looks for the execution of `sc.exe` with command-line arguments ut
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `windows_service_initiation_on_remote_endpoint_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **windows_service_initiation_on_remote_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -89,9 +139,6 @@ Administrators may start Windows Services on remote systems, but this activity i
* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -101,8 +148,6 @@ Administrators may start Windows Services on remote systems, but this activity i
| 54.0 | 90 | 60 | A Windows Service was started on a remote endpoint from $dest |
-
-
#### Reference
* [https://docs.microsoft.com/en-us/windows/win32/services/controlling-a-service-using-sc](https://docs.microsoft.com/en-us/windows/win32/services/controlling-a-service-using-sc)
@@ -111,7 +156,7 @@ Administrators may start Windows Services on remote systems, but this activity i
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-11-11-remote_process_instantiation_via_winrm_and_winrs.md b/docs/_posts/2021-11-11-remote_process_instantiation_via_winrm_and_winrs.md
index f19a90005b..7c2b9a8602 100644
--- a/docs/_posts/2021-11-11-remote_process_instantiation_via_winrm_and_winrs.md
+++ b/docs/_posts/2021-11-11-remote_process_instantiation_via_winrm_and_winrs.md
@@ -27,16 +27,21 @@ tags:
This analytic looks for the execution of `winrs.exe` with command-line arguments utilized to start a process on a remote endpoint. Red Teams and adversaries alike may abuse the WinRM protocol and this binary for lateral movement and remote code execution.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-11-11
- **Author**: Mauricio Velazco, Splunk
- **ID**: 0dd296a2-4338-11ec-ba02-3e22fbd008af
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This analytic looks for the execution of `winrs.exe` with command-line arguments
| [T1021.006](https://attack.mitre.org/techniques/T1021/006/) | Windows Remote Management | Lateral Movement |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +107,10 @@ This analytic looks for the execution of `winrs.exe` with command-line arguments
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `remote_process_instantiation_via_winrm_and_winrs_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **remote_process_instantiation_via_winrm_and_winrs_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -87,9 +137,6 @@ Administrators may leverage WinRM and WinRs to start a process on remote systems
* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -99,8 +146,6 @@ Administrators may leverage WinRM and WinRs to start a process on remote systems
| 54.0 | 90 | 60 | A process was started on a remote endpoint from $dest |
-
-
#### Reference
* [https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/winrs](https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/winrs)
@@ -109,7 +154,7 @@ Administrators may leverage WinRM and WinRs to start a process on remote systems
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-11-11-scheduled_task_creation_on_remote_endpoint_using_at.md b/docs/_posts/2021-11-11-scheduled_task_creation_on_remote_endpoint_using_at.md
index a9a25d464a..f13678a0ac 100644
--- a/docs/_posts/2021-11-11-scheduled_task_creation_on_remote_endpoint_using_at.md
+++ b/docs/_posts/2021-11-11-scheduled_task_creation_on_remote_endpoint_using_at.md
@@ -31,16 +31,21 @@ tags:
This analytic looks for the execution of `at.exe` with command-line arguments utilized to create a Scheduled Task on a remote endpoint. Red Teams and adversaries alike may abuse the Task Scheduler for lateral movement and remote code execution. The `at.exe` binary internally leverages the AT protocol which was deprecated starting with Windows 8 and Windows Server 2012 but may still work on previous versions of Windows. Furthermore, attackers may enable this protocol on demand by changing a sytem registry key.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-11-11
- **Author**: Mauricio Velazco, Splunk
- **ID**: 4be54858-432f-11ec-8209-3e22fbd008af
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -48,6 +53,51 @@ This analytic looks for the execution of `at.exe` with command-line arguments ut
| [T1053.002](https://attack.mitre.org/techniques/T1053/002/) | At (Windows) | Execution, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -61,10 +111,10 @@ This analytic looks for the execution of `at.exe` with command-line arguments ut
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `scheduled_task_creation_on_remote_endpoint_using_at_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **scheduled_task_creation_on_remote_endpoint_using_at_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -92,9 +142,6 @@ Administrators may create scheduled tasks on remote systems, but this activity i
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -104,8 +151,6 @@ Administrators may create scheduled tasks on remote systems, but this activity i
| 54.0 | 90 | 60 | A Windows Scheduled Task was created on a remote endpoint from $dest |
-
-
#### Reference
* [https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/at](https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/at)
@@ -114,7 +159,7 @@ Administrators may create scheduled tasks on remote systems, but this activity i
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-11-11-scheduled_task_initiation_on_remote_endpoint.md b/docs/_posts/2021-11-11-scheduled_task_initiation_on_remote_endpoint.md
index 8addb2be9b..1d9253db6d 100644
--- a/docs/_posts/2021-11-11-scheduled_task_initiation_on_remote_endpoint.md
+++ b/docs/_posts/2021-11-11-scheduled_task_initiation_on_remote_endpoint.md
@@ -31,16 +31,21 @@ tags:
This analytic looks for the execution of `schtasks.exe` with command-line arguments utilized to start a Scheduled Task on a remote endpoint. Red Teams and adversaries alike may abuse the Task Scheduler for lateral movement and remote code execution.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-11-11
- **Author**: Mauricio Velazco, Splunk
- **ID**: 95cf4608-4302-11ec-8194-3e22fbd008af
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -48,6 +53,51 @@ This analytic looks for the execution of `schtasks.exe` with command-line argume
| [T1053.005](https://attack.mitre.org/techniques/T1053/005/) | Scheduled Task | Execution, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -61,10 +111,10 @@ This analytic looks for the execution of `schtasks.exe` with command-line argume
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `scheduled_task_initiation_on_remote_endpoint_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **scheduled_task_initiation_on_remote_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -92,9 +142,6 @@ Administrators may start scheduled tasks on remote systems, but this activity is
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -104,8 +151,6 @@ Administrators may start scheduled tasks on remote systems, but this activity is
| 54.0 | 90 | 60 | A Windows Scheduled Task was ran on a remote endpoint from $dest |
-
-
#### Reference
* [https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks](https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks)
@@ -114,7 +159,7 @@ Administrators may start scheduled tasks on remote systems, but this activity is
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-11-11-schtasks_scheduling_job_on_remote_system.md b/docs/_posts/2021-11-11-schtasks_scheduling_job_on_remote_system.md
index 8646bf2cf5..1cfa95eeef 100644
--- a/docs/_posts/2021-11-11-schtasks_scheduling_job_on_remote_system.md
+++ b/docs/_posts/2021-11-11-schtasks_scheduling_job_on_remote_system.md
@@ -31,16 +31,21 @@ tags:
This analytic looks for the execution of `schtasks.exe` with command-line arguments utilized to create a Scheduled Task on a remote endpoint. Red Teams and adversaries alike may abuse the Task Scheduler for lateral movement and remote code execution.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-11-11
- **Author**: David Dorsey, Mauricio Velazco, Splunk
- **ID**: 1297fb80-f42a-4b4a-9c8a-88c066237cf6
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -48,6 +53,55 @@ This analytic looks for the execution of `schtasks.exe` with command-line argume
| [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.IP
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+
+
+
+
+
+
+
#### Search
```
@@ -61,10 +115,10 @@ This analytic looks for the execution of `schtasks.exe` with command-line argume
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `schtasks_scheduling_job_on_remote_system_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **schtasks_scheduling_job_on_remote_system_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -87,9 +141,6 @@ Administrators may create scheduled tasks on remote systems, but this activity i
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -99,13 +150,11 @@ Administrators may create scheduled tasks on remote systems, but this activity i
| 63.0 | 70 | 90 | A schedule task process $process_name$ with remote job commandline $process$ in host $dest$ |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md b/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md
index 38aade2146..9348248b8a 100644
--- a/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md
+++ b/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md
@@ -24,21 +24,71 @@ tags:
The following analytic identifies `wmic.exe` loading a remote XSL (eXtensible Stylesheet Language) script. This originally was identified by Casey Smith, dubbed Squiblytwo, as an application control bypass. Many adversaries will utilize this technique to invoke JScript or VBScript within an XSL file. This technique can also execute local/remote scripts and, similar to its Regsvr32 "Squiblydoo" counterpart, leverages a trusted, built-in Windows tool. Adversaries may abuse any alias in Windows Management Instrumentation provided they utilize the /FORMAT switch. Upon identifying a suspicious execution, review for confirmed network connnection and script download.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-11-11
- **Author**: Michael Haag, Splunk
- **ID**: 787e9dd0-4328-11ec-a029-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1220](https://attack.mitre.org/techniques/T1220/) | XSL Script Processing | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,11 +102,11 @@ The following analytic identifies `wmic.exe` loading a remote XSL (eXtensible St
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `wmic_xsl_execution_via_url_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **wmic_xsl_execution_via_url_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -83,9 +133,6 @@ False positives are limited as legitimate applications typically do not download
* [Suspicious WMI Use](/stories/suspicious_wmi_use)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -95,8 +142,6 @@ False positives are limited as legitimate applications typically do not download
| 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ utilizing wmic to download a remote XSL script. |
-
-
#### Reference
* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1220/T1220.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1220/T1220.md)
@@ -106,7 +151,7 @@ False positives are limited as legitimate applications typically do not download
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-11-12-aws_iam_accessdenied_discovery_events.md b/docs/_posts/2021-11-12-aws_iam_accessdenied_discovery_events.md
index bcd30c1417..14aa94136a 100644
--- a/docs/_posts/2021-11-12-aws_iam_accessdenied_discovery_events.md
+++ b/docs/_posts/2021-11-12-aws_iam_accessdenied_discovery_events.md
@@ -23,21 +23,71 @@ tags:
The following detection identifies excessive AccessDenied events within an hour timeframe. It is possible that an access key to AWS may have been stolen and is being misused to perform discovery events. In these instances, the access is not available with the key stolen therefore these events will be generated.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-11-12
- **Author**: Michael Haag, Splunk
- **ID**: 3e1f1568-9633-11eb-a69c-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1580](https://attack.mitre.org/techniques/T1580/) | Cloud Infrastructure Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +102,10 @@ The following detection identifies excessive AccessDenied events within an hour
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `aws_iam_accessdenied_discovery_events_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **aws_iam_accessdenied_discovery_events_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -76,9 +126,6 @@ It is possible to start this detection will need to be tuned by source IP or use
* [Suspicious Cloud User Activities](/stories/suspicious_cloud_user_activities)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -88,8 +135,6 @@ It is possible to start this detection will need to be tuned by source IP or use
| 10.0 | 20 | 50 | User $userIdentity.arn$ is seen to perform excessive number of discovery related api calls- $failures$, within an hour where the access was denied. |
-
-
#### Reference
* [https://aws.amazon.com/premiumsupport/knowledge-center/troubleshoot-iam-permission-errors/](https://aws.amazon.com/premiumsupport/knowledge-center/troubleshoot-iam-permission-errors/)
@@ -97,7 +142,7 @@ It is possible to start this detection will need to be tuned by source IP or use
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md b/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md
index 34fcc76d07..3efe4e5ef7 100644
--- a/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md
+++ b/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md
@@ -27,16 +27,21 @@ tags:
this analytic is to detect a suspicious compile before delivery approach of .net compiler csc.exe. This technique was seen in several adversaries, malware and even in red teams to take advantage the csc.exe .net compiler tool to compile on the fly a malicious .net code to evade detection from security product. This is a good hunting query to check further the file or process created after this event and check the file path that passed to csc.exe which is the .net code. Aside from that, powershell is capable of using this compiler in executing .net code in a powershell script so filter on that case is needed.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-11-12
- **Author**: Teoderick Contreras, Splunk
- **ID**: ea73128a-43ab-11ec-9753-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ this analytic is to detect a suspicious compile before delivery approach of .net
| [T1027](https://attack.mitre.org/techniques/T1027/) | Obfuscated Files or Information | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,11 +107,11 @@ this analytic is to detect a suspicious compile before delivery approach of .net
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_csc](https://github.com/splunk/security_content/blob/develop/macros/process_csc.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `csc_net_on_the_fly_compilation_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **csc_net_on_the_fly_compilation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -85,9 +135,6 @@ A network operator or systems administrator may utilize an automated powershell
* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -97,8 +144,6 @@ A network operator or systems administrator may utilize an automated powershell
| 25.0 | 50 | 50 | csc.exe with commandline $process$ to compile .net code on $dest$ by $user$ |
-
-
#### Reference
* [https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/](https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/)
@@ -107,7 +152,7 @@ A network operator or systems administrator may utilize an automated powershell
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-11-12-firewall_allowed_program_enable.md b/docs/_posts/2021-11-12-firewall_allowed_program_enable.md
index d3c3996330..4b5f89536f 100644
--- a/docs/_posts/2021-11-12-firewall_allowed_program_enable.md
+++ b/docs/_posts/2021-11-12-firewall_allowed_program_enable.md
@@ -27,16 +27,21 @@ tags:
This analytic detects a potential suspicious modification of firewall rule allowing to execute specific application. This technique was identified when an adversary and red teams to bypassed firewall file execution restriction in a targetted host. Take note that this event or command can run by administrator during testing or allowing legitimate tool or application.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-11-12
- **Author**: Teoderick Contreras, Splunk
- **ID**: 9a8f63a8-43ac-11ec-904c-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This analytic detects a potential suspicious modification of firewall rule allow
| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +107,10 @@ This analytic detects a potential suspicious modification of firewall rule allow
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `firewall_allowed_program_enable_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **firewall_allowed_program_enable_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +134,6 @@ A network operator or systems administrator may utilize an automated or manual e
* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -96,8 +143,6 @@ A network operator or systems administrator may utilize an automated or manual e
| 25.0 | 50 | 50 | firewall allowed program commandline $process$ of $process_name$ on $dest$ by $user$ |
-
-
#### Reference
* [https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/#](https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/#)
@@ -105,7 +150,7 @@ A network operator or systems administrator may utilize an automated or manual e
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md b/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md
index 63e7ebc6f3..7eecaf5da4 100644
--- a/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md
+++ b/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md
@@ -27,16 +27,21 @@ tags:
This analytic look for a spawned process of route.exe windows application. Adversaries and red teams alike abuse this application the recon or do a network discovery on a target host. but one possible false positive might be an automated tool used by a system administator or a powershell script in amazon ec2 config services.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-11-12
- **Author**: Teoderick Contreras, Splunk
- **ID**: dd83407e-439f-11ec-ab8e-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This analytic look for a spawned process of route.exe windows application. Adver
| [T1016.001](https://attack.mitre.org/techniques/T1016/001/) | Internet Connection Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,11 +107,11 @@ This analytic look for a spawned process of route.exe windows application. Adver
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_route](https://github.com/splunk/security_content/blob/develop/macros/process_route.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `network_discovery_using_route_windows_app_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **network_discovery_using_route_windows_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -85,9 +135,6 @@ A network operator or systems administrator may utilize an automated host discov
* [Active Directory Discovery](/stories/active_directory_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -97,8 +144,6 @@ A network operator or systems administrator may utilize an automated host discov
| 9.0 | 30 | 30 | Network Connection discovery on $dest$ by $user$ |
-
-
#### Reference
* [https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/#](https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/#)
@@ -106,7 +151,7 @@ A network operator or systems administrator may utilize an automated host discov
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md b/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md
index 10b4a986ee..9b12b47e4b 100644
--- a/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md
+++ b/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md
@@ -24,21 +24,79 @@ tags:
This analytic identifies wmic.exe being launched with parameters to spawn a process on a remote system. Red Teams and adversaries alike may abuse WMI and this binary for lateral movement and remote code execution.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-11-12
- **Author**: Rico Valdez, Mauricio Velazco, Splunk
- **ID**: d25d2c3d-d9d8-40ec-8fdf-e86fe155a3da
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1047](https://attack.mitre.org/techniques/T1047/) | Windows Management Instrumentation | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* PR.AT
+* PR.AC
+* PR.IP
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+
+
+
+
+
+
+
#### Search
```
@@ -52,11 +110,11 @@ This analytic identifies wmic.exe being launched with parameters to spawn a proc
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `remote_process_instantiation_via_wmi_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **remote_process_instantiation_via_wmi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -85,9 +143,6 @@ The wmic.exe utility is a benign Windows application. It may be used legitimatel
* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -97,8 +152,6 @@ The wmic.exe utility is a benign Windows application. It may be used legitimatel
| 49.0 | 70 | 70 | A wmic.exe process $process$ contain process spawn commandline $process$ in host $dest$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1047/](https://attack.mitre.org/techniques/T1047/)
@@ -107,7 +160,7 @@ The wmic.exe utility is a benign Windows application. It may be used legitimatel
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-11-12-runas_execution_in_commandline.md b/docs/_posts/2021-11-12-runas_execution_in_commandline.md
index 02ff558b5a..b2382b49ab 100644
--- a/docs/_posts/2021-11-12-runas_execution_in_commandline.md
+++ b/docs/_posts/2021-11-12-runas_execution_in_commandline.md
@@ -29,16 +29,21 @@ tags:
This analytic look for a spawned runas.exe process with a administrator user option parameter. This parameter was abused by adversaries, malware author or even red teams to gain elevated privileges in target host. This is a good hunting query to figure out privilege escalation tactics that may used for different stages like lateral movement but take note that administrator may use this command in purpose so its better to see other event context before and after this analytic.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-11-12
- **Author**: Teoderick Contreras, Splunk
- **ID**: 4807e716-43a4-11ec-a0e7-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,51 @@ This analytic look for a spawned runas.exe process with a administrator user opt
| [T1134.001](https://attack.mitre.org/techniques/T1134/001/) | Token Impersonation/Theft | Defense Evasion, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -59,11 +109,11 @@ This analytic look for a spawned runas.exe process with a administrator user opt
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_runas](https://github.com/splunk/security_content/blob/develop/macros/process_runas.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `runas_execution_in_commandline_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **runas_execution_in_commandline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -87,9 +137,6 @@ A network operator or systems administrator may utilize an automated or manual e
* [Windows Privilege Escalation](/stories/windows_privilege_escalation)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -99,8 +146,6 @@ A network operator or systems administrator may utilize an automated or manual e
| 25.0 | 50 | 50 | elevated process using runas on $dest$ by $user$ |
-
-
#### Reference
* [https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/#](https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/#)
@@ -108,7 +153,7 @@ A network operator or systems administrator may utilize an automated or manual e
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-11-12-windows_installutil_credential_theft.md b/docs/_posts/2021-11-12-windows_installutil_credential_theft.md
index 667e369fa6..4d11b99aa7 100644
--- a/docs/_posts/2021-11-12-windows_installutil_credential_theft.md
+++ b/docs/_posts/2021-11-12-windows_installutil_credential_theft.md
@@ -30,16 +30,21 @@ When `InstallUtil.exe` is used in a malicous manner, the path to an executable o
If used by a developer, typically this will be found with multiple command-line switches/arguments and spawn from Visual Studio. \
During triage review resulting network connections, file modifications, and parallel processes. Capture any artifacts and review further.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-11-12
- **Author**: Michael Haag, Splunk
- **ID**: ccfeddec-43ec-11ec-b494-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -47,6 +52,51 @@ During triage review resulting network connections, file modifications, and para
| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -60,10 +110,10 @@ During triage review resulting network connections, file modifications, and para
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `windows_installutil_credential_theft_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **windows_installutil_credential_theft_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -90,9 +140,6 @@ Typically this will not trigger as by it's very nature InstallUtil does not need
* [Signed Binary Proxy Execution InstallUtil](/stories/signed_binary_proxy_execution_installutil)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -102,8 +149,6 @@ Typically this will not trigger as by it's very nature InstallUtil does not need
| 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ loading samlib.dll and vaultcli.dll to potentially capture credentials in memory. |
-
-
#### Reference
* [https://gist.github.com/xorrior/bbac3919ca2aef8d924bdf3b16cce3d0](https://gist.github.com/xorrior/bbac3919ca2aef8d924bdf3b16cce3d0)
@@ -111,7 +156,7 @@ Typically this will not trigger as by it's very nature InstallUtil does not need
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md b/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md
index 3f488686c3..0cd3b1d6ff 100644
--- a/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md
+++ b/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md
@@ -31,16 +31,21 @@ When `InstallUtil.exe` is used in a malicous manner, the path to an executable o
If used by a developer, typically this will be found with multiple command-line switches/arguments and spawn from Visual Studio. \
During triage review resulting network connections, file modifications, and parallel processes. Capture any artifacts and review further.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-11-12
- **Author**: Michael Haag, Splunk
- **ID**: cfa7b9ac-43f0-11ec-9b48-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -48,6 +53,51 @@ During triage review resulting network connections, file modifications, and para
| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -61,11 +111,11 @@ During triage review resulting network connections, file modifications, and para
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `windows_installutil_uninstall_option_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **windows_installutil_uninstall_option_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -93,9 +143,6 @@ Limited false positives should be present. Filter as needed by parent process or
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -105,8 +152,6 @@ Limited false positives should be present. Filter as needed by parent process or
| 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ performing an uninstall. |
-
-
#### Reference
* [https://evi1cg.me/archives/AppLocker_Bypass_Techniques.html#menu_index_12](https://evi1cg.me/archives/AppLocker_Bypass_Techniques.html#menu_index_12)
@@ -116,7 +161,7 @@ Limited false positives should be present. Filter as needed by parent process or
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md b/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md
index dfd799b8ea..45defa4f5e 100644
--- a/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md
+++ b/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md
@@ -30,16 +30,21 @@ When `InstallUtil.exe` is used in a malicous manner, the path to an executable o
If used by a developer, typically this will be found with multiple command-line switches/arguments and spawn from Visual Studio. \
During triage review resulting network connections, file modifications, and parallel processes. Capture any artifacts and review further.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-11-12
- **Author**: Michael Haag, Splunk
- **ID**: 28e06670-43df-11ec-a569-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -47,6 +52,51 @@ During triage review resulting network connections, file modifications, and para
| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -60,11 +110,11 @@ During triage review resulting network connections, file modifications, and para
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `windows_installutil_url_in_command_line_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **windows_installutil_url_in_command_line_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -92,9 +142,6 @@ Limited false positives should be present as InstallUtil is not typically used t
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -104,8 +151,6 @@ Limited false positives should be present as InstallUtil is not typically used t
| 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ passing a URL on the command-line. |
-
-
#### Reference
* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md)
@@ -114,7 +159,7 @@ Limited false positives should be present as InstallUtil is not typically used t
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md b/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md
index ff7452d893..b632a18fed 100644
--- a/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md
+++ b/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md
@@ -27,16 +27,21 @@ tags:
This analytic looks for the execution of `powershell.exe` with arguments utilized to start a process on a remote endpoint by abusing the DCOM protocol. Specifically, this search looks for the abuse of ShellExecute and ExecuteShellCommand. Red Teams and adversaries alike may abuse DCOM and `powershell.exe` for lateral movement and remote code execution.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-11-15
- **Author**: Mauricio Velazco, Splunk
- **ID**: d4f42098-4680-11ec-ad07-3e22fbd008af
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This analytic looks for the execution of `powershell.exe` with arguments utilize
| [T1021.003](https://attack.mitre.org/techniques/T1021/003/) | Distributed Component Object Model | Lateral Movement |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,11 +107,11 @@ This analytic looks for the execution of `powershell.exe` with arguments utilize
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `remote_process_instantiation_via_dcom_and_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **remote_process_instantiation_via_dcom_and_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -88,9 +138,6 @@ Administrators may leverage DCOM to start a process on remote systems, but this
* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -100,8 +147,6 @@ Administrators may leverage DCOM to start a process on remote systems, but this
| 63.0 | 90 | 70 | A process was started on a remote endpoint from $dest by abusing DCOM using PowerShell.exe |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1021/003/](https://attack.mitre.org/techniques/T1021/003/)
@@ -110,7 +155,7 @@ Administrators may leverage DCOM to start a process on remote systems, but this
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell_script_block.md b/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell_script_block.md
index 12079915ef..b6b7d0635b 100644
--- a/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell_script_block.md
+++ b/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell_script_block.md
@@ -26,16 +26,21 @@ tags:
The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of PowerShell with arguments utilized to start a process on a remote endpoint by abusing the DCOM protocol. Specifically, this search looks for the abuse of ShellExecute and ExecuteShellCommand. Red Teams and adversaries alike may abuse DCOM for lateral movement and remote code execution.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-11-15
- **Author**: Mauricio Velazco, Splunk
- **ID**: fa1c3040-4680-11ec-a618-3e22fbd008af
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,51 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
| [T1021.003](https://attack.mitre.org/techniques/T1021/003/) | Distributed Component Object Model | Lateral Movement |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -54,10 +104,10 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `remote_process_instantiation_via_dcom_and_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **remote_process_instantiation_via_dcom_and_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -77,9 +127,6 @@ Administrators may leverage DCOM to start a process on remote systems, but this
* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -89,8 +136,6 @@ Administrators may leverage DCOM to start a process on remote systems, but this
| 63.0 | 90 | 70 | A process was started on a remote endpoint from $ComputerName by abusing WMI using PowerShell.exe |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1021/003/](https://attack.mitre.org/techniques/T1021/003/)
@@ -99,7 +144,7 @@ Administrators may leverage DCOM to start a process on remote systems, but this
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md b/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md
index dcbe0d6421..db4d3aac0b 100644
--- a/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md
+++ b/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md
@@ -24,21 +24,71 @@ tags:
This analytic looks for the execution of `powershell.exe` leveraging the `Invoke-WmiMethod` commandlet complemented with arguments utilized to start a process on a remote endpoint by abusing WMI. Red Teams and adversaries alike may abuse WMI and `powershell.exe` for lateral movement and remote code execution.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-11-15
- **Author**: Mauricio Velazco, Splunk
- **ID**: 112638b4-4634-11ec-b9ab-3e22fbd008af
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1047](https://attack.mitre.org/techniques/T1047/) | Windows Management Instrumentation | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,11 +102,11 @@ This analytic looks for the execution of `powershell.exe` leveraging the `Invoke
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `remote_process_instantiation_via_wmi_and_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **remote_process_instantiation_via_wmi_and_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -83,9 +133,6 @@ Administrators may leverage WWMI and powershell.exe to start a process on remote
* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -95,8 +142,6 @@ Administrators may leverage WWMI and powershell.exe to start a process on remote
| 63.0 | 90 | 70 | A process was started on a remote endpoint from $dest by abusing WMI using PowerShell.exe |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1047/](https://attack.mitre.org/techniques/T1047/)
@@ -105,7 +150,7 @@ Administrators may leverage WWMI and powershell.exe to start a process on remote
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell_script_block.md b/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell_script_block.md
index 19466dfc96..2ee027b6a5 100644
--- a/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell_script_block.md
+++ b/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell_script_block.md
@@ -23,21 +23,71 @@ tags:
The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Invoke-WmiMethod` commandlet with arguments utilized to start a process on a remote endpoint by abusing WMI. Red Teams and adversaries alike may abuse WMI and this commandlet for lateral movement and remote code execution.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-11-15
- **Author**: Mauricio Velazco, Splunk
- **ID**: 2a048c14-4634-11ec-a618-3e22fbd008af
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1047](https://attack.mitre.org/techniques/T1047/) | Windows Management Instrumentation | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -49,10 +99,10 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `remote_process_instantiation_via_wmi_and_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **remote_process_instantiation_via_wmi_and_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -72,9 +122,6 @@ Administrators may leverage WWMI and powershell.exe to start a process on remote
* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -84,8 +131,6 @@ Administrators may leverage WWMI and powershell.exe to start a process on remote
| 63.0 | 90 | 70 | A process was started on a remote endpoint from $ComputerName by abusing WMI using PowerShell.exe |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1047/](https://attack.mitre.org/techniques/T1047/)
@@ -94,7 +139,7 @@ Administrators may leverage WWMI and powershell.exe to start a process on remote
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-11-15-windows_diskcryptor_usage.md b/docs/_posts/2021-11-15-windows_diskcryptor_usage.md
index 5b810dfe94..749164711c 100644
--- a/docs/_posts/2021-11-15-windows_diskcryptor_usage.md
+++ b/docs/_posts/2021-11-15-windows_diskcryptor_usage.md
@@ -24,21 +24,71 @@ tags:
The following analytic identifies DiskCryptor process name of dcrypt.exe or internal name dcinst.exe. This utility has been utilized by adversaries to encrypt disks manually during an operation. In addition, during install, a dcrypt.sys driver is installed and requires a reboot in order to take effect. There are no command-line arguments used.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-11-15
- **Author**: Michael Haag, Splunk
- **ID**: d56fe0c8-4650-11ec-a8fa-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1486](https://attack.mitre.org/techniques/T1486/) | Data Encrypted for Impact | Impact |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +102,10 @@ The following analytic identifies DiskCryptor process name of dcrypt.exe or int
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `windows_diskcryptor_usage_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **windows_diskcryptor_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -82,9 +132,6 @@ It is possible false positives may be present based on the internal name dcinst.
* [Ransomware](/stories/ransomware)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -94,8 +141,6 @@ It is possible false positives may be present based on the internal name dcinst.
| 35.0 | 70 | 50 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to encrypt disks. |
-
-
#### Reference
* [https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/](https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/)
@@ -104,7 +149,7 @@ It is possible false positives may be present based on the internal name dcinst.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-11-16-high_frequency_copy_of_files_in_network_share.md b/docs/_posts/2021-11-16-high_frequency_copy_of_files_in_network_share.md
index a4d70d4fe9..5f53f8d528 100644
--- a/docs/_posts/2021-11-16-high_frequency_copy_of_files_in_network_share.md
+++ b/docs/_posts/2021-11-16-high_frequency_copy_of_files_in_network_share.md
@@ -24,21 +24,71 @@ tags:
This analytic is to detect a suspicious high frequency copying/moving of files in network share as part of information sabotage. This anomaly event can be a good indicator of insider trying to sabotage data by transfering classified or internal files within network share to exfitrate it after or to lure evidence of insider attack to other user. This behavior may catch several noise if network share is a common place for classified or internal document processing.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-11-16
- **Author**: Teoderick Contreras, Splunk
- **ID**: 40925f12-4709-11ec-bb43-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1537](https://attack.mitre.org/techniques/T1537/) | Transfer Data to Cloud Account | Exfiltration |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -56,7 +106,7 @@ This analytic is to detect a suspicious high frequency copying/moving of files i
The SPL above uses the following Macros:
* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
-Note that `high_frequency_copy_of_files_in_network_share_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **high_frequency_copy_of_files_in_network_share_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -80,9 +130,6 @@ this behavior may seen in normal transfer of file within network if network shar
* [Information Sabotage](/stories/information_sabotage)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -92,8 +139,6 @@ this behavior may seen in normal transfer of file within network if network shar
| 9.0 | 30 | 30 | high frequency copy of document in network share $Share_Name$ from $Source_Address$ by $user$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1537/](https://attack.mitre.org/techniques/T1537/)
@@ -101,7 +146,7 @@ this behavior may seen in normal transfer of file within network if network shar
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md b/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md
index 42e22f8ce0..28c2e723f9 100644
--- a/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md
+++ b/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md
@@ -27,16 +27,21 @@ tags:
This analytic looks for the execution of `powershell.exe` with arguments utilized to start a process on a remote endpoint by abusing the WinRM protocol. Specifically, this search looks for the abuse of the `Invoke-Command` commandlet. Red Teams and adversaries alike may abuse WinRM and `powershell.exe` for lateral movement and remote code execution.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-11-16
- **Author**: Mauricio Velazco, Splunk
- **ID**: ba24cda8-4716-11ec-8009-3e22fbd008af
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This analytic looks for the execution of `powershell.exe` with arguments utilize
| [T1021.006](https://attack.mitre.org/techniques/T1021/006/) | Windows Remote Management | Lateral Movement |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,11 +107,11 @@ This analytic looks for the execution of `powershell.exe` with arguments utilize
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `remote_process_instantiation_via_winrm_and_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **remote_process_instantiation_via_winrm_and_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -88,9 +138,6 @@ Administrators may leverage WinRM and `Invoke-Command` to start a process on rem
* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -100,8 +147,6 @@ Administrators may leverage WinRM and `Invoke-Command` to start a process on rem
| 45.0 | 90 | 50 | A process was started on a remote endpoint from $dest by abusing WinRM using PowerShell.exe |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1021/006/](https://attack.mitre.org/techniques/T1021/006/)
@@ -110,7 +155,7 @@ Administrators may leverage WinRM and `Invoke-Command` to start a process on rem
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell_script_block.md b/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell_script_block.md
index bb2f8134f4..461370826c 100644
--- a/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell_script_block.md
+++ b/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell_script_block.md
@@ -26,16 +26,21 @@ tags:
The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of PowerShell with arguments utilized to start a process on a remote endpoint by abusing the WinRM protocol. Specifically, this search looks for the abuse of the `Invoke-Command` commandlet. Red Teams and adversaries alike may abuse WinRM for lateral movement and remote code execution.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-11-16
- **Author**: Mauricio Velazco, Splunk
- **ID**: 7d4c618e-4716-11ec-951c-3e22fbd008af
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,51 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
| [T1021.006](https://attack.mitre.org/techniques/T1021/006/) | Windows Remote Management | Lateral Movement |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -54,10 +104,10 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `remote_process_instantiation_via_winrm_and_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **remote_process_instantiation_via_winrm_and_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -77,9 +127,6 @@ Administrators may leverage WinRM and `Invoke-Command` to start a process on rem
* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -89,8 +136,6 @@ Administrators may leverage WinRM and `Invoke-Command` to start a process on rem
| 45.0 | 90 | 50 | A process was started on a remote endpoint from $ComputerName by abusing WinRM using PowerShell.exe |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1021/006/](https://attack.mitre.org/techniques/T1021/006/)
@@ -99,7 +144,7 @@ Administrators may leverage WinRM and `Invoke-Command` to start a process on rem
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-11-17-windows_dism_remove_defender.md b/docs/_posts/2021-11-17-windows_dism_remove_defender.md
index 84d432e2c4..a9d65d562c 100644
--- a/docs/_posts/2021-11-17-windows_dism_remove_defender.md
+++ b/docs/_posts/2021-11-17-windows_dism_remove_defender.md
@@ -27,16 +27,21 @@ tags:
The following analytic identifies the use of the Windows Disk Image Utility, `dism.exe`, to remove Windows Defender. Adversaries may use `dism.exe` to disable Defender before completing their objective.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-11-17
- **Author**: Michael Haag, Splunk
- **ID**: 8567da9e-47f0-11ec-99a9-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ The following analytic identifies the use of the Windows Disk Image Utility, `di
| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +107,10 @@ The following analytic identifies the use of the Windows Disk Image Utility, `di
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `windows_dism_remove_defender_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **windows_dism_remove_defender_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -87,9 +137,6 @@ Some legitimate administrative tools leverage `dism.exe` to manipulate packages
* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -99,8 +146,6 @@ Some legitimate administrative tools leverage `dism.exe` to manipulate packages
| 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to disable Windows Defender. |
-
-
#### Reference
* [https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/](https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/)
@@ -108,7 +153,7 @@ Some legitimate administrative tools leverage `dism.exe` to manipulate packages
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-11-18-executable_file_written_in_administrative_smb_share.md b/docs/_posts/2021-11-18-executable_file_written_in_administrative_smb_share.md
index db2714a81f..784a9a7c38 100644
--- a/docs/_posts/2021-11-18-executable_file_written_in_administrative_smb_share.md
+++ b/docs/_posts/2021-11-18-executable_file_written_in_administrative_smb_share.md
@@ -26,16 +26,21 @@ tags:
The following analytic identifies executable files (.exe or .dll) being written to Windows administrative SMB shares (Admin$, IPC$, C$). This represents suspicious behavior as its commonly used by tools like like PsExec/PaExec and others to stage service binaries before creating and starting a Windows service on remote endpoints. Red Teams and adversaries alike may abuse administrative shares for lateral movement and remote code execution. The Trickbot malware family also implements this behavior to try to infect other machines in the infected network.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-11-18
- **Author**: Teoderick Contreras, Mauricio Velazco, Splunk
- **ID**: f63c34fe-a435-11eb-935a-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,51 @@ The following analytic identifies executable files (.exe or .dll) being written
| [T1021.002](https://attack.mitre.org/techniques/T1021/002/) | SMB/Windows Admin Shares | Lateral Movement |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -55,10 +105,10 @@ The following analytic identifies executable files (.exe or .dll) being written
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `executable_file_written_in_administrative_smb_share_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **executable_file_written_in_administrative_smb_share_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -85,9 +135,6 @@ System Administrators may use looks like PsExec for troubleshooting or administr
* [Hermetic Wiper](/stories/hermetic_wiper)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -97,8 +144,6 @@ System Administrators may use looks like PsExec for troubleshooting or administr
| 70.0 | 70 | 100 | $user$ dropped or created an executable file in known sensitive SMB share. Share name=$Share_Name$, Target name=$Relative_Target_Name$, and Access mask=$Access_Mask$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1021/002/](https://attack.mitre.org/techniques/T1021/002/)
@@ -109,7 +154,7 @@ System Administrators may use looks like PsExec for troubleshooting or administr
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md b/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md
index 1412062c6b..c80c3e0ed1 100644
--- a/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md
+++ b/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md
@@ -29,16 +29,21 @@ tags:
DynamicWrapperX is an ActiveX component that can be used in a script to call Windows API functions, but it requires the dynwrapx.dll to be installed and registered. With that, registering or loading dynwrapx.dll to a host is highly suspicious. In most instances when it is used maliciously, the best way to triage is to review parallel processes and pivot on the process_guid. Review the registry for any suspicious modifications meant to load dynwrapx.dll. Identify any suspicious module loads of dynwrapx.dll. This detection will return and identify the processes that invoke vbs/wscript/cscript.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-11-18
- **Author**: Teoderick Contreras, Splunk
- **ID**: eac5e8ba-4857-11ec-9371-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,51 @@ DynamicWrapperX is an ActiveX component that can be used in a script to call Win
| [T1055.001](https://attack.mitre.org/techniques/T1055/001/) | Dynamic-link Library Injection | Defense Evasion, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -58,10 +108,10 @@ DynamicWrapperX is an ActiveX component that can be used in a script to call Win
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `loading_of_dynwrapx_module_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **loading_of_dynwrapx_module_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -86,9 +136,6 @@ False positives should be limited, however it is possible to filter by Processes
* [Remcos](/stories/remcos)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -98,8 +145,6 @@ False positives should be limited, however it is possible to filter by Processes
| 80.0 | 80 | 100 | dynwrapx.dll loaded by process $process_name$ on $Computer$ |
-
-
#### Reference
* [https://blog.f-secure.com/hunting-for-koadic-a-com-based-rootkit/](https://blog.f-secure.com/hunting-for-koadic-a-com-based-rootkit/)
@@ -111,7 +156,7 @@ False positives should be limited, however it is possible to filter by Processes
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md b/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md
index 1d3f211875..46501b0957 100644
--- a/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md
+++ b/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md
@@ -24,21 +24,71 @@ tags:
This analytic is to detect a suspicious dxdiag.exe process command-line execution. Dxdiag is used to collect the system info of the target host. This technique has been used by Remcos RATS, various actors, and other malware to collect information as part of the recon or collection phase of an attack. This behavior should rarely be seen in a corporate network, but this command line can be used by a network administrator to audit host machine specifications. Thus in some rare cases, this detection will contain false positives in its results. To triage further, analyze what commands were passed after it pipes out the result to a file for further processing.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-11-19
- **Author**: Teoderick Contreras, Splunk
- **ID**: f92d74f2-4921-11ec-b685-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1592](https://attack.mitre.org/techniques/T1592/) | Gather Victim Host Information | Reconnaissance |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,11 +102,11 @@ This analytic is to detect a suspicious dxdiag.exe process command-line executio
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_dxdiag](https://github.com/splunk/security_content/blob/develop/macros/process_dxdiag.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `system_info_gathering_using_dxdiag_application_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **system_info_gathering_using_dxdiag_application_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -83,9 +133,6 @@ This commandline can be used by a network administrator to audit host machine sp
* [Remcos](/stories/remcos)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -95,8 +142,6 @@ This commandline can be used by a network administrator to audit host machine sp
| 25.0 | 50 | 50 | dxdiag.exe process with commandline $process$ on $dest$ |
-
-
#### Reference
* [https://app.any.run/tasks/df0baf9f-8baf-4c32-a452-16562ecb19be/](https://app.any.run/tasks/df0baf9f-8baf-4c32-a452-16562ecb19be/)
@@ -104,7 +149,7 @@ This commandline can be used by a network administrator to audit host machine sp
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md b/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md
index 6b503e9ada..cb2f6fef65 100644
--- a/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md
+++ b/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md
@@ -27,16 +27,21 @@ tags:
This analytic will detect if a suspicious process contains a commandline parameter related to a web browser credential dumper. This technique is used by Remcos RAT malware which uses the Nirsoft webbrowserpassview.exe application to dump web browser credentials. Remcos uses the "/stext" command line to dump the credentials in text format. This Hunting query is a good indicator of hosts suffering from possible Remcos RAT infection. Since the hunting query is based on the parameter command and the possible path where it will save the text credential information, it may catch normal tools that are using the same command and behavior.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-11-22
- **Author**: Teoderick Contreras, Splunk
- **ID**: 8ba484e8-4b97-11ec-b19a-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This analytic will detect if a suspicious process contains a commandline paramet
| [T1555](https://attack.mitre.org/techniques/T1555/) | Credentials from Password Stores | Credential Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +107,10 @@ This analytic will detect if a suspicious process contains a commandline paramet
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `possible_browser_pass_view_parameter_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **possible_browser_pass_view_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -87,9 +137,6 @@ False positive is quite limited. Filter is needed
* [Remcos](/stories/remcos)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -99,8 +146,6 @@ False positive is quite limited. Filter is needed
| 16.0 | 40 | 40 | suspicious process $process_name$ contains commandline $process$ on $dest$ |
-
-
#### Reference
* [https://www.nirsoft.net/utils/web_browser_password.html](https://www.nirsoft.net/utils/web_browser_password.html)
@@ -109,7 +154,7 @@ False positive is quite limited. Filter is needed
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-11-22-services_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-22-services_lolbas_execution_process_spawn.md
index 3798452bc4..9cfdc8ebea 100644
--- a/docs/_posts/2021-11-22-services_lolbas_execution_process_spawn.md
+++ b/docs/_posts/2021-11-22-services_lolbas_execution_process_spawn.md
@@ -29,16 +29,21 @@ tags:
The following analytic identifies `services.exe` spawning a LOLBAS execution process. When adversaries execute code on remote endpoints abusing the Service Control Manager and creating a remote malicious service, the executed command is spawned as a child process of `services.exe`. The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code. Looking for child processes of services.exe that are part of the LOLBAS project can help defenders identify lateral movement activity.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-11-22
- **Author**: Mauricio Velazco, Splunk
- **ID**: ba9e1954-4c04-11ec-8b74-3e22fbd008af
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,51 @@ The following analytic identifies `services.exe` spawning a LOLBAS execution pro
| [T1543.003](https://attack.mitre.org/techniques/T1543/003/) | Windows Service | Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -59,10 +109,10 @@ The following analytic identifies `services.exe` spawning a LOLBAS execution pro
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `services_lolbas_execution_process_spawn_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **services_lolbas_execution_process_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -90,9 +140,6 @@ Legitimate applications may trigger this behavior, filter as needed.
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -102,8 +149,6 @@ Legitimate applications may trigger this behavior, filter as needed.
| 54.0 | 90 | 60 | Services.exe spawned a LOLBAS process on $dest |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1543/003/](https://attack.mitre.org/techniques/T1543/003/)
@@ -113,7 +158,7 @@ Legitimate applications may trigger this behavior, filter as needed.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-11-22-svchost_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-22-svchost_lolbas_execution_process_spawn.md
index 8ba87bdb66..5bd13df00c 100644
--- a/docs/_posts/2021-11-22-svchost_lolbas_execution_process_spawn.md
+++ b/docs/_posts/2021-11-22-svchost_lolbas_execution_process_spawn.md
@@ -31,16 +31,21 @@ tags:
The following analytic identifies `svchost.exe` spawning a LOLBAS execution process. When adversaries execute code on remote endpoints abusing the Task Scheduler and creating a malicious remote scheduled task, the executed command is spawned as a child process of `svchost.exe`. The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code. Looking for child processes of svchost.exe that are part of the LOLBAS project can help defenders identify lateral movement activity.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-11-22
- **Author**: Mauricio Velazco, Splunk
- **ID**: 09e5c72a-4c0d-11ec-aa29-3e22fbd008af
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -48,6 +53,51 @@ The following analytic identifies `svchost.exe` spawning a LOLBAS execution proc
| [T1053.005](https://attack.mitre.org/techniques/T1053/005/) | Scheduled Task | Execution, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -61,10 +111,10 @@ The following analytic identifies `svchost.exe` spawning a LOLBAS execution proc
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `svchost_lolbas_execution_process_spawn_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **svchost_lolbas_execution_process_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -92,9 +142,6 @@ Legitimate applications may trigger this behavior, filter as needed.
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -104,8 +151,6 @@ Legitimate applications may trigger this behavior, filter as needed.
| 54.0 | 90 | 60 | Svchost.exe spawned a LOLBAS process on $dest |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1053/005/](https://attack.mitre.org/techniques/T1053/005/)
@@ -115,7 +160,7 @@ Legitimate applications may trigger this behavior, filter as needed.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md b/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md
index 25a02762d9..dc60511f07 100644
--- a/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md
+++ b/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md
@@ -26,16 +26,21 @@ tags:
The following analytc uses Windows Event Id 7045, `New Service Was Installed`, to identify the creation of a Windows Service where the service binary path path is located in a non-common Service folder in Windows. Red Teams and adversaries alike may create malicious Services for lateral movement or remote code execution as well as persistence and execution. The Clop ransomware has also been seen in the wild abusing Windows services.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-11-22
- **Author**: Teoderick Contreras, Mauricio Velazco, Splunk
- **ID**: 429141be-8311-11eb-adb6-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,51 @@ The following analytc uses Windows Event Id 7045, `New Service Was Installed`, t
| [T1569.002](https://attack.mitre.org/techniques/T1569/002/) | Service Execution | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -55,10 +105,10 @@ The following analytc uses Windows Event Id 7045, `New Service Was Installed`, t
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `windows_service_created_with_suspicious_service_path_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **windows_service_created_with_suspicious_service_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* EventCode
@@ -80,9 +130,6 @@ Legitimate applications may install services with uncommon services paths.
* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -92,8 +139,6 @@ Legitimate applications may install services with uncommon services paths.
| 56.0 | 70 | 80 | A service $Service_File_Name$ was created from a non-standard path using $Service_Name$ |
-
-
#### Reference
* [https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html](https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html)
@@ -102,7 +147,7 @@ Legitimate applications may install services with uncommon services paths.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-11-22-windows_service_created_within_public_path.md b/docs/_posts/2021-11-22-windows_service_created_within_public_path.md
index e1d1f7b305..022efd6778 100644
--- a/docs/_posts/2021-11-22-windows_service_created_within_public_path.md
+++ b/docs/_posts/2021-11-22-windows_service_created_within_public_path.md
@@ -28,16 +28,21 @@ tags:
The following analytc uses Windows Event Id 7045, `New Service Was Installed`, to identify the creation of a Windows Service where the service binary path is located in public paths. This behavior could represent the installation of a malicious service. Red Teams and adversaries alike may create malicious Services for lateral movement or remote code execution
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-11-22
- **Author**: Mauricio Velazco, Splunk
- **ID**: 3abb2eda-4bb8-11ec-9ae4-3e22fbd008af
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -45,6 +50,51 @@ The following analytc uses Windows Event Id 7045, `New Service Was Installed`, t
| [T1543.003](https://attack.mitre.org/techniques/T1543/003/) | Windows Service | Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +107,10 @@ The following analytc uses Windows Event Id 7045, `New Service Was Installed`, t
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `windows_service_created_within_public_path_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **windows_service_created_within_public_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* EventCode
@@ -81,9 +131,6 @@ Legitimate applications may install services with uncommon services paths.
* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -93,8 +140,6 @@ Legitimate applications may install services with uncommon services paths.
| 54.0 | 90 | 60 | A Windows Service $Service_File_Name$ with a public path was created on $ComputerName |
-
-
#### Reference
* [https://docs.microsoft.com/en-us/windows/win32/services/service-control-manager](https://docs.microsoft.com/en-us/windows/win32/services/service-control-manager)
@@ -103,7 +148,7 @@ Legitimate applications may install services with uncommon services paths.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-11-22-wmiprsve_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-22-wmiprsve_lolbas_execution_process_spawn.md
index bee9fe8ccf..7ffe682eb2 100644
--- a/docs/_posts/2021-11-22-wmiprsve_lolbas_execution_process_spawn.md
+++ b/docs/_posts/2021-11-22-wmiprsve_lolbas_execution_process_spawn.md
@@ -24,21 +24,71 @@ tags:
The following analytic identifies `wmiprsve.exe` spawning a LOLBAS execution process. When adversaries execute code on remote endpoints abusing Windows Management Instrumentation (WMI), the executed command is spawned as a child process of `wmiprvse.exe`. The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code. Looking for child processes of wmiprvse.exe that are part of the LOLBAS project can help defenders identify lateral movement activity.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-11-22
- **Author**: Mauricio Velazco, Splunk
- **ID**: 95a455f0-4c04-11ec-b8ac-3e22fbd008af
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1047](https://attack.mitre.org/techniques/T1047/) | Windows Management Instrumentation | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +102,10 @@ The following analytic identifies `wmiprsve.exe` spawning a LOLBAS execution pro
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `wmiprsve_lolbas_execution_process_spawn_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **wmiprsve_lolbas_execution_process_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -82,9 +132,6 @@ Legitimate applications may trigger this behavior, filter as needed.
* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -94,8 +141,6 @@ Legitimate applications may trigger this behavior, filter as needed.
| 54.0 | 90 | 60 | Wmiprsve.exe spawned a LOLBAS process on $dest$. |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1047/](https://attack.mitre.org/techniques/T1047/)
@@ -105,7 +150,7 @@ Legitimate applications may trigger this behavior, filter as needed.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-11-22-wsmprovhost_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-22-wsmprovhost_lolbas_execution_process_spawn.md
index bdc2b8d64c..276d318044 100644
--- a/docs/_posts/2021-11-22-wsmprovhost_lolbas_execution_process_spawn.md
+++ b/docs/_posts/2021-11-22-wsmprovhost_lolbas_execution_process_spawn.md
@@ -27,16 +27,21 @@ tags:
The following analytic identifies `Wsmprovhost.exe` spawning a LOLBAS execution process. When adversaries execute code on remote endpoints abusing the Windows Remote Management (WinRm) protocol, the executed command is spawned as a child processs of `Wsmprovhost.exe`. The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code. Looking for child processes of Wsmprovhost.exe that are part of the LOLBAS project can help defenders identify lateral movement activity.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-11-22
- **Author**: Mauricio Velazco, Splunk
- **ID**: 2eed004c-4c0d-11ec-93e8-3e22fbd008af
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ The following analytic identifies `Wsmprovhost.exe` spawning a LOLBAS execution
| [T1021.006](https://attack.mitre.org/techniques/T1021/006/) | Windows Remote Management | Lateral Movement |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +107,10 @@ The following analytic identifies `Wsmprovhost.exe` spawning a LOLBAS execution
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `wsmprovhost_lolbas_execution_process_spawn_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **wsmprovhost_lolbas_execution_process_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -87,9 +137,6 @@ Legitimate applications may trigger this behavior, filter as needed.
* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -99,8 +146,6 @@ Legitimate applications may trigger this behavior, filter as needed.
| 54.0 | 90 | 60 | Wsmprovhost.exe spawned a LOLBAS process on $dest$. |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1021/006/](https://attack.mitre.org/techniques/T1021/006/)
@@ -110,7 +155,7 @@ Legitimate applications may trigger this behavior, filter as needed.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-11-23-mmc_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-23-mmc_lolbas_execution_process_spawn.md
index 29ef270dc9..b017b11469 100644
--- a/docs/_posts/2021-11-23-mmc_lolbas_execution_process_spawn.md
+++ b/docs/_posts/2021-11-23-mmc_lolbas_execution_process_spawn.md
@@ -27,16 +27,21 @@ tags:
The following analytic identifies `mmc.exe` spawning a LOLBAS execution process. When adversaries execute code on remote endpoints abusing the DCOM protocol and the MMC20 COM object, the executed command is spawned as a child processs of `mmc.exe`. The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code. Looking for child processes of mmc.exe that are part of the LOLBAS project can help defenders identify lateral movement activity.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-11-23
- **Author**: Mauricio Velazco, Splunk
- **ID**: f6601940-4c74-11ec-b9b7-3e22fbd008af
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ The following analytic identifies `mmc.exe` spawning a LOLBAS execution process.
| [T1021.003](https://attack.mitre.org/techniques/T1021/003/) | Distributed Component Object Model | Lateral Movement |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +107,10 @@ The following analytic identifies `mmc.exe` spawning a LOLBAS execution process.
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `mmc_lolbas_execution_process_spawn_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **mmc_lolbas_execution_process_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -88,9 +138,6 @@ Legitimate applications may trigger this behavior, filter as needed.
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -100,8 +147,6 @@ Legitimate applications may trigger this behavior, filter as needed.
| 54.0 | 90 | 60 | Mmc.exe spawned a LOLBAS process on $dest |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1021/003/](https://attack.mitre.org/techniques/T1021/003/)
@@ -111,7 +156,7 @@ Legitimate applications may trigger this behavior, filter as needed.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-11-25-add_or_set_windows_defender_exclusion.md b/docs/_posts/2021-11-25-add_or_set_windows_defender_exclusion.md
index fe19ee8876..936a9f865e 100644
--- a/docs/_posts/2021-11-25-add_or_set_windows_defender_exclusion.md
+++ b/docs/_posts/2021-11-25-add_or_set_windows_defender_exclusion.md
@@ -27,16 +27,21 @@ tags:
This analytic will identify a suspicious process command-line related to Windows Defender exclusion feature. This command is abused by adversaries, malware authors and red teams to bypass Windows Defender Antivirus products by excluding folder path, file path, process and extensions. From its real time or schedule scan to execute their malicious code. This is a good indicator for defense evasion and to look further for events after this behavior.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-11-25
- **Author**: Teoderick Contreras, Splunk
- **ID**: 773b66fe-4dd9-11ec-8289-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This analytic will identify a suspicious process command-line related to Windows
| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +107,10 @@ This analytic will identify a suspicious process command-line related to Windows
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `add_or_set_windows_defender_exclusion_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **add_or_set_windows_defender_exclusion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -89,9 +139,6 @@ Admin or user may choose to use this windows features. Filter as needed.
* [WhisperGate](/stories/whispergate)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -101,8 +148,6 @@ Admin or user may choose to use this windows features. Filter as needed.
| 64.0 | 80 | 80 | exclusion command $process$ executed on $dest$ |
-
-
#### Reference
* [https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html](https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html)
@@ -112,7 +157,7 @@ Admin or user may choose to use this windows features. Filter as needed.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-11-25-powershell_windows_defender_exclusion_commands.md b/docs/_posts/2021-11-25-powershell_windows_defender_exclusion_commands.md
index e574844197..09c6ba2284 100644
--- a/docs/_posts/2021-11-25-powershell_windows_defender_exclusion_commands.md
+++ b/docs/_posts/2021-11-25-powershell_windows_defender_exclusion_commands.md
@@ -27,16 +27,21 @@ tags:
This analytic will detect a suspicious process commandline related to windows defender exclusion feature. This command is abused by adversaries, malware author and red teams to bypassed Windows Defender Anti-Virus product by excluding folder path, file path, process, extensions and etc. from its real time or schedule scan to execute their malicious code. This is a good indicator for defense evasion and to look further for events after this behavior.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-11-25
- **Author**: Teoderick Contreras, Splunk
- **ID**: 907ac95c-4dd9-11ec-ba2c-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This analytic will detect a suspicious process commandline related to windows de
| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -56,10 +106,10 @@ This analytic will detect a suspicious process commandline related to windows de
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `powershell_windows_defender_exclusion_commands_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **powershell_windows_defender_exclusion_commands_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -81,9 +131,6 @@ admin or user may choose to use this windows features.
* [WhisperGate](/stories/whispergate)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -93,8 +140,6 @@ admin or user may choose to use this windows features.
| 64.0 | 80 | 80 | exclusion command $Message$ executed on $ComputerName$ |
-
-
#### Reference
* [https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html](https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html)
@@ -104,7 +149,7 @@ admin or user may choose to use this windows features.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-11-25-windows_defender_exclusion_registry_entry.md b/docs/_posts/2021-11-25-windows_defender_exclusion_registry_entry.md
index 202de298dd..3ff630a630 100644
--- a/docs/_posts/2021-11-25-windows_defender_exclusion_registry_entry.md
+++ b/docs/_posts/2021-11-25-windows_defender_exclusion_registry_entry.md
@@ -27,16 +27,21 @@ tags:
This analytic will detect a suspicious process that modify a registry related to windows defender exclusion feature. This registry is abused by adversaries, malware author and red teams to bypassed Windows Defender Anti-Virus product by excluding folder path, file path, process, extensions and etc. from its real time or schedule scan to execute their malicious code. This is a good indicator for a defense evasion and to look further for events after this behavior.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-11-25
- **Author**: Teoderick Contreras, Splunk
- **ID**: 13395a44-4dd9-11ec-9df7-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This analytic will detect a suspicious process that modify a registry related to
| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -64,7 +114,7 @@ This analytic will detect a suspicious process that modify a registry related to
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `windows_defender_exclusion_registry_entry_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **windows_defender_exclusion_registry_entry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -87,9 +137,6 @@ admin or user may choose to use this windows features.
* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -99,8 +146,6 @@ admin or user may choose to use this windows features.
| 64.0 | 80 | 80 | exclusion registry $registry_path$ modified or added on $dest$ |
-
-
#### Reference
* [https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html](https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html)
@@ -110,7 +155,7 @@ admin or user may choose to use this windows features.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md b/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md
index 31da565105..5bfdd9c05e 100644
--- a/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md
+++ b/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md
@@ -24,21 +24,71 @@ tags:
This analytic identifies commonly used command-line arguments used by `rclone.exe` to initiate a file transfer. Some arguments were negated as they are specific to the configuration used by adversaries. In particular, an adversary may list the files or directories of the remote file share using `ls` or `lsd`, which is not indicative of malicious behavior. During triage, at this stage of a ransomware event, exfiltration is about to occur or has already. Isolate the endpoint and continue investigating by review file modifications and parallel processes.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-11-29
- **Author**: Michael Haag, Splunk
- **ID**: 32e0baea-b3f1-11eb-a2ce-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1020](https://attack.mitre.org/techniques/T1020/) | Automated Exfiltration | Exfiltration |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,11 +102,11 @@ This analytic identifies commonly used command-line arguments used by `rclone.ex
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_rclone](https://github.com/splunk/security_content/blob/develop/macros/process_rclone.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_rclone_command-line_usage_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_rclone_command-line_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -81,9 +131,6 @@ False positives should be limited as this is restricted to the Rclone process na
* [Ransomware](/stories/ransomware)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -93,8 +140,6 @@ False positives should be limited as this is restricted to the Rclone process na
| 35.0 | 50 | 70 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to connect to a remote cloud service to move files or folders. |
-
-
#### Reference
* [https://redcanary.com/blog/rclone-mega-extortion/](https://redcanary.com/blog/rclone-mega-extortion/)
@@ -105,7 +150,7 @@ False positives should be limited as this is restricted to the Rclone process na
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-11-29-possible_lateral_movement_powershell_spawn.md b/docs/_posts/2021-11-29-possible_lateral_movement_powershell_spawn.md
index 6143761d87..35abe42876 100644
--- a/docs/_posts/2021-11-29-possible_lateral_movement_powershell_spawn.md
+++ b/docs/_posts/2021-11-29-possible_lateral_movement_powershell_spawn.md
@@ -45,16 +45,21 @@ tags:
The following analytic assists with identifying a PowerShell process spawned as a child or grand child process of commonly abused processes during lateral movement techniques including `services.exe`, `wmiprsve.exe`, `svchost.exe`, `wsmprovhost.exe` and `mmc.exe`. Legitimate Windows features such as the Service Control Manager, Windows Management Instrumentation, Task Scheduler, Windows Remote Management and the DCOM protocol can be abused to start a process on a remote endpoint. Looking for PowerShell spawned out of this processes may reveal a lateral movement attack. Red Teams and adversaries alike may abuse these services during a breach for lateral movement and remote code execution.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-11-29
- **Author**: Mauricio Velazco, Splunk
- **ID**: cb909b3e-512b-11ec-aa31-3e22fbd008af
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -72,6 +77,51 @@ The following analytic assists with identifying a PowerShell process spawned as
| [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -85,10 +135,10 @@ The following analytic assists with identifying a PowerShell process spawned as
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `possible_lateral_movement_powershell_spawn_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **possible_lateral_movement_powershell_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -116,9 +166,6 @@ Legitimate applications may spawn PowerShell as a child process of the the ident
* [Malicious PowerShell](/stories/malicious_powershell)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -128,8 +175,6 @@ Legitimate applications may spawn PowerShell as a child process of the the ident
| 45.0 | 90 | 50 | A PowerShell process was spawned as a child process of typically abused processes on $dest$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1021/003](https://attack.mitre.org/techniques/T1021/003)
@@ -141,7 +186,7 @@ Legitimate applications may spawn PowerShell as a child process of the the ident
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-11-29-randomly_generated_scheduled_task_name.md b/docs/_posts/2021-11-29-randomly_generated_scheduled_task_name.md
index 4af01152ad..5c18f45018 100644
--- a/docs/_posts/2021-11-29-randomly_generated_scheduled_task_name.md
+++ b/docs/_posts/2021-11-29-randomly_generated_scheduled_task_name.md
@@ -32,16 +32,21 @@ We have not been able to test, simulate, or build datasets for this object. Use
The following hunting analytic leverages Event ID 4698, `A scheduled task was created`, to identify the creation of a Scheduled Task with a suspicious, high entropy, Task Name. To achieve this, this analytic also leverages the `ut_shannon` function from the URL ToolBox Splunk application. Red teams and adversaries alike may abuse the Task Scheduler to create and start a remote Scheduled Task and obtain remote code execution. To achieve this goal, tools like Impacket or Crapmapexec, typically create a Scheduled Task with a random task name on the victim host. This hunting analytic may help defenders identify Scheduled Tasks created as part of a lateral movement attack. The entropy threshold `ut_shannon > 3` should be customized by users. The Command field can be used to determine if the task has malicious intent or not.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-11-29
- **Author**: Mauricio Velazco, Splunk
- **ID**: 9d22a780-5165-11ec-ad4f-3e22fbd008af
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -49,6 +54,51 @@ The following hunting analytic leverages Event ID 4698, `A scheduled task was cr
| [T1053.005](https://attack.mitre.org/techniques/T1053/005/) | Scheduled Task | Execution, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -64,7 +114,7 @@ The following hunting analytic leverages Event ID 4698, `A scheduled task was cr
The SPL above uses the following Macros:
* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
-Note that `randomly_generated_scheduled_task_name_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **randomly_generated_scheduled_task_name_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +134,6 @@ Legitimate applications may use random Scheduled Task names.
* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -96,8 +143,6 @@ Legitimate applications may use random Scheduled Task names.
| 45.0 | 90 | 50 | A windows scheduled task with a suspicious task name was created on $dest$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1053/005/](https://attack.mitre.org/techniques/T1053/005/)
@@ -107,7 +152,7 @@ Legitimate applications may use random Scheduled Task names.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-11-29-randomly_generated_windows_service_name.md b/docs/_posts/2021-11-29-randomly_generated_windows_service_name.md
index fcf95ad060..b373d1d58f 100644
--- a/docs/_posts/2021-11-29-randomly_generated_windows_service_name.md
+++ b/docs/_posts/2021-11-29-randomly_generated_windows_service_name.md
@@ -30,16 +30,21 @@ We have not been able to test, simulate, or build datasets for this object. Use
The following hunting analytic leverages Event ID 7045, `A new service was installed in the system`, to identify the installation of a Windows Service with a suspicious, high entropy, Service Name. To achieve this, this analytic also leverages the `ut_shannon` function from the URL ToolBox Splunk application. Red teams and adversaries alike may abuse the Service Control Manager to create and start a remote Windows Service and obtain remote code execution. To achieve this goal, some tools like Metasploit, Cobalt Strike and Impacket, typically create a Windows Service with a random service name on the victim host. This hunting analytic may help defenders identify Windows Services installed as part of a lateral movement attack. The entropy threshold `ut_shannon > 3` should be customized by users. The Service_File_Name field can be used to determine if the Windows Service has malicious intent or not.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-11-29
- **Author**: Mauricio Velazco, Splunk
- **ID**: 2032a95a-5165-11ec-a2c3-3e22fbd008af
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -47,6 +52,51 @@ The following hunting analytic leverages Event ID 7045, `A new service was insta
| [T1543.003](https://attack.mitre.org/techniques/T1543/003/) | Windows Service | Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -61,7 +111,7 @@ The following hunting analytic leverages Event ID 7045, `A new service was insta
The SPL above uses the following Macros:
* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml)
-Note that `randomly_generated_windows_service_name_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **randomly_generated_windows_service_name_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -83,9 +133,6 @@ Legitimate applications may use random Windows Service names.
* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -95,8 +142,6 @@ Legitimate applications may use random Windows Service names.
| 45.0 | 90 | 50 | A Windows Service with a suspicious service name was installed on $ComputerName$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1543/003/](https://attack.mitre.org/techniques/T1543/003/)
@@ -104,7 +149,7 @@ Legitimate applications may use random Windows Service names.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-12-01-unusual_number_of_computer_service_tickets_requested.md b/docs/_posts/2021-12-01-unusual_number_of_computer_service_tickets_requested.md
index 2e3b47ea0f..ccf60fde95 100644
--- a/docs/_posts/2021-12-01-unusual_number_of_computer_service_tickets_requested.md
+++ b/docs/_posts/2021-12-01-unusual_number_of_computer_service_tickets_requested.md
@@ -29,21 +29,71 @@ We have not been able to test, simulate, or build datasets for this object. Use
The following hunting analytic leverages Event ID 4769, `A Kerberos service ticket was requested`, to identify an unusual number of computer service ticket requests from one source. When a domain joined endpoint connects to a remote endpoint, it first will request a Kerberos Ticket with the computer name as the Service Name. An endpoint requesting a large number of computer service tickets for different endpoints could represent malicious behavior like lateral movement, malware staging, reconnaissance, etc.\
The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of service requests. To customize this analytic, users can try different combinations of the `bucket` span time, the calculation of the `upperBound` field as well as the Outlier calculation. This logic can be used for real time security monitoring as well as threat hunting exercises.\
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-12-01
- **Author**: Mauricio Velazco, Splunk
- **ID**: ac3b81c0-52f4-11ec-ac44-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -60,7 +110,7 @@ The detection calculates the standard deviation for each host and leverages the
The SPL above uses the following Macros:
* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
-Note that `unusual_number_of_computer_service_tickets_requested_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **unusual_number_of_computer_service_tickets_requested_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -82,9 +132,6 @@ An single endpoint requesting a large number of computer service tickets is not
* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -94,8 +141,6 @@ An single endpoint requesting a large number of computer service tickets is not
| 42.0 | 70 | 60 | |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1078/](https://attack.mitre.org/techniques/T1078/)
@@ -103,7 +148,7 @@ An single endpoint requesting a large number of computer service tickets is not
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-12-01-unusual_number_of_remote_endpoint_authentication_events.md b/docs/_posts/2021-12-01-unusual_number_of_remote_endpoint_authentication_events.md
index af522dcfe5..4ddabc750f 100644
--- a/docs/_posts/2021-12-01-unusual_number_of_remote_endpoint_authentication_events.md
+++ b/docs/_posts/2021-12-01-unusual_number_of_remote_endpoint_authentication_events.md
@@ -29,21 +29,71 @@ We have not been able to test, simulate, or build datasets for this object. Use
The following hunting analytic leverages Event ID 4624, `An account was successfully logged on`, to identify an unusual number of remote authentication attempts coming from one source. An endpoint authenticating to a large number of remote endpoints could represent malicious behavior like lateral movement, malware staging, reconnaissance, etc.\
The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual high number of authentication events. To customize this analytic, users can try different combinations of the `bucket` span time, the calculation of the `upperBound` field as well as the Outlier calculation. This logic can be used for real time security monitoring as well as threat hunting exercises.\
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-12-01
- **Author**: Mauricio Velazco, Splunk
- **ID**: acb5dc74-5324-11ec-a36d-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -61,7 +111,7 @@ The detection calculates the standard deviation for each host and leverages the
The SPL above uses the following Macros:
* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
-Note that `unusual_number_of_remote_endpoint_authentication_events_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **unusual_number_of_remote_endpoint_authentication_events_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -83,9 +133,6 @@ An single endpoint authenticating to a large number of hosts is not common behav
* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -95,8 +142,6 @@ An single endpoint authenticating to a large number of hosts is not common behav
| 42.0 | 70 | 60 | |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1078/](https://attack.mitre.org/techniques/T1078/)
@@ -104,7 +149,7 @@ An single endpoint authenticating to a large number of hosts is not common behav
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-12-03-short_lived_scheduled_task.md b/docs/_posts/2021-12-03-short_lived_scheduled_task.md
index 2e9be2c098..2e30129165 100644
--- a/docs/_posts/2021-12-03-short_lived_scheduled_task.md
+++ b/docs/_posts/2021-12-03-short_lived_scheduled_task.md
@@ -25,21 +25,71 @@ tags:
The following analytic leverages Windows Security EventCode 4698, `A scheduled task was created` and Windows Security EventCode 4699, `A scheduled task was deleted` to identify scheduled tasks created and deleted in less than 30 seconds. This behavior may represent a lateral movement attack abusing the Task Scheduler to obtain code execution. Red Teams and adversaries alike may abuse the Task Scheduler for lateral movement and remote code execution.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-12-03
- **Author**: Mauricio Velazco, Splunk
- **ID**: 6fa31414-546e-11ec-adfa-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1053.005](https://attack.mitre.org/techniques/T1053/005/) | Scheduled Task | Execution, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -56,7 +106,7 @@ The following analytic leverages Windows Security EventCode 4698, `A scheduled t
The SPL above uses the following Macros:
* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
-Note that `short_lived_scheduled_task_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **short_lived_scheduled_task_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -78,9 +128,6 @@ Although uncommon, legitimate applications may create and delete a Scheduled Tas
* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -90,8 +137,6 @@ Although uncommon, legitimate applications may create and delete a Scheduled Tas
| 81.0 | 90 | 90 | A windows scheduled task was created and deleted in 30 seconds on $ComputerName$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1053/005/](https://attack.mitre.org/techniques/T1053/005/)
@@ -100,7 +145,7 @@ Although uncommon, legitimate applications may create and delete a Scheduled Tas
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-12-06-suspicious_linux_discovery_commands.md b/docs/_posts/2021-12-06-suspicious_linux_discovery_commands.md
index 2d995f3691..2036a963e1 100644
--- a/docs/_posts/2021-12-06-suspicious_linux_discovery_commands.md
+++ b/docs/_posts/2021-12-06-suspicious_linux_discovery_commands.md
@@ -25,21 +25,71 @@ tags:
This search, detects execution of suspicious bash commands from various commonly leveraged bash scripts like (AutoSUID, LinEnum, LinPeas) to perform discovery of possible paths of privilege execution, password files, vulnerable directories, executables and file permissions on a Linux host.\
The search logic specifically looks for high number of distinct commands run in a short period of time.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-12-06
- **Author**: Bhavin Patel, Splunk
- **ID**: 0edd5112-56c9-11ec-b990-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1059.004](https://attack.mitre.org/techniques/T1059/004/) | Unix Shell | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +107,10 @@ The search logic specifically looks for high number of distinct commands run in
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `suspicious_linux_discovery_commands_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **suspicious_linux_discovery_commands_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -80,9 +130,6 @@ Unless an administrator is using these commands to troubleshoot or audit a syste
* [Linux Post-Exploitation](/stories/linux_post-exploitation)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -92,8 +139,6 @@ Unless an administrator is using these commands to troubleshoot or audit a syste
| 81.0 | 90 | 90 | Suspicious Linux Discovery Commands detected on $dest$ |
-
-
#### Reference
* [https://attack.mitre.org/matrices/enterprise/linux/](https://attack.mitre.org/matrices/enterprise/linux/)
@@ -105,7 +150,7 @@ Unless an administrator is using these commands to troubleshoot or audit a syste
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-12-07-ms_exchange_mailbox_replication_service_writing_active_server_pages.md b/docs/_posts/2021-12-07-ms_exchange_mailbox_replication_service_writing_active_server_pages.md
index bd6e8908b1..55b2b6652c 100644
--- a/docs/_posts/2021-12-07-ms_exchange_mailbox_replication_service_writing_active_server_pages.md
+++ b/docs/_posts/2021-12-07-ms_exchange_mailbox_replication_service_writing_active_server_pages.md
@@ -32,16 +32,21 @@ We have not been able to test, simulate, or build datasets for this object. Use
The following query identifies suspicious .aspx created in 3 paths identified by Microsoft as known drop locations for Exchange exploitation related to HAFNIUM group and recently disclosed vulnerablity named ProxyShell. Paths include: `\HttpProxy\owa\auth\`, `\inetpub\wwwroot\aspnet_client\`, and `\HttpProxy\OAB\`. The analytic is limited to process name MSExchangeMailboxReplication.exe, which typically does not write .aspx files to disk. Upon triage, the suspicious .aspx file will likely look obvious on the surface. inspect the contents for script code inside. Identify additional log sources, IIS included, to review source and other potential exploitation. It is often the case that a particular threat is only applicable to a specific subset of systems in your environment. Typically analytics to detect those threats are written without the benefit of being able to only target those systems as well. Writing analytics against all systems when those behaviors are limited to identifiable subsets of those systems is suboptimal. Consider the case ProxyShell vulnerability on Microsoft Exchange Servers. With asset information, a hunter can limit their analytics to systems that have been identified as Exchange servers. A hunter may start with the theory that the exchange server is communicating with new systems that it has not previously. If this theory is run against all publicly facing systems, the amount of noise it will generate will likely render this theory untenable. However, using the asset information to limit this analytic to just the Exchange servers will reduce the noise allowing the hunter to focus only on the systems where this behavioral change is relevant.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-12-07
- **Author**: Michael Haag, Splunk
- **ID**: 985f322c-57a5-11ec-b9ac-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -51,6 +56,51 @@ The following query identifies suspicious .aspx created in 3 paths identified by
| [T1190](https://attack.mitre.org/techniques/T1190/) | Exploit Public-Facing Application | Initial Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -70,7 +120,7 @@ The following query identifies suspicious .aspx created in 3 paths identified by
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `ms_exchange_mailbox_replication_service_writing_active_server_pages_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **ms_exchange_mailbox_replication_service_writing_active_server_pages_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -97,9 +147,6 @@ The query is structured in a way that `action` (read, create) is not defined. Re
* [Ransomware](/stories/ransomware)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -109,8 +156,6 @@ The query is structured in a way that `action` (read, create) is not defined. Re
| 81.0 | 90 | 90 | A file - $file_name$ was written to disk that is related to IIS exploitation related to ProxyShell. Review further file modifications on endpoint $dest$ by user $user$. |
-
-
#### Reference
* [https://redcanary.com/blog/blackbyte-ransomware/](https://redcanary.com/blog/blackbyte-ransomware/)
@@ -118,7 +163,7 @@ The query is structured in a way that `action` (read, create) is not defined. Re
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-12-07-windows_raccine_scheduled_task_deletion.md b/docs/_posts/2021-12-07-windows_raccine_scheduled_task_deletion.md
index 5078e0885f..f299a1bfef 100644
--- a/docs/_posts/2021-12-07-windows_raccine_scheduled_task_deletion.md
+++ b/docs/_posts/2021-12-07-windows_raccine_scheduled_task_deletion.md
@@ -24,21 +24,71 @@ tags:
The following analytic identifies the Raccine Rules Updater scheduled task being deleted. Adversaries may attempt to remove this task in order to prevent the update of Raccine. Raccine is a "ransomware vaccine" created by security researcher Florian Roth, designed to intercept and prevent precursors and active ransomware behavior.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-12-07
- **Author**: Michael Haag, Splunk
- **ID**: c9f010da-57ab-11ec-82bd-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +102,10 @@ The following analytic identifies the Raccine Rules Updater scheduled task being
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `windows_raccine_scheduled_task_deletion_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **windows_raccine_scheduled_task_deletion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -82,9 +132,6 @@ False positives should be limited, however filter as needed.
* [Ransomware](/stories/ransomware)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -94,8 +141,6 @@ False positives should be limited, however filter as needed.
| 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user user$ attempting to disable Raccines scheduled task. |
-
-
#### Reference
* [https://redcanary.com/blog/blackbyte-ransomware/](https://redcanary.com/blog/blackbyte-ransomware/)
@@ -104,7 +149,7 @@ False positives should be limited, however filter as needed.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md b/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md
index a154d93732..dfc9568416 100644
--- a/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md
+++ b/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md
@@ -36,16 +36,21 @@ The following hunting analytic identifies `msi.dll` being loaded by a binary not
1. Racing to introduce a junction and a symlink to trick msiexec.exe to modify the attacker specified file. \
In addition, `msi.dll` has been abused in DLL side-loading attacks by being loaded by non-system binaries.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-12-08
- **Author**: Michael Haag, Splunk
- **ID**: ccb98a66-5851-11ec-b91c-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -53,6 +58,55 @@ In addition, `msi.dll` has been abused in DLL side-loading attacks by being load
| [T1574](https://attack.mitre.org/techniques/T1574/) | Hijack Execution Flow | Defense Evasion, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -65,10 +119,10 @@ In addition, `msi.dll` has been abused in DLL side-loading attacks by being load
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `msi_module_loaded_by_non-system_binary_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **msi_module_loaded_by_non-system_binary_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -90,9 +144,6 @@ It is possible some Administrative utilities will load msi.dll outside of normal
* [Windows Privilege Escalation](/stories/windows_privilege_escalation)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -102,14 +153,6 @@ It is possible some Administrative utilities will load msi.dll outside of normal
| 56.0 | 80 | 70 | The following module $ImageLoaded$ was loaded by $Image$ outside of the normal system paths on endpoint $Computer$, potentally related to DLL side-loading. |
-#### CVE
-
-| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
-| ----------- | ----------- | -------------- |
-| [CVE-2021-41379](https://nvd.nist.gov/vuln/detail/CVE-2021-41379) | Windows Installer Elevation of Privilege Vulnerability | 4.6 |
-
-
-
#### Reference
* [https://attackerkb.com/topics/7LstI2clmF/cve-2021-41379/rapid7-analysis](https://attackerkb.com/topics/7LstI2clmF/cve-2021-41379/rapid7-analysis)
@@ -119,7 +162,7 @@ It is possible some Administrative utilities will load msi.dll outside of normal
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-12-10-curl_download_and_bash_execution.md b/docs/_posts/2021-12-10-curl_download_and_bash_execution.md
index 380285d4db..9d5565668b 100644
--- a/docs/_posts/2021-12-10-curl_download_and_bash_execution.md
+++ b/docs/_posts/2021-12-10-curl_download_and_bash_execution.md
@@ -25,21 +25,75 @@ tags:
The following analytic identifies the use of curl on Linux or MacOS attempting to download a file from a remote source and pipe it to bash. This is typically found with coinminers and most recently with CVE-2021-44228, a vulnerability in Log4j.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-12-10
- **Author**: Michael Haag, Splunk
- **ID**: 900bc324-59f3-11ec-9fb4-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
+| ----------- | ----------- | -------------- |
+| [CVE-2021-41379](https://nvd.nist.gov/vuln/detail/CVE-2021-41379) | Windows Installer Elevation of Privilege Vulnerability | 4.6 |
+
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1105](https://attack.mitre.org/techniques/T1105/) | Ingress Tool Transfer | Command And Control |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -54,10 +108,10 @@ The following analytic identifies the use of curl on Linux or MacOS attempting t
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `curl_download_and_bash_execution_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **curl_download_and_bash_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +138,6 @@ False positives should be limited, however filtering may be required.
* [Log4Shell CVE-2021-44228](/stories/log4shell_cve-2021-44228)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -96,14 +147,6 @@ False positives should be limited, however filtering may be required.
| 80.0 | 80 | 100 | An instance of $process_name$ was identified on endpoint $dest$ attempting to download a remote file and run it with bash. |
-#### CVE
-
-| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
-| ----------- | ----------- | -------------- |
-| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 |
-
-
-
#### Reference
* [https://www.huntress.com/blog/rapid-response-critical-rce-vulnerability-is-affecting-java](https://www.huntress.com/blog/rapid-response-critical-rce-vulnerability-is-affecting-java)
@@ -113,7 +156,7 @@ False positives should be limited, however filtering may be required.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-12-11-wget_download_and_bash_execution.md b/docs/_posts/2021-12-11-wget_download_and_bash_execution.md
index 6edd380484..d1767dc18e 100644
--- a/docs/_posts/2021-12-11-wget_download_and_bash_execution.md
+++ b/docs/_posts/2021-12-11-wget_download_and_bash_execution.md
@@ -25,21 +25,75 @@ tags:
The following analytic identifies the use of wget on Linux or MacOS attempting to download a file from a remote source and pipe it to bash. This is typically found with coinminers and most recently with CVE-2021-44228, a vulnerability in Log4j.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-12-11
- **Author**: Michael Haag, Splunk
- **ID**: 35682718-5a85-11ec-b8f7-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
+| ----------- | ----------- | -------------- |
+| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 |
+
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1105](https://attack.mitre.org/techniques/T1105/) | Ingress Tool Transfer | Command And Control |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -54,10 +108,10 @@ The following analytic identifies the use of wget on Linux or MacOS attempting t
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `wget_download_and_bash_execution_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **wget_download_and_bash_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +138,6 @@ False positives should be limited, however filtering may be required.
* [Log4Shell CVE-2021-44228](/stories/log4shell_cve-2021-44228)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -96,14 +147,6 @@ False positives should be limited, however filtering may be required.
| 80.0 | 80 | 100 | An instance of $process_name$ was identified on endpoint $dest$ attempting to download a remote file and run it with bash. |
-#### CVE
-
-| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
-| ----------- | ----------- | -------------- |
-| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 |
-
-
-
#### Reference
* [https://www.huntress.com/blog/rapid-response-critical-rce-vulnerability-is-affecting-java](https://www.huntress.com/blog/rapid-response-critical-rce-vulnerability-is-affecting-java)
@@ -113,7 +156,7 @@ False positives should be limited, however filtering may be required.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-12-13-detect_outbound_ldap_traffic.md b/docs/_posts/2021-12-13-detect_outbound_ldap_traffic.md
index 2b06e6fc97..807b21055f 100644
--- a/docs/_posts/2021-12-13-detect_outbound_ldap_traffic.md
+++ b/docs/_posts/2021-12-13-detect_outbound_ldap_traffic.md
@@ -28,16 +28,21 @@ tags:
Malicious actors often abuse misconfigured LDAP servers or applications that use the LDAP servers in organizations. Outbound LDAP traffic should not be allowed outbound through your perimeter firewall. This search will help determine if you have any LDAP connections to IP addresses outside of private (RFC1918) address space.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic)
-
- **Last Updated**: 2021-12-13
- **Author**: Bhavin Patel, Johan Bjerke, Splunk
- **ID**: 5e06e262-d7cd-4216-b2f8-27b437e18458
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
+| ----------- | ----------- | -------------- |
+| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 |
+
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -45,6 +50,64 @@ Malicious actors often abuse misconfigured LDAP servers or applications that use
| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Command & Control
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.DS
+* PR.PT
+* DE.AE
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 12
+* CIS 13
+
+
+
+
+
+
+
#### Search
```
@@ -61,7 +124,7 @@ Malicious actors often abuse misconfigured LDAP servers or applications that use
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_outbound_ldap_traffic_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_outbound_ldap_traffic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -80,10 +143,6 @@ Unknown at this moment. Outbound LDAP traffic should not be allowed outbound thr
* [Log4Shell CVE-2021-44228](/stories/log4shell_cve-2021-44228)
-#### Kill Chain Phase
-* Command & Control
-* Actions on Objectives
-
#### RBA
@@ -93,14 +152,6 @@ Unknown at this moment. Outbound LDAP traffic should not be allowed outbound thr
| 56.0 | 70 | 80 | An outbound LDAP connection from $src_ip$ in your infrastructure connecting to dest ip $dest_ip$ |
-#### CVE
-
-| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
-| ----------- | ----------- | -------------- |
-| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 |
-
-
-
#### Reference
* [https://www.govcert.ch/blog/zero-day-exploit-targeting-popular-java-library-log4j/](https://www.govcert.ch/blog/zero-day-exploit-targeting-popular-java-library-log4j/)
@@ -108,7 +159,7 @@ Unknown at this moment. Outbound LDAP traffic should not be allowed outbound thr
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-12-13-java_class_file_download_by_java_user_agent.md b/docs/_posts/2021-12-13-java_class_file_download_by_java_user_agent.md
index 7c7638d37b..967b055754 100644
--- a/docs/_posts/2021-12-13-java_class_file_download_by_java_user_agent.md
+++ b/docs/_posts/2021-12-13-java_class_file_download_by_java_user_agent.md
@@ -25,21 +25,75 @@ tags:
The following analytic identifies a Java user agent performing a GET request for a .class file from the remote site. This is potentially indicative of exploitation of the Java application and may be related to current event CVE-2021-44228 (Log4Shell).
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Web](https://docs.splunk.com/Documentation/CIM/latest/User/Web)
-
- **Last Updated**: 2021-12-13
- **Author**: Michael Haag, Splunk
- **ID**: 8281ce42-5c50-11ec-82d2-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
+| ----------- | ----------- | -------------- |
+| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 |
+
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1190](https://attack.mitre.org/techniques/T1190/) | Exploit Public-Facing Application | Initial Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -55,7 +109,7 @@ The following analytic identifies a Java user agent performing a GET request for
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `java_class_file_download_by_java_user_agent_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **java_class_file_download_by_java_user_agent_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -77,9 +131,6 @@ Filtering may be required in some instances, filter as needed.
* [Log4Shell CVE-2021-44228](/stories/log4shell_cve-2021-44228)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -89,14 +140,6 @@ Filtering may be required in some instances, filter as needed.
| 40.0 | 80 | 50 | A Java user agent $http_user_agent$ was performing a $http_method$ to retrieve a remote class file. |
-#### CVE
-
-| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
-| ----------- | ----------- | -------------- |
-| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 |
-
-
-
#### Reference
* [https://arstechnica.com/information-technology/2021/12/as-log4shell-wreaks-havoc-payroll-service-reports-ransomware-attack/](https://arstechnica.com/information-technology/2021/12/as-log4shell-wreaks-havoc-payroll-service-reports-ransomware-attack/)
@@ -104,7 +147,7 @@ Filtering may be required in some instances, filter as needed.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-12-13-linux_java_spawning_shell.md b/docs/_posts/2021-12-13-linux_java_spawning_shell.md
index 1e7d55e0ae..f2694b1706 100644
--- a/docs/_posts/2021-12-13-linux_java_spawning_shell.md
+++ b/docs/_posts/2021-12-13-linux_java_spawning_shell.md
@@ -25,21 +25,75 @@ tags:
The following analytic identifies the process name of Java, Apache, or Tomcat spawning a Linux shell. This is potentially indicative of exploitation of the Java application and may be related to current event CVE-2021-44228 (Log4Shell). The shells included in the macro are "sh", "ksh", "zsh", "bash", "dash", "rbash", "fish", "csh', "tcsh', "ion", "eshell". Upon triage, review parallel processes and command-line arguments to determine legitimacy.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-12-13
- **Author**: Michael Haag, Splunk
- **ID**: 7b09db8a-5c20-11ec-9945-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
+| ----------- | ----------- | -------------- |
+| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 |
+
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1190](https://attack.mitre.org/techniques/T1190/) | Exploit Public-Facing Application | Initial Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -53,11 +107,11 @@ The following analytic identifies the process name of Java, Apache, or Tomcat sp
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [linux_shells](https://github.com/splunk/security_content/blob/develop/macros/linux_shells.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `linux_java_spawning_shell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **linux_java_spawning_shell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +138,6 @@ Filtering may be required on internal developer build systems or classify assets
* [Log4Shell CVE-2021-44228](/stories/log4shell_cve-2021-44228)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -96,14 +147,6 @@ Filtering may be required on internal developer build systems or classify assets
| 40.0 | 80 | 50 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ spawning a Linux shell, potentially indicative of exploitation. |
-#### CVE
-
-| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
-| ----------- | ----------- | -------------- |
-| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 |
-
-
-
#### Reference
* [https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/](https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/)
@@ -112,7 +155,7 @@ Filtering may be required on internal developer build systems or classify assets
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_attempt.md b/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_attempt.md
index 981c5402a7..a73fcd86c1 100644
--- a/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_attempt.md
+++ b/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_attempt.md
@@ -25,21 +25,82 @@ tags:
CVE-2021-44228 Log4Shell payloads can be injected via various methods, but on of the most common vectors injection is via Web calls. Many of the vulnerable java web applications that are using log4j have a web component to them are specially targets of this injection, specifically projects like Apache Struts, Flink, Druid, and Solr. The exploit is triggered by a LDAP lookup function in the log4j package, its invocation is similar to `${jndi:ldap://PAYLOAD_INJECTED}`, when executed against vulnerable web applications the invocation can be seen in various part of web logs. Specifically it has been successfully exploited via headers like X-Forwarded-For, User-Agent, Referer, and X-Api-Version. In this detection we first limit the scope of our search to the Web Datamodel and use the `| from datamodel` function to benefit from schema accelerated searching capabilities, mainly because the second part of the detection is pretty heavy, it runs a regex across all _raw events that looks for `${jndi:ldap://` pattern across all potential web fields available to the raw data, like http headers for example. If you see results for this detection, it means that there was a attempt at a injection, which could be a reconnaissance activity or a valid expliotation attempt, but this does not exactly mean that the host was indeed successfully exploited.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Web](https://docs.splunk.com/Documentation/CIM/latest/User/Web)
-
- **Last Updated**: 2021-12-13
- **Author**: Jose Hernandez
- **ID**: c184f12e-5c90-11ec-bf1f-497c9a704a72
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
+| ----------- | ----------- | -------------- |
+| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 |
+
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1190](https://attack.mitre.org/techniques/T1190/) | Exploit Public-Facing Application | Initial Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -58,7 +119,7 @@ CVE-2021-44228 Log4Shell payloads can be injected via various methods, but on of
#### Macros
The SPL above uses the following Macros:
-Note that `log4shell_jndi_payload_injection_attempt_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **log4shell_jndi_payload_injection_attempt_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* action
@@ -86,10 +147,6 @@ If there is a vulnerablility scannner looking for log4shells this will trigger,
* [Log4Shell CVE-2021-44228](/stories/log4shell_cve-2021-44228)
-#### Kill Chain Phase
-* Reconnaissance
-* Exploitation
-
#### RBA
@@ -99,14 +156,6 @@ If there is a vulnerablility scannner looking for log4shells this will trigger,
| 15.0 | 50 | 30 | CVE-2021-44228 Log4Shell triggered for host $dest$ |
-#### CVE
-
-| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
-| ----------- | ----------- | -------------- |
-| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 |
-
-
-
#### Reference
* [https://www.lunasec.io/docs/blog/log4j-zero-day/](https://www.lunasec.io/docs/blog/log4j-zero-day/)
@@ -114,7 +163,7 @@ If there is a vulnerablility scannner looking for log4shells this will trigger,
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md b/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md
index 926d2be5e8..f7896912d1 100644
--- a/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md
+++ b/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md
@@ -26,21 +26,81 @@ tags:
CVE-2021-44228 Log4Shell payloads can be injected via various methods, but on of the most common vectors injection is via Web calls. Many of the vulnerable java web applications that are using log4j have a web component to them are specially targets of this injection, specifically projects like Apache Struts, Flink, Druid, and Solr. The exploit is triggered by a LDAP lookup function in the log4j package, its invocation is similar to `${jndi:ldap://PAYLOAD_INJECTED}`, when executed against vulnerable web applications the invocation can be seen in various part of web logs. Specifically it has been successfully exploited via headers like X-Forwarded-For, User-Agent, Referer, and X-Api-Version. In this detection we match the invocation function with a network connection to a malicious ip address.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic), [Web](https://docs.splunk.com/Documentation/CIM/latest/User/Web)
-
- **Last Updated**: 2021-12-13
- **Author**: Jose Hernandez
- **ID**: 69afee44-5c91-11ec-bf1f-497c9a704a72
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
+| ----------- | ----------- | -------------- |
+| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 |
+
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1190](https://attack.mitre.org/techniques/T1190/) | Exploit Public-Facing Application | Initial Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -64,10 +124,10 @@ CVE-2021-44228 Log4Shell payloads can be injected via various methods, but on of
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `log4shell_jndi_payload_injection_with_outbound_connection_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **log4shell_jndi_payload_injection_with_outbound_connection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* action
@@ -95,9 +155,6 @@ If there is a vulnerablility scannner looking for log4shells this will trigger,
* [Log4Shell CVE-2021-44228](/stories/log4shell_cve-2021-44228)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -107,14 +164,6 @@ If there is a vulnerablility scannner looking for log4shells this will trigger,
| 15.0 | 50 | 30 | CVE-2021-44228 Log4Shell triggered for host $dest$ |
-#### CVE
-
-| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
-| ----------- | ----------- | -------------- |
-| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 |
-
-
-
#### Reference
* [https://www.lunasec.io/docs/blog/log4j-zero-day/](https://www.lunasec.io/docs/blog/log4j-zero-day/)
@@ -122,7 +171,7 @@ If there is a vulnerablility scannner looking for log4shells this will trigger,
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-12-13-outbound_network_connection_from_java_using_default_ports.md b/docs/_posts/2021-12-13-outbound_network_connection_from_java_using_default_ports.md
index 64f9524f73..898543d1d4 100644
--- a/docs/_posts/2021-12-13-outbound_network_connection_from_java_using_default_ports.md
+++ b/docs/_posts/2021-12-13-outbound_network_connection_from_java_using_default_ports.md
@@ -24,21 +24,75 @@ tags:
A required step while exploiting the CVE-2021-44228-Log4j vulnerability is that the victim server will perform outbound connections to attacker-controlled infrastructure. This is required as part of the JNDI lookup as well as for retrieving the second stage .class payload. The following analytic identifies the Java process reaching out to default ports used by the LDAP and RMI protocols. This behavior could represent successfull exploitation. Note that adversaries can easily decide to use arbitrary ports for these protocols and potentially bypass this detection.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2021-12-13
- **Author**: Mauricio Velazco, Splunk
- **ID**: d2c14d28-5c47-11ec-9892-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
+| ----------- | ----------- | -------------- |
+| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 |
+
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1190](https://attack.mitre.org/techniques/T1190/) | Exploit Public-Facing Application | Initial Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +111,10 @@ A required step while exploiting the CVE-2021-44228-Log4j vulnerability is that
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `outbound_network_connection_from_java_using_default_ports_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **outbound_network_connection_from_java_using_default_ports_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -85,9 +139,6 @@ Legitimate Java applications may use perform outbound connections to these ports
* [Log4Shell CVE-2021-44228](/stories/log4shell_cve-2021-44228)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -97,14 +148,6 @@ Legitimate Java applications may use perform outbound connections to these ports
| 54.0 | 90 | 60 | Java performed outbound connections to default ports of LDAP or RMI on $dest$ |
-#### CVE
-
-| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
-| ----------- | ----------- | -------------- |
-| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 |
-
-
-
#### Reference
* [https://www.lunasec.io/docs/blog/log4j-zero-day/](https://www.lunasec.io/docs/blog/log4j-zero-day/)
@@ -113,7 +156,7 @@ Legitimate Java applications may use perform outbound connections to these ports
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-12-13-windows_java_spawning_shells.md b/docs/_posts/2021-12-13-windows_java_spawning_shells.md
index 9454cf32d5..81c9aec0fc 100644
--- a/docs/_posts/2021-12-13-windows_java_spawning_shells.md
+++ b/docs/_posts/2021-12-13-windows_java_spawning_shells.md
@@ -27,21 +27,75 @@ We have not been able to test, simulate, or build datasets for this object. Use
The following analytic identifies the process name of java.exe and w3wp.exe spawning a Windows shell. This is potentially indicative of exploitation of the Java application and may be related to current event CVE-2021-44228 (Log4Shell). The shells included in the macro are "cmd.exe", "powershell.exe". Upon triage, review parallel processes and command-line arguments to determine legitimacy.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-12-13
- **Author**: Michael Haag, Splunk
- **ID**: 28c81306-5c47-11ec-bfea-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
+| ----------- | ----------- | -------------- |
+| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 |
+
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1190](https://attack.mitre.org/techniques/T1190/) | Exploit Public-Facing Application | Initial Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -55,11 +109,11 @@ The following analytic identifies the process name of java.exe and w3wp.exe spaw
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [windows_shells](https://github.com/splunk/security_content/blob/develop/macros/windows_shells.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `windows_java_spawning_shells_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **windows_java_spawning_shells_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -86,9 +140,6 @@ Filtering may be required on internal developer build systems or classify assets
* [Log4Shell CVE-2021-44228](/stories/log4shell_cve-2021-44228)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -98,14 +149,6 @@ Filtering may be required on internal developer build systems or classify assets
| 40.0 | 80 | 50 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ spawning a Windows shell, potentially indicative of exploitation. |
-#### CVE
-
-| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
-| ----------- | ----------- | -------------- |
-| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 |
-
-
-
#### Reference
* [https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/](https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/)
@@ -114,7 +157,7 @@ Filtering may be required on internal developer build systems or classify assets
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-12-14-hunting_for_log4shell.md b/docs/_posts/2021-12-14-hunting_for_log4shell.md
index 6eea555649..d60970e27e 100644
--- a/docs/_posts/2021-12-14-hunting_for_log4shell.md
+++ b/docs/_posts/2021-12-14-hunting_for_log4shell.md
@@ -35,21 +35,75 @@ lookup matching is meant to catch some basic obfuscation that has been identifie
Scoring will then occur based on any findings. The base score is meant to be 2 , created by jndi_fastmatch. Everything else is meant to increase that score. \
Finally, a simple table is created to show the scoring and the _raw field. Sort based on score or columns of interest.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Web](https://docs.splunk.com/Documentation/CIM/latest/User/Web)
-
- **Last Updated**: 2021-12-14
- **Author**: Michael Haag, Splunk
- **ID**: 158b68fa-5d1a-11ec-aac8-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
+| ----------- | ----------- | -------------- |
+| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 |
+
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1190](https://attack.mitre.org/techniques/T1190/) | Exploit Public-Facing Application | Initial Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -177,7 +231,7 @@ Finally, a simple table is created to show the scoring and the _raw field. Sort
#### Macros
The SPL above uses the following Macros:
-Note that `hunting_for_log4shell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **hunting_for_log4shell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -200,9 +254,6 @@ It is highly possible you will find false positives, however, the base score is
* [Log4Shell CVE-2021-44228](/stories/log4shell_cve-2021-44228)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -212,14 +263,6 @@ It is highly possible you will find false positives, however, the base score is
| 40.0 | 80 | 50 | Hunting for Log4Shell exploitation has occurred. |
-#### CVE
-
-| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
-| ----------- | ----------- | -------------- |
-| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 |
-
-
-
#### Reference
* [https://gist.github.com/olafhartong/916ebc673ba066537740164f7e7e1d72](https://gist.github.com/olafhartong/916ebc673ba066537740164f7e7e1d72)
@@ -233,7 +276,7 @@ It is highly possible you will find false positives, however, the base score is
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-12-17-linux_add_files_in_known_crontab_directories.md b/docs/_posts/2021-12-17-linux_add_files_in_known_crontab_directories.md
index 11104a06e3..3ad2b9f0a3 100644
--- a/docs/_posts/2021-12-17-linux_add_files_in_known_crontab_directories.md
+++ b/docs/_posts/2021-12-17-linux_add_files_in_known_crontab_directories.md
@@ -31,16 +31,21 @@ tags:
The following analytic identifies a suspicious file creation in known cron table directories. This event is commonly abuse by malware, adversaries and red teamers to persist on the target or compromised host. crontab or cronjob is like a schedule task in windows environment where you can create an executable or script on the known crontab directories to run it base on its schedule. This Anomaly query is a good indicator to look further what file is added and who added the file if to consider it legitimate file.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-12-17
- **Author**: Teoderick Contreras, Splunk
- **ID**: 023f3452-5f27-11ec-bf00-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
+| ----------- | ----------- | -------------- |
+| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 |
+
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -48,6 +53,57 @@ The following analytic identifies a suspicious file creation in known cron table
| [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -61,10 +117,10 @@ The following analytic identifies a suspicious file creation in known cron table
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `linux_add_files_in_known_crontab_directories_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **linux_add_files_in_known_crontab_directories_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -86,9 +142,6 @@ Administrator or network operator can create file in crontab folders for automat
* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -98,8 +151,6 @@ Administrator or network operator can create file in crontab folders for automat
| 25.0 | 50 | 50 | a file $file_name$ is created in $file_path$ on $dest$ |
-
-
#### Reference
* [https://www.sandflysecurity.com/blog/detecting-cronrat-malware-on-linux-instantly/](https://www.sandflysecurity.com/blog/detecting-cronrat-malware-on-linux-instantly/)
@@ -108,7 +159,7 @@ Administrator or network operator can create file in crontab folders for automat
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-12-17-linux_at_allow_config_file_creation.md b/docs/_posts/2021-12-17-linux_at_allow_config_file_creation.md
index 97bba054e3..1988954c6e 100644
--- a/docs/_posts/2021-12-17-linux_at_allow_config_file_creation.md
+++ b/docs/_posts/2021-12-17-linux_at_allow_config_file_creation.md
@@ -31,16 +31,21 @@ tags:
The following analytic identifies a suspicious file creation of /etc/at.allow or /etc/at.deny. These 2 files are commonly abused by malware, adversaries or red teamers to persist on the targeted or compromised host. These config files can restrict or allow user to execute "at" application (another schedule task application in linux). attacker can create a user or add the compromised username to that config file to execute "at" to schedule it malicious code. This anomaly detection can be a good indicator to investigate further the entry in created config file and who created it to verify if it is a false positive.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-12-17
- **Author**: Teoderick Contreras, Splunk
- **ID**: 977b3082-5f3d-11ec-b954-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -48,6 +53,57 @@ The following analytic identifies a suspicious file creation of /etc/at.allow or
| [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -61,10 +117,10 @@ The following analytic identifies a suspicious file creation of /etc/at.allow or
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `linux_at_allow_config_file_creation_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **linux_at_allow_config_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -86,9 +142,6 @@ Administrator or network operator can create this file for automation purposes.
* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -98,8 +151,6 @@ Administrator or network operator can create this file for automation purposes.
| 25.0 | 50 | 50 | A file $file_name$ is created in $file_path$ on $dest$ |
-
-
#### Reference
* [https://linuxize.com/post/at-command-in-linux/](https://linuxize.com/post/at-command-in-linux/)
@@ -107,7 +158,7 @@ Administrator or network operator can create this file for automation purposes.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-12-17-linux_at_application_execution.md b/docs/_posts/2021-12-17-linux_at_application_execution.md
index 2fdbee4543..15399f7704 100644
--- a/docs/_posts/2021-12-17-linux_at_application_execution.md
+++ b/docs/_posts/2021-12-17-linux_at_application_execution.md
@@ -31,16 +31,21 @@ tags:
The following analytic identifies a suspicious process creation of At application. This process can be used by malware, adversaries and red teamers to create persistence entry to the targeted or compromised host with their malicious code. This anomaly detection can be a good indicator to investigate the event before and after this process execution, when it was executed and what schedule task it will execute.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-12-17
- **Author**: Teoderick Contreras, Splunk
- **ID**: bf0a378e-5f3c-11ec-a6de-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -48,6 +53,57 @@ The following analytic identifies a suspicious process creation of At applicatio
| [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -61,10 +117,10 @@ The following analytic identifies a suspicious process creation of At applicatio
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `linux_at_application_execution_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **linux_at_application_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -88,9 +144,6 @@ Administrator or network operator can use this application for automation purpos
* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -100,8 +153,6 @@ Administrator or network operator can use this application for automation purpos
| 9.0 | 30 | 30 | At application was executed in $dest$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1053/001/](https://attack.mitre.org/techniques/T1053/001/)
@@ -110,7 +161,7 @@ Administrator or network operator can use this application for automation purpos
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-12-17-linux_edit_cron_table_parameter.md b/docs/_posts/2021-12-17-linux_edit_cron_table_parameter.md
index 2f77a91aae..5dcf88553e 100644
--- a/docs/_posts/2021-12-17-linux_edit_cron_table_parameter.md
+++ b/docs/_posts/2021-12-17-linux_edit_cron_table_parameter.md
@@ -31,16 +31,21 @@ tags:
The following analytic identifies a suspicious cronjobs modification using crontab edit parameter. This commandline parameter can be abuse by malware author, adversaries, and red red teamers to add cronjob entry to their malicious code to execute to the schedule they want. This event can also be executed by administrator or normal user for automation purposes so filter is needed.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-12-17
- **Author**: Teoderick Contreras, Splunk
- **ID**: 0d370304-5f26-11ec-a4bb-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -48,6 +53,57 @@ The following analytic identifies a suspicious cronjobs modification using cront
| [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -61,10 +117,10 @@ The following analytic identifies a suspicious cronjobs modification using cront
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `linux_edit_cron_table_parameter_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **linux_edit_cron_table_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -88,9 +144,6 @@ Administrator or network operator can use this application for automation purpos
* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -100,8 +153,6 @@ Administrator or network operator can use this application for automation purpos
| 9.0 | 30 | 30 | A possible crontab edit command $process$ executed on $dest$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1053/003/](https://attack.mitre.org/techniques/T1053/003/)
@@ -109,7 +160,7 @@ Administrator or network operator can use this application for automation purpos
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-12-17-linux_possible_append_command_to_at_allow_config_file.md b/docs/_posts/2021-12-17-linux_possible_append_command_to_at_allow_config_file.md
index 3138b11829..302ab92b97 100644
--- a/docs/_posts/2021-12-17-linux_possible_append_command_to_at_allow_config_file.md
+++ b/docs/_posts/2021-12-17-linux_possible_append_command_to_at_allow_config_file.md
@@ -31,16 +31,21 @@ tags:
This analytic looks for suspicious commandline that may use to append user entry to /etc/at.allow or /etc/at.deny. These 2 files are commonly abused by malware, adversaries or red teamers to persist on the targeted or compromised host. These config file can restrict user that can only execute at application (another schedule task application in linux). attacker can create a user or add the compromised username to that config file to execute at to schedule it malicious code. This anomaly detection can be a good indicator to investigate further the entry in created config file and who created it to verify if it is a false positive.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-12-17
- **Author**: Teoderick Contreras, Splunk
- **ID**: 7bc20606-5f40-11ec-a586-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -48,6 +53,57 @@ This analytic looks for suspicious commandline that may use to append user entry
| [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -61,10 +117,10 @@ This analytic looks for suspicious commandline that may use to append user entry
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `linux_possible_append_command_to_at_allow_config_file_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **linux_possible_append_command_to_at_allow_config_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -88,9 +144,6 @@ Administrator or network operator can use this commandline for automation purpos
* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -100,8 +153,6 @@ Administrator or network operator can use this commandline for automation purpos
| 9.0 | 30 | 30 | A commandline $process$ that may modify at allow config file in $dest$ |
-
-
#### Reference
* [https://linuxize.com/post/at-command-in-linux/](https://linuxize.com/post/at-command-in-linux/)
@@ -110,7 +161,7 @@ Administrator or network operator can use this commandline for automation purpos
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-12-17-linux_possible_append_cronjob_entry_on_existing_cronjob_file.md b/docs/_posts/2021-12-17-linux_possible_append_cronjob_entry_on_existing_cronjob_file.md
index 8be54e459e..473119e53b 100644
--- a/docs/_posts/2021-12-17-linux_possible_append_cronjob_entry_on_existing_cronjob_file.md
+++ b/docs/_posts/2021-12-17-linux_possible_append_cronjob_entry_on_existing_cronjob_file.md
@@ -31,16 +31,21 @@ tags:
This analytic looks for possible suspicious commandline that may use to append a code to any existing cronjob files for persistence or privilege escalation. This technique is commonly abused by malware, adversaries and red teamers to automatically execute their code within a existing or sometimes in normal cronjob script file.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-12-17
- **Author**: Teoderick Contreras, Splunk
- **ID**: b5b91200-5f27-11ec-bb4e-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -48,6 +53,57 @@ This analytic looks for possible suspicious commandline that may use to append a
| [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -61,10 +117,10 @@ This analytic looks for possible suspicious commandline that may use to append a
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `linux_possible_append_cronjob_entry_on_existing_cronjob_file_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **linux_possible_append_cronjob_entry_on_existing_cronjob_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -88,9 +144,6 @@ Administrator or network operator can use this commandline for automation purpos
* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -100,8 +153,6 @@ Administrator or network operator can use this commandline for automation purpos
| 49.0 | 70 | 70 | A commandline $process$ that may modify cronjob file in $dest$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1053/003/](https://attack.mitre.org/techniques/T1053/003/)
@@ -111,7 +162,7 @@ Administrator or network operator can use this commandline for automation purpos
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-12-17-linux_possible_cronjob_modification_with_editor.md b/docs/_posts/2021-12-17-linux_possible_cronjob_modification_with_editor.md
index e9f30e54ff..c5a8a034a7 100644
--- a/docs/_posts/2021-12-17-linux_possible_cronjob_modification_with_editor.md
+++ b/docs/_posts/2021-12-17-linux_possible_cronjob_modification_with_editor.md
@@ -31,16 +31,21 @@ tags:
This analytic looks for possible modification of cronjobs file using editor. This event is can be seen in normal user but can also be a good hunting indicator for unwanted user modifying cronjobs for possible persistence or privilege escalation.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-12-17
- **Author**: Teoderick Contreras, Splunk
- **ID**: dcc89bde-5f24-11ec-87ca-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -48,6 +53,57 @@ This analytic looks for possible modification of cronjobs file using editor. Thi
| [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -61,10 +117,10 @@ This analytic looks for possible modification of cronjobs file using editor. Thi
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `linux_possible_cronjob_modification_with_editor_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **linux_possible_cronjob_modification_with_editor_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -88,9 +144,6 @@ Administrator or network operator can use this commandline for automation purpos
* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -100,8 +153,6 @@ Administrator or network operator can use this commandline for automation purpos
| 6.0 | 20 | 30 | A commandline $process$ that may modify cronjob file using editor in $dest$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1053/003/](https://attack.mitre.org/techniques/T1053/003/)
@@ -109,7 +160,7 @@ Administrator or network operator can use this commandline for automation purpos
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-12-20-linux_file_creation_in_init_boot_directory.md b/docs/_posts/2021-12-20-linux_file_creation_in_init_boot_directory.md
index 50568f876e..ddc781bd15 100644
--- a/docs/_posts/2021-12-20-linux_file_creation_in_init_boot_directory.md
+++ b/docs/_posts/2021-12-20-linux_file_creation_in_init_boot_directory.md
@@ -29,16 +29,21 @@ tags:
This analytic looks for suspicious file creation on init system directories for automatic execution of script or file upon boot up. This technique is commonly abuse by adversaries, malware author and red teamer to persist on the targeted or compromised host. This behavior can be executed or use by an administrator or network operator to add script files or binary files as part of a task or automation. filter is needed.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-12-20
- **Author**: Teoderick Contreras, Splunk
- **ID**: 97d9cfb2-61ad-11ec-bb2d-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,57 @@ This analytic looks for suspicious file creation on init system directories for
| [T1037](https://attack.mitre.org/techniques/T1037/) | Boot or Logon Initialization Scripts | Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -59,10 +115,10 @@ This analytic looks for suspicious file creation on init system directories for
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `linux_file_creation_in_init_boot_directory_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **linux_file_creation_in_init_boot_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +140,6 @@ Administrator or network operator can create file in this folders for automation
* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -96,8 +149,6 @@ Administrator or network operator can create file in this folders for automation
| 49.0 | 70 | 70 | A file $file_name$ is created in $file_path$ on $dest$ |
-
-
#### Reference
* [https://www.intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/](https://www.intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/)
@@ -105,7 +156,7 @@ Administrator or network operator can create file in this folders for automation
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-12-20-linux_file_creation_in_profile_directory.md b/docs/_posts/2021-12-20-linux_file_creation_in_profile_directory.md
index e31030e3e6..a1e453bfe1 100644
--- a/docs/_posts/2021-12-20-linux_file_creation_in_profile_directory.md
+++ b/docs/_posts/2021-12-20-linux_file_creation_in_profile_directory.md
@@ -29,16 +29,21 @@ tags:
This analytic looks for suspicious file creation in /etc/profile.d directory to automatically execute scripts by shell upon boot up of a linux machine. This technique is commonly abused by adversaries, malware and red teamers as a persistence mechanism to the targeted or compromised host. This Anomaly detection is a good indicator that someone wants to run a code after boot up which can be done also by the administrator or network operator for automation purposes.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-12-20
- **Author**: Teoderick Contreras, Splunk
- **ID**: 46ba0082-61af-11ec-9826-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,57 @@ This analytic looks for suspicious file creation in /etc/profile.d directory to
| [T1546](https://attack.mitre.org/techniques/T1546/) | Event Triggered Execution | Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -59,10 +115,10 @@ This analytic looks for suspicious file creation in /etc/profile.d directory to
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `linux_file_creation_in_profile_directory_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **linux_file_creation_in_profile_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +140,6 @@ Administrator or network operator can create file in profile.d folders for autom
* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -96,8 +149,6 @@ Administrator or network operator can create file in profile.d folders for autom
| 56.0 | 70 | 80 | A file $file_name$ is created in $file_path$ on $dest$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1546/004/](https://attack.mitre.org/techniques/T1546/004/)
@@ -106,7 +157,7 @@ Administrator or network operator can create file in profile.d folders for autom
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-12-20-linux_possible_append_command_to_profile_config_file.md b/docs/_posts/2021-12-20-linux_possible_append_command_to_profile_config_file.md
index cc4e5c784e..2d585b9989 100644
--- a/docs/_posts/2021-12-20-linux_possible_append_command_to_profile_config_file.md
+++ b/docs/_posts/2021-12-20-linux_possible_append_command_to_profile_config_file.md
@@ -29,16 +29,21 @@ tags:
This analytic looks for suspicious command-lines that can be possibly used to modify user profile files to automatically execute scripts/executables by shell upon reboot of the machine. This technique is commonly abused by adversaries, malware and red teamers as persistence mechanism to the targeted or compromised host. This Anomaly detection is a good indicator that someone wants to run code after reboot which can be done also by the administrator or network operator for automation purposes.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-12-20
- **Author**: Teoderick Contreras, Splunk
- **ID**: 9c94732a-61af-11ec-91e3-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,57 @@ This analytic looks for suspicious command-lines that can be possibly used to mo
| [T1546](https://attack.mitre.org/techniques/T1546/) | Event Triggered Execution | Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -59,10 +115,10 @@ This analytic looks for suspicious command-lines that can be possibly used to mo
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `linux_possible_append_command_to_profile_config_file_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **linux_possible_append_command_to_profile_config_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -86,9 +142,6 @@ Administrator or network operator can use this commandline for automation purpos
* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -98,8 +151,6 @@ Administrator or network operator can use this commandline for automation purpos
| 49.0 | 70 | 70 | a commandline $process$ that may modify profile files in $dest$ |
-
-
#### Reference
* [https://unix.stackexchange.com/questions/129143/what-is-the-purpose-of-bashrc-and-how-does-it-work](https://unix.stackexchange.com/questions/129143/what-is-the-purpose-of-bashrc-and-how-does-it-work)
@@ -108,7 +159,7 @@ Administrator or network operator can use this commandline for automation purpos
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-12-20-linux_service_file_created_in_systemd_directory.md b/docs/_posts/2021-12-20-linux_service_file_created_in_systemd_directory.md
index f11c7e8c67..c8d4e2ed1e 100644
--- a/docs/_posts/2021-12-20-linux_service_file_created_in_systemd_directory.md
+++ b/docs/_posts/2021-12-20-linux_service_file_created_in_systemd_directory.md
@@ -31,16 +31,21 @@ tags:
This analytic looks for suspicious file creation in systemd timer directory in linux platform. systemd is a system and service manager for Linux distributions. From the Windows perspective, this process fulfills the duties of wininit.exe and services.exe combined. At the risk of simplifying the functionality of systemd, it initializes a Linux system and starts relevant services that are defined in service unit files. Adversaries, malware and red teamers may abuse this this feature by stashing systemd service file to persist on the targetted or compromised host.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-12-20
- **Author**: Teoderick Contreras, Splunk
- **ID**: c7495048-61b6-11ec-9a37-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -48,6 +53,57 @@ This analytic looks for suspicious file creation in systemd timer directory in l
| [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -61,10 +117,10 @@ This analytic looks for suspicious file creation in systemd timer directory in l
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `linux_service_file_created_in_systemd_directory_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **linux_service_file_created_in_systemd_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -86,9 +142,6 @@ Administrator or network operator can create file in systemd folders for automat
* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -98,8 +151,6 @@ Administrator or network operator can create file in systemd folders for automat
| 64.0 | 80 | 80 | A service file named as $file_path$ is created in systemd folder on $dest$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1053/006/](https://attack.mitre.org/techniques/T1053/006/)
@@ -110,7 +161,7 @@ Administrator or network operator can create file in systemd folders for automat
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-12-20-linux_service_restarted.md b/docs/_posts/2021-12-20-linux_service_restarted.md
index eee0bc61fc..29b47b0992 100644
--- a/docs/_posts/2021-12-20-linux_service_restarted.md
+++ b/docs/_posts/2021-12-20-linux_service_restarted.md
@@ -31,16 +31,21 @@ tags:
This analytic looks for restarted or re-enable services in linux platform. This technique can be executed or performed using systemctl or service tool application. Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions. Administrator may also create a legitimated service for a specific tool or normal application as part of task or automation, in this scenario it is suggested to look for the service path of the actual script or executable that register as service and who created the service for further verification.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-12-20
- **Author**: Teoderick Contreras, Splunk
- **ID**: 084275ba-61b8-11ec-8d64-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -48,6 +53,57 @@ This analytic looks for restarted or re-enable services in linux platform. This
| [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -61,10 +117,10 @@ This analytic looks for restarted or re-enable services in linux platform. This
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `linux_service_restarted_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **linux_service_restarted_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -88,9 +144,6 @@ Administrator or network operator can use this commandline for automation purpos
* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -100,8 +153,6 @@ Administrator or network operator can use this commandline for automation purpos
| 25.0 | 50 | 50 | A commandline $process$ that may create or start a service on $dest$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1543/003/](https://attack.mitre.org/techniques/T1543/003/)
@@ -109,7 +160,7 @@ Administrator or network operator can use this commandline for automation purpos
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-12-20-linux_service_started_or_enabled.md b/docs/_posts/2021-12-20-linux_service_started_or_enabled.md
index 88118dec91..d7dac183bd 100644
--- a/docs/_posts/2021-12-20-linux_service_started_or_enabled.md
+++ b/docs/_posts/2021-12-20-linux_service_started_or_enabled.md
@@ -31,16 +31,21 @@ tags:
This analytic looks for created or enable services in linux platform. This technique can be executed or performed using systemctl or service tool application. Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions. Administrator may also create a legitimated service for a specific tool or normal application as part of task or automation, in this scenario it is suggested to look for the service path of the actual script or executable that register as service and who created the service for further verification.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-12-20
- **Author**: Teoderick Contreras, Splunk
- **ID**: e0428212-61b7-11ec-88a3-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -48,6 +53,57 @@ This analytic looks for created or enable services in linux platform. This techn
| [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -61,10 +117,10 @@ This analytic looks for created or enable services in linux platform. This techn
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `linux_service_started_or_enabled_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **linux_service_started_or_enabled_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -88,9 +144,6 @@ Administrator or network operator can use this commandline for automation purpos
* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -100,8 +153,6 @@ Administrator or network operator can use this commandline for automation purpos
| 42.0 | 60 | 70 | a commandline $process$ that may create or start a service on $dest |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1543/003/](https://attack.mitre.org/techniques/T1543/003/)
@@ -109,7 +160,7 @@ Administrator or network operator can use this commandline for automation purpos
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-12-20-suspicious_computer_account_name_change.md b/docs/_posts/2021-12-20-suspicious_computer_account_name_change.md
index c92d8bd1f7..10d905a387 100644
--- a/docs/_posts/2021-12-20-suspicious_computer_account_name_change.md
+++ b/docs/_posts/2021-12-20-suspicious_computer_account_name_change.md
@@ -35,16 +35,21 @@ tags:
As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Impersonation (CVE-2021-42287) exploitation chain, adversaries need to create a new computer account name and rename it to match the name of a domain controller account without the ending '$'. In Windows Active Directory environments, computer account names always end with `$`. This analytic leverages Event Id 4781, `The name of an account was changed`, to identify a computer account rename event with a suspicious name that does not terminate with `$`. This behavior could represent an exploitation attempt of CVE-2021-42278 and CVE-2021-42287 for privilege escalation.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-12-20
- **Author**: Mauricio Velazco, Splunk
- **ID**: 35a61ed8-61c4-11ec-bc1e-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -52,6 +57,56 @@ As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Im
| [T1078.002](https://attack.mitre.org/techniques/T1078/002/) | Domain Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -64,7 +119,7 @@ As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Im
The SPL above uses the following Macros:
* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
-Note that `suspicious_computer_account_name_change_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **suspicious_computer_account_name_change_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -85,9 +140,6 @@ Renaming a computer account name to a name that not end with '$' is highly unsua
* [sAMAccountName Spoofing and Domain Controller Impersonation](/stories/samaccountname_spoofing_and_domain_controller_impersonation)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -97,15 +149,6 @@ Renaming a computer account name to a name that not end with '$' is highly unsua
| 70.0 | 100 | 70 | A computer account $Old_Account_Name$ was renamed with a suspicious computer name |
-#### CVE
-
-| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
-| ----------- | ----------- | -------------- |
-| [CVE-2021-42287](https://nvd.nist.gov/vuln/detail/CVE-2021-42287) | Active Directory Domain Services Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-42278, CVE-2021-42282, CVE-2021-42291. | 6.5 |
-| [CVE-2021-42278](https://nvd.nist.gov/vuln/detail/CVE-2021-42278) | Active Directory Domain Services Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-42282, CVE-2021-42287, CVE-2021-42291. | 6.5 |
-
-
-
#### Reference
* [https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html](https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html)
@@ -115,7 +158,7 @@ Renaming a computer account name to a name that not end with '$' is highly unsua
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-12-20-suspicious_kerberos_service_ticket_request.md b/docs/_posts/2021-12-20-suspicious_kerberos_service_ticket_request.md
index 9c035ec9ad..9afc56d003 100644
--- a/docs/_posts/2021-12-20-suspicious_kerberos_service_ticket_request.md
+++ b/docs/_posts/2021-12-20-suspicious_kerberos_service_ticket_request.md
@@ -35,16 +35,21 @@ tags:
As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Impersonation (CVE-2021-42287) exploitation chain, adversaries will request and obtain a Kerberos Service Ticket (TGS) with a domain controller computer account as the Service Name. This Service Ticket can be then used to take control of the domain controller on the final part of the attack. This analytic leverages Event Id 4769, `A Kerberos service ticket was requested`, to identify an unusual TGS request where the Account_Name requesting the ticket matches the Service_Name field. This behavior could represent an exploitation attempt of CVE-2021-42278 and CVE-2021-42287 for privilege escalation.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-12-20
- **Author**: Mauricio Velazco, Splunk
- **ID**: 8b1297bc-6204-11ec-b7c4-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
+| ----------- | ----------- | -------------- |
+| [CVE-2021-42287](https://nvd.nist.gov/vuln/detail/CVE-2021-42287) | Active Directory Domain Services Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-42278, CVE-2021-42282, CVE-2021-42291. | 6.5 |
+| [CVE-2021-42278](https://nvd.nist.gov/vuln/detail/CVE-2021-42278) | Active Directory Domain Services Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-42282, CVE-2021-42287, CVE-2021-42291. | 6.5 |
+
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -52,6 +57,56 @@ As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Im
| [T1078.002](https://attack.mitre.org/techniques/T1078/002/) | Domain Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -66,7 +121,7 @@ As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Im
The SPL above uses the following Macros:
* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
-Note that `suspicious_kerberos_service_ticket_request_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **suspicious_kerberos_service_ticket_request_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -87,9 +142,6 @@ We have tested this detection logic with ~2 million 4769 events and did not iden
* [sAMAccountName Spoofing and Domain Controller Impersonation](/stories/samaccountname_spoofing_and_domain_controller_impersonation)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -99,15 +151,6 @@ We have tested this detection logic with ~2 million 4769 events and did not iden
| 60.0 | 100 | 60 | A suspicious Kerberos Service Ticket was requested by $Account_Name$ |
-#### CVE
-
-| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
-| ----------- | ----------- | -------------- |
-| [CVE-2021-42287](https://nvd.nist.gov/vuln/detail/CVE-2021-42287) | Active Directory Domain Services Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-42278, CVE-2021-42282, CVE-2021-42291. | 6.5 |
-| [CVE-2021-42278](https://nvd.nist.gov/vuln/detail/CVE-2021-42278) | Active Directory Domain Services Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-42282, CVE-2021-42287, CVE-2021-42291. | 6.5 |
-
-
-
#### Reference
* [https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html](https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html)
@@ -118,7 +161,7 @@ We have tested this detection logic with ~2 million 4769 events and did not iden
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-12-21-linux_add_user_account.md b/docs/_posts/2021-12-21-linux_add_user_account.md
index d83ff36bf1..215aaa0b06 100644
--- a/docs/_posts/2021-12-21-linux_add_user_account.md
+++ b/docs/_posts/2021-12-21-linux_add_user_account.md
@@ -27,16 +27,21 @@ tags:
This analytic looks for commands to create user accounts on the linux platform. This technique is commonly abuse by adversaries, malware author and red teamers to persist on the targeted or compromised host by creating new user with an elevated privilege. This Hunting query may catch normal creation of user by administrator so filter is needed.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-12-21
- **Author**: Teoderick Contreras, Splunk
- **ID**: 51fbcaf2-6259-11ec-b0f3-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
+| ----------- | ----------- | -------------- |
+| [CVE-2021-42287](https://nvd.nist.gov/vuln/detail/CVE-2021-42287) | Active Directory Domain Services Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-42278, CVE-2021-42282, CVE-2021-42291. | 6.5 |
+| [CVE-2021-42278](https://nvd.nist.gov/vuln/detail/CVE-2021-42278) | Active Directory Domain Services Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-42282, CVE-2021-42287, CVE-2021-42291. | 6.5 |
+
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,57 @@ This analytic looks for commands to create user accounts on the linux platform.
| [T1136](https://attack.mitre.org/techniques/T1136/) | Create Account | Persistence |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +113,10 @@ This analytic looks for commands to create user accounts on the linux platform.
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `linux_add_user_account_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **linux_add_user_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +140,6 @@ Administrator or network operator can execute this command. Please update the fi
* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -96,8 +149,6 @@ Administrator or network operator can execute this command. Please update the fi
| 25.0 | 50 | 50 | A commandline $process$ that may create user account on $dest$ |
-
-
#### Reference
* [https://linuxize.com/post/how-to-create-users-in-linux-using-the-useradd-command/](https://linuxize.com/post/how-to-create-users-in-linux-using-the-useradd-command/)
@@ -105,7 +156,7 @@ Administrator or network operator can execute this command. Please update the fi
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-12-21-linux_change_file_owner_to_root.md b/docs/_posts/2021-12-21-linux_change_file_owner_to_root.md
index 7b1c8e08de..787bf9cf07 100644
--- a/docs/_posts/2021-12-21-linux_change_file_owner_to_root.md
+++ b/docs/_posts/2021-12-21-linux_change_file_owner_to_root.md
@@ -27,16 +27,21 @@ tags:
This analytic looks for a commandline that change the file owner to root using chown utility tool. This technique is commonly abuse by adversaries, malware author and red teamers to escalate privilege to the targeted or compromised host by changing the owner of their malicious file to root. This event is not so common in corporate network except from the administrator doing normal task that needs high privilege.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-12-21
- **Author**: Teoderick Contreras, Splunk
- **ID**: c1400ea2-6257-11ec-ad49-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,57 @@ This analytic looks for a commandline that change the file owner to root using c
| [T1222](https://attack.mitre.org/techniques/T1222/) | File and Directory Permissions Modification | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +113,10 @@ This analytic looks for a commandline that change the file owner to root using c
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `linux_change_file_owner_to_root_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **linux_change_file_owner_to_root_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +140,6 @@ Administrator or network operator can execute this command. Please update the fi
* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -96,8 +149,6 @@ Administrator or network operator can execute this command. Please update the fi
| 64.0 | 80 | 80 | A commandline $process$ that may change ownership to root on $dest$ |
-
-
#### Reference
* [https://unix.stackexchange.com/questions/101073/how-to-change-permissions-from-root-user-to-all-users](https://unix.stackexchange.com/questions/101073/how-to-change-permissions-from-root-user-to-all-users)
@@ -106,7 +157,7 @@ Administrator or network operator can execute this command. Please update the fi
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-12-21-linux_nopasswd_entry_in_sudoers_file.md b/docs/_posts/2021-12-21-linux_nopasswd_entry_in_sudoers_file.md
index df7ee8affc..1435ec4b25 100644
--- a/docs/_posts/2021-12-21-linux_nopasswd_entry_in_sudoers_file.md
+++ b/docs/_posts/2021-12-21-linux_nopasswd_entry_in_sudoers_file.md
@@ -29,16 +29,21 @@ tags:
This analytic is to look for suspicious command lines that may add entry to /etc/sudoers with NOPASSWD attribute in linux platform. This technique is commonly abuse by adversaries, malware author and red teamers to gain elevated privilege to the targeted or compromised host. /etc/sudoers file controls who can run what commands users can execute on the machines and can also control whether user need a password to execute particular commands. This file is composed of aliases (basically variables) and user specifications.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-12-21
- **Author**: Teoderick Contreras, Splunk
- **ID**: ab1e0d52-624a-11ec-8e0b-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,57 @@ This analytic is to look for suspicious command lines that may add entry to /etc
| [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -59,10 +115,10 @@ This analytic is to look for suspicious command lines that may add entry to /etc
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `linux_nopasswd_entry_in_sudoers_file_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **linux_nopasswd_entry_in_sudoers_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -86,9 +142,6 @@ Administrator or network operator can execute this command. Please update the fi
* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -98,8 +151,6 @@ Administrator or network operator can execute this command. Please update the fi
| 64.0 | 80 | 80 | a commandline $process$ executed on $dest$ |
-
-
#### Reference
* [https://askubuntu.com/questions/334318/sudoers-file-enable-nopasswd-for-user-all-commands](https://askubuntu.com/questions/334318/sudoers-file-enable-nopasswd-for-user-all-commands)
@@ -108,7 +159,7 @@ Administrator or network operator can execute this command. Please update the fi
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-12-21-linux_setuid_using_chmod_utility.md b/docs/_posts/2021-12-21-linux_setuid_using_chmod_utility.md
index fdacc24010..0a1f0db1f2 100644
--- a/docs/_posts/2021-12-21-linux_setuid_using_chmod_utility.md
+++ b/docs/_posts/2021-12-21-linux_setuid_using_chmod_utility.md
@@ -29,16 +29,21 @@ tags:
This analytic looks for suspicious chmod utility execution to enable SUID bit. This allows a user to temporarily gain root access, usually in order to run a program. For example, only the root account is allowed to change the password information contained in the password database; If the SUID bit appears as an s, the file's owner also has execute permission to the file; if it appears as an S, the file's owner does not have execute permission. The second specialty permission is the SGID, or set group id bit. It is similar to the SUID bit, except it can temporarily change group membership, usually to execute a program. The SGID bit is set if an s or an S appears in the group section of permissions.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-12-21
- **Author**: Teoderick Contreras, Splunk
- **ID**: bf0304b6-6250-11ec-9d7c-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,57 @@ This analytic looks for suspicious chmod utility execution to enable SUID bit. T
| [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -59,10 +115,10 @@ This analytic looks for suspicious chmod utility execution to enable SUID bit. T
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `linux_setuid_using_chmod_utility_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **linux_setuid_using_chmod_utility_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -86,9 +142,6 @@ Administrator or network operator can execute this command. Please update the fi
* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -98,8 +151,6 @@ Administrator or network operator can execute this command. Please update the fi
| 49.0 | 70 | 70 | a commandline $process$ that may set suid or sgid on $dest$ |
-
-
#### Reference
* [https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/](https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/)
@@ -107,7 +158,7 @@ Administrator or network operator can execute this command. Please update the fi
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-12-21-linux_setuid_using_setcap_utility.md b/docs/_posts/2021-12-21-linux_setuid_using_setcap_utility.md
index 5a61e301f7..68d970d4fc 100644
--- a/docs/_posts/2021-12-21-linux_setuid_using_setcap_utility.md
+++ b/docs/_posts/2021-12-21-linux_setuid_using_setcap_utility.md
@@ -29,16 +29,21 @@ tags:
This analytic looks for suspicious setcap utility execution to enable SUID bit. This allows a user to temporarily gain root access, usually in order to run a program. For example, only the root account is allowed to change the password information contained in the password database; If the SUID bit appears as an s, the file's owner also has execute permission to the file; if it appears as an S, the file's owner does not have execute permission. The second specialty permission is the SGID, or set group id bit. It is similar to the SUID bit, except it can temporarily change group membership, usually to execute a program. The SGID bit is set if an s or an S appears in the group section of permissions.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-12-21
- **Author**: Teoderick Contreras, Splunk
- **ID**: 9d96022e-6250-11ec-9a19-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,57 @@ This analytic looks for suspicious setcap utility execution to enable SUID bit.
| [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -59,10 +115,10 @@ This analytic looks for suspicious setcap utility execution to enable SUID bit.
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `linux_setuid_using_setcap_utility_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **linux_setuid_using_setcap_utility_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -86,9 +142,6 @@ Administrator or network operator can execute this command. Please update the fi
* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -98,8 +151,6 @@ Administrator or network operator can execute this command. Please update the fi
| 49.0 | 70 | 70 | A commandline $process$ that may set suid or sgid on $dest$ |
-
-
#### Reference
* [https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/](https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/)
@@ -107,7 +158,7 @@ Administrator or network operator can execute this command. Please update the fi
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-12-21-linux_visudo_utility_execution.md b/docs/_posts/2021-12-21-linux_visudo_utility_execution.md
index 5651a83a54..d4b1ebd892 100644
--- a/docs/_posts/2021-12-21-linux_visudo_utility_execution.md
+++ b/docs/_posts/2021-12-21-linux_visudo_utility_execution.md
@@ -29,16 +29,21 @@ tags:
This analytic is to looks for suspicious commandline that add entry to /etc/sudoers by using visudo utility tool in linux platform. This technique may abuse by adversaries, malware author and red teamers to gain elevated privilege to targeted or compromised host. /etc/sudoers file controls who can run what commands as what users on what machines and can also control special things such as whether you need a password for particular commands. The file is composed of aliases (basically variables) and user specifications (which control who can run what).
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-12-21
- **Author**: Teoderick Contreras, Splunk
- **ID**: 08c41040-624c-11ec-a71f-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,57 @@ This analytic is to looks for suspicious commandline that add entry to /etc/sudo
| [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -59,10 +115,10 @@ This analytic is to looks for suspicious commandline that add entry to /etc/sudo
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `linux_visudo_utility_execution_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **linux_visudo_utility_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -86,9 +142,6 @@ Administrator or network operator can execute this command. Please update the fi
* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -98,8 +151,6 @@ Administrator or network operator can execute this command. Please update the fi
| 16.0 | 40 | 40 | A commandline $process$ executed on $dest$ |
-
-
#### Reference
* [https://askubuntu.com/questions/334318/sudoers-file-enable-nopasswd-for-user-all-commands](https://askubuntu.com/questions/334318/sudoers-file-enable-nopasswd-for-user-all-commands)
@@ -107,7 +158,7 @@ Administrator or network operator can execute this command. Please update the fi
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-12-21-suspicious_ticket_granting_ticket_request.md b/docs/_posts/2021-12-21-suspicious_ticket_granting_ticket_request.md
index 5d4a496b5b..458587f4f1 100644
--- a/docs/_posts/2021-12-21-suspicious_ticket_granting_ticket_request.md
+++ b/docs/_posts/2021-12-21-suspicious_ticket_granting_ticket_request.md
@@ -33,16 +33,21 @@ tags:
As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Impersonation (CVE-2021-42287) exploitation chain, adversaries will need to request a Kerberos Ticket Granting Ticket (TGT) on behalf of the newly created and renamed computer account. The TGT request will be preceded by a computer account name event. This analytic leverages Event Id 4781, `The name of an account was changed` and event Id 4768 `A Kerberos authentication ticket (TGT) was requested` to correlate a sequence of events where the new computer account on event id 4781 matches the request account on event id 4768. This behavior could represent an exploitation attempt of CVE-2021-42278 and CVE-2021-42287 for privilege escalation.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-12-21
- **Author**: Mauricio Velazco, Splunk
- **ID**: d77d349e-6269-11ec-9cfe-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -50,6 +55,51 @@ As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Im
| [T1078.002](https://attack.mitre.org/techniques/T1078/002/) | Domain Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -66,7 +116,7 @@ As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Im
The SPL above uses the following Macros:
* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
-Note that `suspicious_ticket_granting_ticket_request_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **suspicious_ticket_granting_ticket_request_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -87,9 +137,6 @@ A computer account name change event inmediately followed by a kerberos TGT requ
* [sAMAccountName Spoofing and Domain Controller Impersonation](/stories/samaccountname_spoofing_and_domain_controller_impersonation)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -99,8 +146,6 @@ A computer account name change event inmediately followed by a kerberos TGT requ
| 60.0 | 100 | 60 | A suspicious TGT was requested was requested |
-
-
#### Reference
* [https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html](https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html)
@@ -110,7 +155,7 @@ A computer account name change event inmediately followed by a kerberos TGT requ
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-12-22-linux_file_created_in_kernel_driver_directory.md b/docs/_posts/2021-12-22-linux_file_created_in_kernel_driver_directory.md
index ac0ce8567a..e03f211383 100644
--- a/docs/_posts/2021-12-22-linux_file_created_in_kernel_driver_directory.md
+++ b/docs/_posts/2021-12-22-linux_file_created_in_kernel_driver_directory.md
@@ -29,16 +29,21 @@ tags:
This analytic looks for suspicious file creation in kernel/driver directory in linux platform. This directory is known folder for all linux kernel module available within the system. so creation of file in this directory is a good indicator that there is a possible rootkit installation in the host machine. This technique was abuse by adversaries, malware author and red teamers to gain high privileges to their malicious code such us in kernel level. Even this event is not so common administrator or legitimate 3rd party tool may install driver or linux kernel module as part of its installation.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-12-22
- **Author**: Teoderick Contreras, Splunk
- **ID**: b85bbeec-6326-11ec-9311-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,57 @@ This analytic looks for suspicious file creation in kernel/driver directory in l
| [T1547](https://attack.mitre.org/techniques/T1547/) | Boot or Logon Autostart Execution | Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -59,10 +115,10 @@ This analytic looks for suspicious file creation in kernel/driver directory in l
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `linux_file_created_in_kernel_driver_directory_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **linux_file_created_in_kernel_driver_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +140,6 @@ Administrator or network operator can create file in this folders for automation
* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -96,8 +149,6 @@ Administrator or network operator can create file in this folders for automation
| 72.0 | 80 | 90 | A file $file_name$ is created in $file_path$ on $dest$ |
-
-
#### Reference
* [https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/kernel-module-driver-configuration/Working_with_Kernel_Modules/](https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/kernel-module-driver-configuration/Working_with_Kernel_Modules/)
@@ -107,7 +158,7 @@ Administrator or network operator can create file in this folders for automation
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-12-22-linux_insert_kernel_module_using_insmod_utility.md b/docs/_posts/2021-12-22-linux_insert_kernel_module_using_insmod_utility.md
index b8b9fe327f..93b650fe0a 100644
--- a/docs/_posts/2021-12-22-linux_insert_kernel_module_using_insmod_utility.md
+++ b/docs/_posts/2021-12-22-linux_insert_kernel_module_using_insmod_utility.md
@@ -29,16 +29,21 @@ tags:
This analytic looks for inserting of linux kernel module using insmod utility function. This event can detect a installation of rootkit or malicious kernel module to gain elevated privileges to their malicious code and bypassed detections. This Anomaly detection is a good indicator that someone installing kernel module in a linux host either admin or adversaries. filter is needed in this scenario
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-12-22
- **Author**: Teoderick Contreras, Splunk
- **ID**: 18b5a1a0-6326-11ec-943a-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,57 @@ This analytic looks for inserting of linux kernel module using insmod utility fu
| [T1547](https://attack.mitre.org/techniques/T1547/) | Boot or Logon Autostart Execution | Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -59,10 +115,10 @@ This analytic looks for inserting of linux kernel module using insmod utility fu
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `linux_insert_kernel_module_using_insmod_utility_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **linux_insert_kernel_module_using_insmod_utility_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -86,9 +142,6 @@ Administrator or network operator can execute this command. Please update the fi
* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -98,8 +151,6 @@ Administrator or network operator can execute this command. Please update the fi
| 64.0 | 80 | 80 | A commandline $process$ that may install kernel module on $dest$ |
-
-
#### Reference
* [https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/kernel-module-driver-configuration/Working_with_Kernel_Modules/](https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/kernel-module-driver-configuration/Working_with_Kernel_Modules/)
@@ -109,7 +160,7 @@ Administrator or network operator can execute this command. Please update the fi
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-12-22-linux_install_kernel_module_using_modprobe_utility.md b/docs/_posts/2021-12-22-linux_install_kernel_module_using_modprobe_utility.md
index 077b070e62..2c8bf702b9 100644
--- a/docs/_posts/2021-12-22-linux_install_kernel_module_using_modprobe_utility.md
+++ b/docs/_posts/2021-12-22-linux_install_kernel_module_using_modprobe_utility.md
@@ -29,16 +29,21 @@ tags:
This analytic looks for possible installing a linux kernel module using modprobe utility function. This event can detect a installation of rootkit or malicious kernel module to gain elevated privileges to their malicious code and bypassed detections. This Anomaly detection is a good indicator that someone installing kernel module in a linux host either admin or adversaries. filter is needed in this scenario
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-12-22
- **Author**: Teoderick Contreras, Splunk
- **ID**: 387b278a-6326-11ec-aa2c-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,57 @@ This analytic looks for possible installing a linux kernel module using modprobe
| [T1547](https://attack.mitre.org/techniques/T1547/) | Boot or Logon Autostart Execution | Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -59,10 +115,10 @@ This analytic looks for possible installing a linux kernel module using modprobe
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `linux_install_kernel_module_using_modprobe_utility_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **linux_install_kernel_module_using_modprobe_utility_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -86,9 +142,6 @@ Administrator or network operator can execute this command. Please update the fi
* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -98,8 +151,6 @@ Administrator or network operator can execute this command. Please update the fi
| 64.0 | 80 | 80 | A commandline $process$ that may install kernel module on $dest$ |
-
-
#### Reference
* [https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/kernel-module-driver-configuration/Working_with_Kernel_Modules/](https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/kernel-module-driver-configuration/Working_with_Kernel_Modules/)
@@ -109,7 +160,7 @@ Administrator or network operator can execute this command. Please update the fi
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-12-22-linux_preload_hijack_library_calls.md b/docs/_posts/2021-12-22-linux_preload_hijack_library_calls.md
index 9ead51a7a9..b2ab9b1edc 100644
--- a/docs/_posts/2021-12-22-linux_preload_hijack_library_calls.md
+++ b/docs/_posts/2021-12-22-linux_preload_hijack_library_calls.md
@@ -31,16 +31,21 @@ tags:
This analytic is to detect a suspicious command that may hijack a library function in linux platform. This technique is commonly abuse by adversaries, malware author and red teamers to gain privileges and persist on the machine. This detection pertains to loading a dll to hijack or hook a library function of specific program using LD_PRELOAD command.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-12-22
- **Author**: Teoderick Contreras, Splunk
- **ID**: cbe2ca30-631e-11ec-8670-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -48,6 +53,57 @@ This analytic is to detect a suspicious command that may hijack a library functi
| [T1574](https://attack.mitre.org/techniques/T1574/) | Hijack Execution Flow | Defense Evasion, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -61,10 +117,10 @@ This analytic is to detect a suspicious command that may hijack a library functi
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `linux_preload_hijack_library_calls_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **linux_preload_hijack_library_calls_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -88,9 +144,6 @@ Administrator or network operator can execute this command. Please update the fi
* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -100,8 +153,6 @@ Administrator or network operator can execute this command. Please update the fi
| 64.0 | 80 | 80 | A commandline $process$ that may hijack library function on $dest$ |
-
-
#### Reference
* [https://compilepeace.medium.com/memory-malware-part-0x2-writing-userland-rootkits-via-ld-preload-30121c8343d5](https://compilepeace.medium.com/memory-malware-part-0x2-writing-userland-rootkits-via-ld-preload-30121c8343d5)
@@ -109,7 +160,7 @@ Administrator or network operator can execute this command. Please update the fi
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-12-23-linux_common_process_for_elevation_control.md b/docs/_posts/2021-12-23-linux_common_process_for_elevation_control.md
index 45c8046cc6..630260d649 100644
--- a/docs/_posts/2021-12-23-linux_common_process_for_elevation_control.md
+++ b/docs/_posts/2021-12-23-linux_common_process_for_elevation_control.md
@@ -27,18 +27,23 @@ tags:
#### Description
-This analytic is to look for possible elevation control access using a common known process in linux platform to change the attribute and file ownership. This technique is commonly abused by adversaries, malware author and red teamers to gain persistence or privilege escalation on the target or compromised host. Tis common process is used to modify file attribute, file ownership or SUID. This tools can be used in legitimate purposes so filter is needed.
+This analytic is to look for possible elevation control access using a common known process in linux platform to change the attribute and file ownership. This technique is commonly abused by adversaries, malware author and red teamers to gain persistence or privilege escalation on the target or compromised host. This common process is used to modify file attribute, file ownership or SUID. This tools can be used in legitimate purposes so filter is needed.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-12-23
- **Author**: Teoderick Contreras, Splunk
- **ID**: 66ab15c0-63d0-11ec-9e70-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,57 @@ This analytic is to look for possible elevation control access using a common kn
| [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -59,10 +115,10 @@ This analytic is to look for possible elevation control access using a common kn
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `linux_common_process_for_elevation_control_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **linux_common_process_for_elevation_control_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -86,9 +142,6 @@ Administrator or network operator can execute this command. Please update the fi
* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -98,8 +151,6 @@ Administrator or network operator can execute this command. Please update the fi
| 9.0 | 30 | 30 | A commandline $process$ with process $process_name$ on $dest$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1548/001/](https://attack.mitre.org/techniques/T1548/001/)
@@ -110,7 +161,7 @@ Administrator or network operator can execute this command. Please update the fi
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2021-12-23-linux_sudoers_tmp_file_creation.md b/docs/_posts/2021-12-23-linux_sudoers_tmp_file_creation.md
index b777df2f57..5ecd7ddeb9 100644
--- a/docs/_posts/2021-12-23-linux_sudoers_tmp_file_creation.md
+++ b/docs/_posts/2021-12-23-linux_sudoers_tmp_file_creation.md
@@ -29,16 +29,21 @@ tags:
This analytic is to looks for file creation of sudoers.tmp file cause by editing /etc/sudoers using visudo or editor in linux platform. This technique may abuse by adversaries, malware author and red teamers to gain elevated privilege to targeted or compromised host. /etc/sudoers file controls who can run what commands as what users on what machines and can also control special things such as whether you need a password for particular commands. The file is composed of aliases (basically variables) and user specifications (which control who can run what).
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2021-12-23
- **Author**: Teoderick Contreras, Splunk
- **ID**: be254a5c-63e7-11ec-89da-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,57 @@ This analytic is to looks for file creation of sudoers.tmp file cause by editing
| [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -59,10 +115,10 @@ This analytic is to looks for file creation of sudoers.tmp file cause by editing
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `linux_sudoers_tmp_file_creation_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **linux_sudoers_tmp_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +140,6 @@ administrator or network operator can execute this command. Please update the fi
* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -96,8 +149,6 @@ administrator or network operator can execute this command. Please update the fi
| 72.0 | 80 | 90 | A file $file_name$ is created in $file_path$ on $dest$ |
-
-
#### Reference
* [https://forum.ubuntuusers.de/topic/sudo-visudo-gibt-etc-sudoers-tmp/](https://forum.ubuntuusers.de/topic/sudo-visudo-gibt-etc-sudoers-tmp/)
@@ -105,7 +156,7 @@ administrator or network operator can execute this command. Please update the fi
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-01-04-linux_sudo_or_su_execution.md b/docs/_posts/2022-01-04-linux_sudo_or_su_execution.md
index fb99121ecd..a4091d5bd5 100644
--- a/docs/_posts/2022-01-04-linux_sudo_or_su_execution.md
+++ b/docs/_posts/2022-01-04-linux_sudo_or_su_execution.md
@@ -29,16 +29,21 @@ tags:
This analytic is to detect the execution of sudo or su command in linux operating system. The "sudo" command allows a system administrator to delegate authority to give certain users (or groups of users) the ability to run some (or all) commands as root or another user while providing an audit trail of the commands and their arguments. This command is commonly abused by adversaries, malware author and red teamers to elevate privileges to the targeted host. This command can be executed by administrator for legitimate purposes or to execute process that need admin privileges, In this scenario filter is needed.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2022-01-04
- **Author**: Teoderick Contreras, Splunk
- **ID**: 4b00f134-6d6a-11ec-a90c-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,57 @@ This analytic is to detect the execution of sudo or su command in linux operatin
| [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -59,10 +115,10 @@ This analytic is to detect the execution of sudo or su command in linux operatin
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `linux_sudo_or_su_execution_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **linux_sudo_or_su_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -86,9 +142,6 @@ Administrator or network operator can execute this command. Please update the fi
* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -98,8 +151,6 @@ Administrator or network operator can execute this command. Please update the fi
| 9.0 | 30 | 30 | A commandline $process$ that execute sudo or su in $dest$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1548/003/](https://attack.mitre.org/techniques/T1548/003/)
@@ -107,7 +158,7 @@ Administrator or network operator can execute this command. Please update the fi
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-01-05-linux_doas_conf_file_creation.md b/docs/_posts/2022-01-05-linux_doas_conf_file_creation.md
index 4bd04da89e..fed38517b7 100644
--- a/docs/_posts/2022-01-05-linux_doas_conf_file_creation.md
+++ b/docs/_posts/2022-01-05-linux_doas_conf_file_creation.md
@@ -29,16 +29,21 @@ tags:
This analytic is to detect the creation of doas.conf file in linux host platform. This configuration file can be use by doas utility tool to allow or permit standard users to perform tasks as root, the same way sudo does. This tool is developed as a minimalistic alternative to sudo application. This tool can be abused advesaries, attacker or malware to gain elevated privileges to the targeted or compromised host. On the other hand this can also be executed by administrator for a certain task that needs admin rights. In this case filter is needed.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2022-01-05
- **Author**: Teoderick Contreras, Splunk
- **ID**: f6343e86-6e09-11ec-9376-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,57 @@ This analytic is to detect the creation of doas.conf file in linux host platform
| [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -59,10 +115,10 @@ This analytic is to detect the creation of doas.conf file in linux host platform
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `linux_doas_conf_file_creation_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **linux_doas_conf_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +140,6 @@ Administrator or network operator can execute this command. Please update the fi
* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -96,8 +149,6 @@ Administrator or network operator can execute this command. Please update the fi
| 49.0 | 70 | 70 | A file $file_name$ is created in $file_path$ on $dest$ |
-
-
#### Reference
* [https://wiki.gentoo.org/wiki/Doas](https://wiki.gentoo.org/wiki/Doas)
@@ -106,7 +157,7 @@ Administrator or network operator can execute this command. Please update the fi
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-01-05-linux_doas_tool_execution.md b/docs/_posts/2022-01-05-linux_doas_tool_execution.md
index c308cf5768..1599d008a8 100644
--- a/docs/_posts/2022-01-05-linux_doas_tool_execution.md
+++ b/docs/_posts/2022-01-05-linux_doas_tool_execution.md
@@ -29,16 +29,21 @@ tags:
This analytic is to detect the doas tool execution in linux host platform. This utility tool allow standard users to perform tasks as root, the same way sudo does. This tool is developed as a minimalistic alternative to sudo application. This tool can be abused advesaries, attacker or malware to gain elevated privileges to the targeted or compromised host. On the other hand this can also be executed by administrator for a certain task that needs admin rights. In this case filter is needed.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2022-01-05
- **Author**: Teoderick Contreras, Splunk
- **ID**: d5a62490-6e09-11ec-884e-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,57 @@ This analytic is to detect the doas tool execution in linux host platform. This
| [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -59,10 +115,10 @@ This analytic is to detect the doas tool execution in linux host platform. This
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `linux_doas_tool_execution_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **linux_doas_tool_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -86,9 +142,6 @@ Administrator or network operator can execute this command. Please update the fi
* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -98,8 +151,6 @@ Administrator or network operator can execute this command. Please update the fi
| 49.0 | 70 | 70 | A doas $process_name$ with commandline $process$ was executed on $dest$ |
-
-
#### Reference
* [https://wiki.gentoo.org/wiki/Doas](https://wiki.gentoo.org/wiki/Doas)
@@ -108,7 +159,7 @@ Administrator or network operator can execute this command. Please update the fi
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-01-10-linux_possible_access_to_credential_files.md b/docs/_posts/2022-01-10-linux_possible_access_to_credential_files.md
index b7a5e56af4..8abacad923 100644
--- a/docs/_posts/2022-01-10-linux_possible_access_to_credential_files.md
+++ b/docs/_posts/2022-01-10-linux_possible_access_to_credential_files.md
@@ -27,16 +27,21 @@ tags:
This analytic is to detect a possible attempt to dump or access the content of /etc/passwd and /etc/shadow to enable offline credential cracking. "etc/passwd" store user information within linux OS while "etc/shadow" contain the user passwords hash. Adversaries and threat actors may attempt to access this to gain persistence and/or privilege escalation. This anomaly detection can be a good indicator of possible credential dumping technique but it might catch some normal administrator automation scripts or during credential auditing. In this scenario filter is needed.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2022-01-10
- **Author**: Teoderick Contreras, Splunk
- **ID**: 16107e0e-71fc-11ec-b862-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,57 @@ This analytic is to detect a possible attempt to dump or access the content of /
| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +113,10 @@ This analytic is to detect a possible attempt to dump or access the content of /
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `linux_possible_access_to_credential_files_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **linux_possible_access_to_credential_files_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +140,6 @@ Administrator or network operator can execute this command. Please update the fi
* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -96,8 +149,6 @@ Administrator or network operator can execute this command. Please update the fi
| 25.0 | 50 | 50 | A commandline $process$ executed on $dest$ |
-
-
#### Reference
* [https://askubuntu.com/questions/445361/what-is-difference-between-etc-shadow-and-etc-passwd](https://askubuntu.com/questions/445361/what-is-difference-between-etc-shadow-and-etc-passwd)
@@ -106,7 +157,7 @@ Administrator or network operator can execute this command. Please update the fi
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-01-10-linux_possible_access_to_sudoers_file.md b/docs/_posts/2022-01-10-linux_possible_access_to_sudoers_file.md
index a3d718e1cd..d32def4018 100644
--- a/docs/_posts/2022-01-10-linux_possible_access_to_sudoers_file.md
+++ b/docs/_posts/2022-01-10-linux_possible_access_to_sudoers_file.md
@@ -29,16 +29,21 @@ tags:
This analytic is to detect a possible access or modification of /etc/sudoers file. "/etc/sudoers" file controls who can run what command as what users on what machine and can also control whether a specific user need a password for particular commands. adversaries and threat actors abuse this file to gain persistence and/or privilege escalation during attack on targeted host.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2022-01-10
- **Author**: Teoderick Contreras, Splunk
- **ID**: 4479539c-71fc-11ec-b2e2-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,57 @@ This analytic is to detect a possible access or modification of /etc/sudoers fil
| [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -59,10 +115,10 @@ This analytic is to detect a possible access or modification of /etc/sudoers fil
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `linux_possible_access_to_sudoers_file_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **linux_possible_access_to_sudoers_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -86,9 +142,6 @@ administrator or network operator can execute this command. Please update the fi
* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -98,8 +151,6 @@ administrator or network operator can execute this command. Please update the fi
| 25.0 | 50 | 50 | A commandline $process$ executed on $dest$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1548/003/](https://attack.mitre.org/techniques/T1548/003/)
@@ -108,7 +159,7 @@ administrator or network operator can execute this command. Please update the fi
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-01-11-linux_possible_access_or_modification_of_sshd_config_file.md b/docs/_posts/2022-01-11-linux_possible_access_or_modification_of_sshd_config_file.md
index 41b74f6697..646b74e3e7 100644
--- a/docs/_posts/2022-01-11-linux_possible_access_or_modification_of_sshd_config_file.md
+++ b/docs/_posts/2022-01-11-linux_possible_access_or_modification_of_sshd_config_file.md
@@ -27,16 +27,21 @@ tags:
This analytic is to look for suspicious process command-line that might be accessing or modifying sshd_config. This file is the ssh configuration file that might be modify by threat actors or adversaries to redirect port connection, allow user using authorized key generated during attack. This anomaly detection might catch noise from administrator auditing or modifying ssh configuration file. In this scenario filter is needed
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2022-01-11
- **Author**: Teoderick Contreras, Splunk
- **ID**: 7a85eb24-72da-11ec-ac76-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,57 @@ This analytic is to look for suspicious process command-line that might be acces
| [T1098](https://attack.mitre.org/techniques/T1098/) | Account Manipulation | Persistence |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +113,10 @@ This analytic is to look for suspicious process command-line that might be acces
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `linux_possible_access_or_modification_of_sshd_config_file_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **linux_possible_access_or_modification_of_sshd_config_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +140,6 @@ Administrator or network operator can use this commandline for automation purpos
* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -96,8 +149,6 @@ Administrator or network operator can use this commandline for automation purpos
| 25.0 | 50 | 50 | a commandline $process$ executed on $dest$ |
-
-
#### Reference
* [https://www.hackingarticles.in/ssh-penetration-testing-port-22/](https://www.hackingarticles.in/ssh-penetration-testing-port-22/)
@@ -106,7 +157,7 @@ Administrator or network operator can use this commandline for automation purpos
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-01-11-linux_possible_ssh_key_file_creation.md b/docs/_posts/2022-01-11-linux_possible_ssh_key_file_creation.md
index 0f9d915cb7..44b67839f1 100644
--- a/docs/_posts/2022-01-11-linux_possible_ssh_key_file_creation.md
+++ b/docs/_posts/2022-01-11-linux_possible_ssh_key_file_creation.md
@@ -27,16 +27,21 @@ tags:
This analytic is to look for possible ssh key file creation on ~/.ssh/ folder. This technique is commonly abused by threat actors and adversaries to gain persistence and privilege escalation to the targeted host. by creating ssh private and public key and passing the public key to the attacker server. threat actor can access remotely the machine using openssh daemon service.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2022-01-11
- **Author**: Teoderick Contreras, Splunk
- **ID**: c04ef40c-72da-11ec-8eac-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,57 @@ This analytic is to look for possible ssh key file creation on ~/.ssh/ folder. T
| [T1098](https://attack.mitre.org/techniques/T1098/) | Account Manipulation | Persistence |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +113,10 @@ This analytic is to look for possible ssh key file creation on ~/.ssh/ folder. T
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `linux_possible_ssh_key_file_creation_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **linux_possible_ssh_key_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -82,9 +138,6 @@ Administrator or network operator can create file in ~/.ssh folders for automati
* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -94,8 +147,6 @@ Administrator or network operator can create file in ~/.ssh folders for automati
| 36.0 | 60 | 60 | A file $file_name$ is created in $file_path$ on $dest$ |
-
-
#### Reference
* [https://www.hackingarticles.in/ssh-penetration-testing-port-22/](https://www.hackingarticles.in/ssh-penetration-testing-port-22/)
@@ -104,7 +155,7 @@ Administrator or network operator can create file in ~/.ssh folders for automati
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md b/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md
index 146d2e5105..1028de66cd 100644
--- a/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md
+++ b/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md
@@ -28,16 +28,21 @@ tags:
The following hunting analytic identifies PowerShell commands utilizing the WindowStyle parameter to hide the window on the compromised endpoint. This combination of command-line options is suspicious because it is overriding the default PowerShell execution policy, attempts to hide its activity from the user, and connects to the Internet. Removed in this version of the query is New-Object. The analytic identifies all variations of WindowStyle, as PowerShell allows the ability to shorten the parameter. For example w, win, windowsty and so forth. In addition, through our research it was identified that PowerShell will interpret different command switch types beyond the hyphen. We have added endash, emdash, horizontal bar, and forward slash.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2022-01-12
- **Author**: David Dorsey, Michael Haag Splunk
- **ID**: ee18ed37-0802-4268-9435-b3b91aaa18db
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -45,6 +50,64 @@ The following hunting analytic identifies PowerShell commands utilizing the Wind
| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Command & Control
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+* PR.IP
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 7
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -63,11 +126,11 @@ The following hunting analytic identifies PowerShell commands utilizing the Wind
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `powershell_-_connect_to_internet_with_hidden_window_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **powershell_-_connect_to_internet_with_hidden_window_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -91,10 +154,6 @@ Legitimate process can have this combination of command-line options, but it's n
* [Log4Shell CVE-2021-44228](/stories/log4shell_cve-2021-44228)
-#### Kill Chain Phase
-* Command & Control
-* Actions on Objectives
-
#### RBA
@@ -104,14 +163,6 @@ Legitimate process can have this combination of command-line options, but it's n
| 81.0 | 90 | 90 | PowerShell processes $process$ started with parameters to modify the execution policy of the run, run in a hidden window, and connect to the Internet on host $dest$ executed by user $user$. |
-#### CVE
-
-| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
-| ----------- | ----------- | -------------- |
-| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 |
-
-
-
#### Reference
* [https://regexr.com/663rr](https://regexr.com/663rr)
@@ -123,7 +174,7 @@ Legitimate process can have this combination of command-line options, but it's n
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md b/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md
index 66943892c9..cd569b7713 100644
--- a/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md
+++ b/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md
@@ -26,16 +26,21 @@ tags:
The following hunting analytic identifies all processes requesting access into Lsass.exe. his behavior may be related to credential dumping or applications requiring access to credentials. Triaging this event will require understanding the GrantedAccess from the SourceImage. In addition, whether the account is privileged or not. Review the process requesting permissions and review parallel processes.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2022-01-12
- **Author**: Michael Haag, Splunk
- **ID**: 1c6abb08-73d1-11ec-9ca0-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
+| ----------- | ----------- | -------------- |
+| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 |
+
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,54 @@ The following hunting analytic identifies all processes requesting access into L
| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.AE
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -56,10 +109,10 @@ The following hunting analytic identifies all processes requesting access into L
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `windows_hunting_system_account_targeting_lsass_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **windows_hunting_system_account_targeting_lsass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -82,9 +135,6 @@ False positives will occur based on GrantedAccess and SourceUser, filter based o
* [Credential Dumping](/stories/credential_dumping)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -94,8 +144,6 @@ False positives will occur based on GrantedAccess and SourceUser, filter based o
| 64.0 | 80 | 80 | A process, $SourceImage$, has loaded $ImageLoaded$ that are typically related to credential dumping on $dest$. Review for further details. |
-
-
#### Reference
* [https://en.wikipedia.org/wiki/Local_Security_Authority_Subsystem_Service](https://en.wikipedia.org/wiki/Local_Security_Authority_Subsystem_Service)
@@ -107,7 +155,7 @@ False positives will occur based on GrantedAccess and SourceUser, filter based o
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md b/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md
index 4aa188380b..60c7093de5 100644
--- a/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md
+++ b/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md
@@ -26,16 +26,21 @@ tags:
The following analytic identifies non SYSTEM accounts requesting access to lsass.exe. This behavior may be related to credential dumping or applications requiring access to credentials. Triaging this event will require understanding the GrantedAccess from the SourceImage. In addition, whether the account is privileged or not. Review the process requesting permissions and review parallel processes.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2022-01-12
- **Author**: Michael Haag, Splunk
- **ID**: b1ce9a72-73cf-11ec-981b-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,54 @@ The following analytic identifies non SYSTEM accounts requesting access to lsass
| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.AE
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -56,10 +109,10 @@ The following analytic identifies non SYSTEM accounts requesting access to lsass
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `windows_non-system_account_targeting_lsass_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **windows_non-system_account_targeting_lsass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -82,9 +135,6 @@ False positives will occur based on legitimate application requests, filter base
* [Credential Dumping](/stories/credential_dumping)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -94,8 +144,6 @@ False positives will occur based on legitimate application requests, filter base
| 64.0 | 80 | 80 | A process, $SourceImage$, has loaded $ImageLoaded$ that are typically related to credential dumping on $dest$. Review for further details. |
-
-
#### Reference
* [https://en.wikipedia.org/wiki/Local_Security_Authority_Subsystem_Service](https://en.wikipedia.org/wiki/Local_Security_Authority_Subsystem_Service)
@@ -107,7 +155,7 @@ False positives will occur based on legitimate application requests, filter base
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-01-14-potentially_malicious_code_on_commandline.md b/docs/_posts/2022-01-14-potentially_malicious_code_on_commandline.md
index a9db929c55..5834b33c54 100644
--- a/docs/_posts/2022-01-14-potentially_malicious_code_on_commandline.md
+++ b/docs/_posts/2022-01-14-potentially_malicious_code_on_commandline.md
@@ -24,21 +24,71 @@ tags:
The following analytic uses a pretrained machine learning text classifier to detect potentially malicious commandlines. The model identifies unusual combinations of keywords found in samples of commandlines where adversaries executed powershell code, primarily for C2 communication. For example, adversaries will leverage IO capabilities such as "streamreader" and "webclient", threading capabilties such as "mutex" locks, programmatic constructs like "function" and "catch", and cryptographic operations like "computehash". Although observing one of these keywords in a commandline script is possible, combinations of keywords observed in attack data are not typically found in normal usage of the commandline. The model will output a score where all values above zero are suspicious, anything greater than one particularly so.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2022-01-14
- **Author**: Michael Hart, Splunk
- **ID**: 9c53c446-757e-11ec-871d-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1059.003](https://attack.mitre.org/techniques/T1059/003/) | Windows Command Shell | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -59,10 +109,10 @@ The following analytic uses a pretrained machine learning text classifier to det
#### Macros
The SPL above uses the following Macros:
* [potentially_malicious_code_on_cmdline_tokenize_score](https://github.com/splunk/security_content/blob/develop/macros/potentially_malicious_code_on_cmdline_tokenize_score.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `potentially_malicious_code_on_commandline_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **potentially_malicious_code_on_commandline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +134,6 @@ This model is an anomaly detector that identifies usage of APIs and scripting co
* [Suspicious Command-Line Executions](/stories/suspicious_command-line_executions)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -96,8 +143,6 @@ This model is an anomaly detector that identifies usage of APIs and scripting co
| 12.0 | 60 | 20 | Unusual command-line execution with hallmarks of malicious activity run by $user$ found on $dest$ with commandline $process$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1059/003/](https://attack.mitre.org/techniques/T1059/003/)
@@ -106,7 +151,7 @@ This model is an anomaly detector that identifies usage of APIs and scripting co
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md b/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md
index be8867deae..34a10929a9 100644
--- a/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md
+++ b/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md
@@ -28,16 +28,21 @@ tags:
The following analytic identifies command-line arguments where `cmd.exe /c` is used to execute a program. `cmd /c` is used to run commands in MS-DOS and terminate after command or process completion. This technique is commonly seen in adversaries and malware to execute batch command using different shell like PowerShell or different process other than `cmd.exe`. This is a good hunting query for suspicious command-line made by a script or relative process execute it.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2022-01-18
- **Author**: Teoderick Contreras, Bhavin Patel, Splunk
- **ID**: 54a6ed00-3256-11ec-b031-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -45,6 +50,55 @@ The following analytic identifies command-line arguments where `cmd.exe /c` is u
| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -59,10 +113,10 @@ The following analytic identifies command-line arguments where `cmd.exe /c` is u
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
-Note that `cmd_carry_out_string_command_parameter_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **cmd_carry_out_string_command_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -92,9 +146,6 @@ False positives may be high based on legitimate scripted code in any environment
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -104,14 +155,6 @@ False positives may be high based on legitimate scripted code in any environment
| 30.0 | 60 | 50 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting spawn a new process. |
-#### CVE
-
-| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
-| ----------- | ----------- | -------------- |
-| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 |
-
-
-
#### Reference
* [https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/](https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/)
@@ -120,7 +163,7 @@ False positives may be high based on legitimate scripted code in any environment
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-01-18-impacket_lateral_movement_commandline_parameters.md b/docs/_posts/2022-01-18-impacket_lateral_movement_commandline_parameters.md
index d1c5bac0e4..cbc824d6df 100644
--- a/docs/_posts/2022-01-18-impacket_lateral_movement_commandline_parameters.md
+++ b/docs/_posts/2022-01-18-impacket_lateral_movement_commandline_parameters.md
@@ -37,16 +37,21 @@ tags:
This analytic looks for the presence of suspicious commandline parameters typically present when using Impacket tools. Impacket is a collection of python classes meant to be used with Microsoft network protocols. There are multiple scripts that leverage impacket libraries like `wmiexec.py`, `smbexec.py`, `dcomexec.py` and `atexec.py` used to execute commands on remote endpoints. By default, these scripts leverage administrative shares and hardcoded parameters that can be used as a signature to detect its use. Red Teams and adversaries alike may leverage Impackets tools for lateral movement and remote code execution.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2022-01-18
- **Author**: Mauricio Velazco, Splunk
- **ID**: 8ce07472-496f-11ec-ab3b-3e22fbd008af
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
+| ----------- | ----------- | -------------- |
+| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 |
+
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -60,6 +65,51 @@ This analytic looks for the presence of suspicious commandline parameters typica
| [T1543.003](https://attack.mitre.org/techniques/T1543/003/) | Windows Service | Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -73,10 +123,10 @@ This analytic looks for the presence of suspicious commandline parameters typica
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `impacket_lateral_movement_commandline_parameters_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **impacket_lateral_movement_commandline_parameters_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -104,9 +154,6 @@ Although uncommon, Administrators may leverage Impackets tools to start a proces
* [WhisperGate](/stories/whispergate)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -116,8 +163,6 @@ Although uncommon, Administrators may leverage Impackets tools to start a proces
| 63.0 | 90 | 70 | Suspicious command line parameters on $dest may represent a lateral movement attack with Impackets tools |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1021/002/](https://attack.mitre.org/techniques/T1021/002/)
@@ -132,7 +177,7 @@ Although uncommon, Administrators may leverage Impackets tools to start a proces
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md b/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md
index d616508018..64629a89f1 100644
--- a/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md
+++ b/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md
@@ -27,21 +27,80 @@ The analytic identifies all variations of EncodedCommand, as PowerShell allows t
During triage, review parallel events to determine legitimacy. Tune as needed based on admin scripts in use. \
Alternatively, may use regex per matching here https://regexr.com/662ov.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2022-01-18
- **Author**: David Dorsey, Michael Haag, Splunk
- **ID**: c4db14d9-7909-48b4-a054-aa14d89dbb19
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1027](https://attack.mitre.org/techniques/T1027/) | Obfuscated Files or Information | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Command & Control
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+* PR.IP
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 7
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -60,11 +119,11 @@ Alternatively, may use regex per matching here https://regexr.com/662ov.
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `malicious_powershell_process_-_encoded_command_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **malicious_powershell_process_-_encoded_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -88,10 +147,6 @@ System administrators may use this option, but it's not common.
* [WhisperGate](/stories/whispergate)
-#### Kill Chain Phase
-* Command & Control
-* Actions on Objectives
-
#### RBA
@@ -101,8 +156,6 @@ System administrators may use this option, but it's not common.
| 35.0 | 70 | 50 | Powershell.exe running potentially malicious encodede commands on $dest$ |
-
-
#### Reference
* [https://regexr.com/662ov](https://regexr.com/662ov)
@@ -114,7 +167,7 @@ System administrators may use this option, but it's not common.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-01-18-powershell_remove_windows_defender_directory.md b/docs/_posts/2022-01-18-powershell_remove_windows_defender_directory.md
index 10e33198a5..e3619c665e 100644
--- a/docs/_posts/2022-01-18-powershell_remove_windows_defender_directory.md
+++ b/docs/_posts/2022-01-18-powershell_remove_windows_defender_directory.md
@@ -27,16 +27,21 @@ tags:
This analytic will identify a suspicious PowerShell command used to delete the Windows Defender folder. This technique was seen used by the WhisperGate malware campaign where it used Nirsofts advancedrun.exe to gain administrative privileges to then execute a PowerShell command to delete the Windows Defender folder. This is a good indicator the offending process is trying corrupt a Windows Defender installation.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2022-01-18
- **Author**: Teoderick Contreras, Splunk
- **ID**: adf47620-79fa-11ec-b248-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,57 @@ This analytic will identify a suspicious PowerShell command used to delete the W
| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -56,10 +112,10 @@ This analytic will identify a suspicious PowerShell command used to delete the W
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `powershell_remove_windows_defender_directory_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **powershell_remove_windows_defender_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -79,9 +135,6 @@ unknown
* [WhisperGate](/stories/whispergate)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -91,8 +144,6 @@ unknown
| 90.0 | 100 | 90 | suspicious powershell script $Message$ was executed on the $ComputerName$ |
-
-
#### Reference
* [https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/](https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/)
@@ -100,7 +151,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md b/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md
index a632288cc0..20ea3aa0e0 100644
--- a/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md
+++ b/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md
@@ -27,16 +27,21 @@ tags:
This analytic detects a suspicious process making a DNS query via known, abused text-paste web services, VoIP, instant messaging, and digital distribution platforms used to download external files. This technique is abused by adversaries, malware actors, and red teams to download a malicious file on the target host. This is a good TTP indicator for possible initial access techniques. A user will experience false positives if the following instant messaging is allowed or common applications like telegram or discord are allowed in the corporate network.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2022-01-18
- **Author**: Teoderick Contreras, Splunk
- **ID**: 3cf0dc36-484d-11ec-a6bc-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This analytic detects a suspicious process making a DNS query via known, abused
| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -56,10 +106,10 @@ This analytic detects a suspicious process making a DNS query via known, abused
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `suspicious_process_dns_query_known_abuse_web_services_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **suspicious_process_dns_query_known_abuse_web_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -82,9 +132,6 @@ Noise and false positive can be seen if the following instant messaging is allow
* [WhisperGate](/stories/whispergate)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -94,8 +141,6 @@ Noise and false positive can be seen if the following instant messaging is allow
| 64.0 | 80 | 80 | suspicious process $process_name$ has a dns query in $QueryName$ on $Computer$ |
-
-
#### Reference
* [https://urlhaus.abuse.ch/url/1798923/](https://urlhaus.abuse.ch/url/1798923/)
@@ -104,7 +149,7 @@ Noise and false positive can be seen if the following instant messaging is allow
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-01-19-suspicious_process_with_discord_dns_query.md b/docs/_posts/2022-01-19-suspicious_process_with_discord_dns_query.md
index 15514a149f..c102f70073 100644
--- a/docs/_posts/2022-01-19-suspicious_process_with_discord_dns_query.md
+++ b/docs/_posts/2022-01-19-suspicious_process_with_discord_dns_query.md
@@ -27,16 +27,21 @@ tags:
This analytic identifies a process making a DNS query to Discord, a well known instant messaging and digital distribution platform. Discord can be abused by adversaries, as seen in the WhisperGate campaign, to host and download malicious. external files. A process resolving a Discord DNS name could be an indicator of malware trying to download files from Discord for further execution.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2022-01-19
- **Author**: Teoderick Contreras, Splunk
- **ID**: 4d4332ae-792c-11ec-89c1-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,57 @@ This analytic identifies a process making a DNS query to Discord, a well known i
| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -56,10 +112,10 @@ This analytic identifies a process making a DNS query to Discord, a well known i
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `suspicious_process_with_discord_dns_query_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **suspicious_process_with_discord_dns_query_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -82,9 +138,6 @@ Noise and false positive can be seen if the following instant messaging is allow
* [WhisperGate](/stories/whispergate)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -94,8 +147,6 @@ Noise and false positive can be seen if the following instant messaging is allow
| 64.0 | 80 | 80 | suspicious process $process_name$ has a dns query in $QueryName$ on $Computer$ |
-
-
#### Reference
* [https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/](https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/)
@@ -105,7 +156,7 @@ Noise and false positive can be seen if the following instant messaging is allow
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md b/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md
index d47dcc0755..db5f6c5ee2 100644
--- a/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md
+++ b/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md
@@ -33,16 +33,21 @@ tags:
The following analytic identifies native .net binaries within the Windows operating system that may be abused by adversaries by moving it to a new directory. The analytic identifies the .net binary by using a lookup and compares the process name and original file name (internal name). The analytic utilizes a lookup with the is_net_windows_file macro to identify the binary process name and original file name. if one or the other matches an alert will be generated. Adversaries abuse these binaries as they are native to windows and native DotNet. Note that not all SDK (post install of Windows) are captured in the lookup.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2022-01-19
- **Author**: Michael Haag, Splunk
- **ID**: fddf3b56-7933-11ec-98a6-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -54,6 +59,51 @@ The following analytic identifies native .net binaries within the Windows operat
| [T1218.004](https://attack.mitre.org/techniques/T1218/004/) | InstallUtil | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -68,11 +118,11 @@ The following analytic identifies native .net binaries within the Windows operat
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [is_net_windows_file](https://github.com/splunk/security_content/blob/develop/macros/is_net_windows_file.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `windows_dotnet_binary_in_non_standard_path_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **windows_dotnet_binary_in_non_standard_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -103,9 +153,6 @@ False positives may be present and filtering may be required. Certain utilities
* [WhisperGate](/stories/whispergate)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -115,8 +162,6 @@ False positives may be present and filtering may be required. Certain utilities
| 49.0 | 70 | 70 | An instance of $parent_process_name$ spawning $process_name$ from a non-standard path was identified on endpoint $dest$ by user $user$. |
-
-
#### Reference
* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml)
@@ -127,7 +172,7 @@ False positives may be present and filtering may be required. Certain utilities
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md b/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md
index bcf9258d8d..e887c103b9 100644
--- a/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md
+++ b/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md
@@ -33,16 +33,21 @@ tags:
The following analytic identifies the Windows binary InstallUtil.exe running from a non-standard location. The analytic utilizes a macro for InstallUtil and identifies both the process_name and original_file_name.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2022-01-19
- **Author**: Michael Haag, Splunk
- **ID**: dcf74b22-7933-11ec-857c-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -54,6 +59,51 @@ The following analytic identifies the Windows binary InstallUtil.exe running fro
| [T1218.004](https://attack.mitre.org/techniques/T1218/004/) | InstallUtil | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -67,11 +117,11 @@ The following analytic identifies the Windows binary InstallUtil.exe running fro
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `windows_installutil_in_non_standard_path_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **windows_installutil_in_non_standard_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -103,9 +153,6 @@ False positives may be present and filtering may be required. Certain utilities
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -115,8 +162,6 @@ False positives may be present and filtering may be required. Certain utilities
| 49.0 | 70 | 70 | An instance of $parent_process_name$ spawning $process_name$ from a non-standard path was identified on endpoint $dest$ by user $user$. |
-
-
#### Reference
* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml)
@@ -127,7 +172,7 @@ False positives may be present and filtering may be required. Certain utilities
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md b/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md
index 7d39b30789..19efd5ad59 100644
--- a/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md
+++ b/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md
@@ -24,21 +24,77 @@ tags:
This analytic will identify excessive file deletion events in the Windows Defender folder. This technique was seen in the WhisperGate malware campaign in which adversaries abused Nirsofts advancedrun.exe to gain administrative privilege to then execute PowerShell commands to delete files within the Windows Defender application folder. This behavior is a good indicator the offending process is trying to corrupt a Windows Defender installation.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2022-01-20
- **Author**: Teoderick Contreras, Splunk
- **ID**: b5baa09a-7a05-11ec-8da4-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1485](https://attack.mitre.org/techniques/T1485/) | Data Destruction | Impact |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +108,10 @@ This analytic will identify excessive file deletion events in the Windows Defend
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `excessive_file_deletion_in_windefender_folder_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **excessive_file_deletion_in_windefender_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -77,9 +133,6 @@ Windows Defender AV updates may cause this alert. Please update the filter macro
* [WhisperGate](/stories/whispergate)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -89,8 +142,6 @@ Windows Defender AV updates may cause this alert. Please update the filter macro
| 25.0 | 50 | 50 | High frequency file deletion activity detected on host $Computer$ |
-
-
#### Reference
* [https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/](https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/)
@@ -98,7 +149,7 @@ Windows Defender AV updates may cause this alert. Please update the filter macro
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-01-20-ping_sleep_batch_command.md b/docs/_posts/2022-01-20-ping_sleep_batch_command.md
index 389940e407..fb4539a7d4 100644
--- a/docs/_posts/2022-01-20-ping_sleep_batch_command.md
+++ b/docs/_posts/2022-01-20-ping_sleep_batch_command.md
@@ -29,16 +29,21 @@ tags:
This analytic will identify the possible execution of ping sleep batch commands. This technique was seen in several malware samples and is used to trigger sleep times without explicitly calling sleep functions or commandlets. The goal is to delay the execution of malicious code and bypass detection or sandbox analysis. This detection can be a good indicator of a process delaying its execution for malicious purposes.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2022-01-20
- **Author**: Teoderick Contreras, Splunk
- **ID**: ce058d6c-79f2-11ec-b476-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,57 @@ This analytic will identify the possible execution of ping sleep batch commands.
| [T1497.003](https://attack.mitre.org/techniques/T1497/003/) | Time Based Evasion | Defense Evasion, Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -59,11 +115,11 @@ This analytic will identify the possible execution of ping sleep batch commands.
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_ping](https://github.com/splunk/security_content/blob/develop/macros/process_ping.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `ping_sleep_batch_command_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **ping_sleep_batch_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -90,9 +146,6 @@ Administrator or network operator may execute this command. Please update the fi
* [WhisperGate](/stories/whispergate)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -102,8 +155,6 @@ Administrator or network operator may execute this command. Please update the fi
| 36.0 | 60 | 60 | suspicious $process$ commandline run in $dest$ |
-
-
#### Reference
* [https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/](https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/)
@@ -111,7 +162,7 @@ Administrator or network operator may execute this command. Please update the fi
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-01-21-windows_nirsoft_advancedrun.md b/docs/_posts/2022-01-21-windows_nirsoft_advancedrun.md
index 94b3af79b8..2e355530e0 100644
--- a/docs/_posts/2022-01-21-windows_nirsoft_advancedrun.md
+++ b/docs/_posts/2022-01-21-windows_nirsoft_advancedrun.md
@@ -24,21 +24,71 @@ tags:
The following analytic identifies the use of AdvancedRun.exe. AdvancedRun.exe has similar capabilities as other remote programs like psexec. AdvancedRun may also ingest a configuration file with all settings defined and perform its activity. The analytic is written in a way to identify a renamed binary and also the common command-line arguments.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2022-01-21
- **Author**: Michael Haag, Splunk
- **ID**: bb4f3090-7ae4-11ec-897f-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1588.002](https://attack.mitre.org/techniques/T1588/002/) | Tool | Resource Development |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +102,10 @@ The following analytic identifies the use of AdvancedRun.exe. AdvancedRun.exe ha
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `windows_nirsoft_advancedrun_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **windows_nirsoft_advancedrun_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +134,6 @@ False positives should be limited as it is specific to AdvancedRun. Filter as ne
* [WhisperGate](/stories/whispergate)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -96,8 +143,6 @@ False positives should be limited as it is specific to AdvancedRun. Filter as ne
| 60.0 | 60 | 100 | An instance of advancedrun.exe, $process_name$, was spawned by $parent_process_name$ on $dest$ by $user$. |
-
-
#### Reference
* [http://www.nirsoft.net/utils/advanced_run.html](http://www.nirsoft.net/utils/advanced_run.html)
@@ -106,7 +151,7 @@ False positives should be limited as it is specific to AdvancedRun. Filter as ne
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-01-24-windows_nirsoft_utilities.md b/docs/_posts/2022-01-24-windows_nirsoft_utilities.md
index c0b10695a7..58c3176a80 100644
--- a/docs/_posts/2022-01-24-windows_nirsoft_utilities.md
+++ b/docs/_posts/2022-01-24-windows_nirsoft_utilities.md
@@ -24,21 +24,71 @@ tags:
The following hunting analytic assists with identifying the proces execution of commonly used utilities from NirSoft. Potentially not adversary behavior, but worth identifying to know if the software is present and being used.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2022-01-24
- **Author**: Michael Haag, Splunk
- **ID**: 5b2f4596-7d4c-11ec-88a7-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1588.002](https://attack.mitre.org/techniques/T1588/002/) | Tool | Resource Development |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -53,11 +103,11 @@ The following hunting analytic assists with identifying the proces execution of
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [is_nirsoft_software](https://github.com/splunk/security_content/blob/develop/macros/is_nirsoft_software.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `windows_nirsoft_utilities_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **windows_nirsoft_utilities_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +134,6 @@ False positives may be present. Filtering may be required before setting to aler
* [WhisperGate](/stories/whispergate)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -96,8 +143,6 @@ False positives may be present. Filtering may be required before setting to aler
| 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ related to NiRSoft software usage. |
-
-
#### Reference
* [https://www.cisa.gov/uscert/ncas/alerts/TA18-201A](https://www.cisa.gov/uscert/ncas/alerts/TA18-201A)
@@ -107,7 +152,7 @@ False positives may be present. Filtering may be required before setting to aler
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-01-26-active_setup_registry_autostart.md b/docs/_posts/2022-01-26-active_setup_registry_autostart.md
index a40afd8a63..0a50b83139 100644
--- a/docs/_posts/2022-01-26-active_setup_registry_autostart.md
+++ b/docs/_posts/2022-01-26-active_setup_registry_autostart.md
@@ -29,16 +29,21 @@ tags:
This analytic is to detect a suspicious modification of the active setup registry for persistence and privilege escalation. This technique was seen in several malware (poisonIvy), adware and APT to gain persistence to the compromised machine upon boot up. This TTP is a good indicator to further check the process id that do the modification since modification of this registry is not commonly done. check the legitimacy of the file and process involve in this rules to check if it is a valid setup installer that creating or modifying this registry.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2022-01-26
- **Author**: Teoderick Contreras, Splunk
- **ID**: f64579c0-203f-11ec-abcc-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,51 @@ This analytic is to detect a suspicious modification of the active setup registr
| [T1547](https://attack.mitre.org/techniques/T1547/) | Boot or Logon Autostart Execution | Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -66,7 +116,7 @@ This analytic is to detect a suspicious modification of the active setup registr
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `active_setup_registry_autostart_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **active_setup_registry_autostart_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -88,9 +138,6 @@ Active setup installer may add or modify this registry.
* [Windows Privilege Escalation](/stories/windows_privilege_escalation)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -100,8 +147,6 @@ Active setup installer may add or modify this registry.
| 64.0 | 80 | 80 | modified/added/deleted registry entry $Registry.registry_path$ in $dest$ |
-
-
#### Reference
* [https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor%3aWin32%2fPoisonivy.E](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor%3aWin32%2fPoisonivy.E)
@@ -110,7 +155,7 @@ Active setup installer may add or modify this registry.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-01-26-add_defaultuser_and_password_in_registry.md b/docs/_posts/2022-01-26-add_defaultuser_and_password_in_registry.md
index 2fce5334e2..e3b95c3a2e 100644
--- a/docs/_posts/2022-01-26-add_defaultuser_and_password_in_registry.md
+++ b/docs/_posts/2022-01-26-add_defaultuser_and_password_in_registry.md
@@ -27,16 +27,21 @@ tags:
this search is to detect a suspicious registry modification to implement auto admin logon to a host. This technique was seen in BlackMatter ransomware to automatically logon to the compromise host after triggering a safemode boot to continue encrypting the whole network. This behavior is not a common practice and really a suspicious TTP or alert need to be consider if found within then network premise.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2022-01-26
- **Author**: Teoderick Contreras, Splunk
- **ID**: d4a3eb62-0f1e-11ec-a971-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ this search is to detect a suspicious registry modification to implement auto ad
| [T1552](https://attack.mitre.org/techniques/T1552/) | Unsecured Credentials | Credential Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -64,7 +114,7 @@ this search is to detect a suspicious registry modification to implement auto ad
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `add_defaultuser_and_password_in_registry_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **add_defaultuser_and_password_in_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +134,6 @@ unknown
* [BlackMatter Ransomware](/stories/blackmatter_ransomware)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -96,8 +143,6 @@ unknown
| 25.0 | 50 | 50 | modified registry key $registry_key_name$ with registry value $registry_value_name$ to prepare autoadminlogon |
-
-
#### Reference
* [https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/](https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/)
@@ -105,7 +150,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-01-26-allow_inbound_traffic_by_firewall_rule_registry.md b/docs/_posts/2022-01-26-allow_inbound_traffic_by_firewall_rule_registry.md
index 10d6f22a3b..399c21f3de 100644
--- a/docs/_posts/2022-01-26-allow_inbound_traffic_by_firewall_rule_registry.md
+++ b/docs/_posts/2022-01-26-allow_inbound_traffic_by_firewall_rule_registry.md
@@ -27,16 +27,21 @@ tags:
This analytic detects a potential suspicious modification of firewall rule registry allowing inbound traffic in specific port with public profile. This technique was identified when an adversary wants to grant remote access to a machine by allowing the traffic in a firewall rule.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2022-01-26
- **Author**: Teoderick Contreras, Splunk
- **ID**: 0a46537c-be02-11eb-92ca-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This analytic detects a potential suspicious modification of firewall rule regis
| [T1021](https://attack.mitre.org/techniques/T1021/) | Remote Services | Lateral Movement |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -71,7 +121,7 @@ This analytic detects a potential suspicious modification of firewall rule regis
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `allow_inbound_traffic_by_firewall_rule_registry_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **allow_inbound_traffic_by_firewall_rule_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -93,9 +143,6 @@ network admin may add/remove/modify public inbound firewall rule that may cause
* [Windows Registry Abuse](/stories/windows_registry_abuse)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -105,8 +152,6 @@ network admin may add/remove/modify public inbound firewall rule that may cause
| 3.0 | 10 | 30 | Suspicious firewall modifications were detected via the registry on endpoint $dest$ by user $user$. |
-
-
#### Reference
* [https://docs.microsoft.com/en-us/powershell/module/netsecurity/new-netfirewallrule?view=windowsserver2019-ps](https://docs.microsoft.com/en-us/powershell/module/netsecurity/new-netfirewallrule?view=windowsserver2019-ps)
@@ -114,7 +159,7 @@ network admin may add/remove/modify public inbound firewall rule that may cause
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-01-26-allow_operation_with_consent_admin.md b/docs/_posts/2022-01-26-allow_operation_with_consent_admin.md
index 63e0095b91..b8a47a358d 100644
--- a/docs/_posts/2022-01-26-allow_operation_with_consent_admin.md
+++ b/docs/_posts/2022-01-26-allow_operation_with_consent_admin.md
@@ -25,21 +25,71 @@ tags:
This analytic identifies a potential privilege escalation attempt to perform malicious task. This registry modification is designed to allow the `Consent Admin` to perform an operation that requires elevation without consent or credentials. We also found this in some attacker to gain privilege escalation to the compromise machine.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2022-01-26
- **Author**: Teoderick Contreras, Splunk
- **ID**: 7de17d7a-c9d8-11eb-a812-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -60,7 +110,7 @@ This analytic identifies a potential privilege escalation attempt to perform mal
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `allow_operation_with_consent_admin_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **allow_operation_with_consent_admin_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -81,9 +131,6 @@ unknown
* [Windows Registry Abuse](/stories/windows_registry_abuse)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -93,8 +140,6 @@ unknown
| 25.0 | 50 | 50 | Suspicious registry modification was performed on endpoint $dest$ by user $user$. This behavior is indicative of privilege escalation. |
-
-
#### Reference
* [https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-gpsb/341747f5-6b5d-4d30-85fc-fa1cc04038d4](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-gpsb/341747f5-6b5d-4d30-85fc-fa1cc04038d4)
@@ -103,7 +148,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-01-26-disable_amsi_through_registry.md b/docs/_posts/2022-01-26-disable_amsi_through_registry.md
index dc5aa85b37..f6cdfc655c 100644
--- a/docs/_posts/2022-01-26-disable_amsi_through_registry.md
+++ b/docs/_posts/2022-01-26-disable_amsi_through_registry.md
@@ -27,16 +27,21 @@ tags:
this search is to identify modification in registry to disable AMSI windows feature to evade detections. This technique was seen in several ransomware, RAT and even APT to impaire defenses of the compromise machine and to be able to execute payload with minimal alert as much as possible.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2022-01-26
- **Author**: Teoderick Contreras, Splunk
- **ID**: 9c27ec42-d338-11eb-9044-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ this search is to identify modification in registry to disable AMSI windows feat
| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -64,7 +114,7 @@ this search is to identify modification in registry to disable AMSI windows feat
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `disable_amsi_through_registry_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **disable_amsi_through_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -86,9 +136,6 @@ network operator may disable this feature of windows but not so common.
* [Windows Registry Abuse](/stories/windows_registry_abuse)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -98,8 +145,6 @@ network operator may disable this feature of windows but not so common.
| 25.0 | 50 | 50 | Disable AMSI Through Registry |
-
-
#### Reference
* [https://blog.f-secure.com/hunting-for-amsi-bypasses/](https://blog.f-secure.com/hunting-for-amsi-bypasses/)
@@ -108,7 +153,7 @@ network operator may disable this feature of windows but not so common.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-01-26-disable_defender_antivirus_registry.md b/docs/_posts/2022-01-26-disable_defender_antivirus_registry.md
index afcf0dd18e..7e1001b8c8 100644
--- a/docs/_posts/2022-01-26-disable_defender_antivirus_registry.md
+++ b/docs/_posts/2022-01-26-disable_defender_antivirus_registry.md
@@ -27,16 +27,21 @@ tags:
This particular behavior is typically executed when an adversaries or malware gains access to an endpoint and beings to perform execution and to evade detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2022-01-26
- **Author**: Teoderick Contreras, Splunk
- **ID**: aa4f695a-3024-11ec-9987-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This particular behavior is typically executed when an adversaries or malware ga
| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -64,7 +114,7 @@ This particular behavior is typically executed when an adversaries or malware ga
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `disable_defender_antivirus_registry_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **disable_defender_antivirus_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -87,9 +137,6 @@ admin or user may choose to disable windows defender product
* [Windows Registry Abuse](/stories/windows_registry_abuse)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -99,8 +146,6 @@ admin or user may choose to disable windows defender product
| 49.0 | 70 | 70 | modified/added/deleted registry entry $registry_path$ in $dest$ |
-
-
#### Reference
* [https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/](https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/)
@@ -108,7 +153,7 @@ admin or user may choose to disable windows defender product
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-01-26-disable_defender_blockatfirstseen_feature.md b/docs/_posts/2022-01-26-disable_defender_blockatfirstseen_feature.md
index 236dd647a6..b0bd369bf8 100644
--- a/docs/_posts/2022-01-26-disable_defender_blockatfirstseen_feature.md
+++ b/docs/_posts/2022-01-26-disable_defender_blockatfirstseen_feature.md
@@ -27,16 +27,21 @@ tags:
This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the BlockAtFirstSeen feature where it block suspicious file first seen in the host.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2022-01-26
- **Author**: Teoderick Contreras
- **ID**: 2dd719ac-3021-11ec-97b4-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This analytic is to detect a suspicious modification of registry to disable wind
| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -64,7 +114,7 @@ This analytic is to detect a suspicious modification of registry to disable wind
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `disable_defender_blockatfirstseen_feature_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **disable_defender_blockatfirstseen_feature_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -87,9 +137,6 @@ admin or user may choose to disable windows defender product
* [Windows Registry Abuse](/stories/windows_registry_abuse)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -99,8 +146,6 @@ admin or user may choose to disable windows defender product
| 49.0 | 70 | 70 | modified/added/deleted registry entry $registry_path$ in $dest$ |
-
-
#### Reference
* [https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/](https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/)
@@ -108,7 +153,7 @@ admin or user may choose to disable windows defender product
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-01-26-disable_defender_enhanced_notification.md b/docs/_posts/2022-01-26-disable_defender_enhanced_notification.md
index 6f60420950..5ced3b3e0f 100644
--- a/docs/_posts/2022-01-26-disable_defender_enhanced_notification.md
+++ b/docs/_posts/2022-01-26-disable_defender_enhanced_notification.md
@@ -27,16 +27,21 @@ tags:
This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the Enhanced Notification feature wher user or admin set to show or display alerts.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2022-01-26
- **Author**: Teoderick Contreras, Splunk
- **ID**: dc65678c-301f-11ec-8e30-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This analytic is to detect a suspicious modification of registry to disable wind
| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -64,7 +114,7 @@ This analytic is to detect a suspicious modification of registry to disable wind
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `disable_defender_enhanced_notification_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **disable_defender_enhanced_notification_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -87,9 +137,6 @@ user may choose to disable windows defender AV
* [Windows Registry Abuse](/stories/windows_registry_abuse)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -99,8 +146,6 @@ user may choose to disable windows defender AV
| 49.0 | 70 | 70 | modified/added/deleted registry entry $registry_path$ in $dest$ |
-
-
#### Reference
* [https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/](https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/)
@@ -108,7 +153,7 @@ user may choose to disable windows defender AV
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-01-26-disable_defender_mpengine_registry.md b/docs/_posts/2022-01-26-disable_defender_mpengine_registry.md
index ff29d76e5f..6f2a54b953 100644
--- a/docs/_posts/2022-01-26-disable_defender_mpengine_registry.md
+++ b/docs/_posts/2022-01-26-disable_defender_mpengine_registry.md
@@ -27,16 +27,21 @@ tags:
This particular behavior is typically executed when an adversaries or malware gains access to an endpoint and beings to perform execution and to evade detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2022-01-26
- **Author**: Teoderick Contreras, Splunk
- **ID**: cc391750-3024-11ec-955a-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This particular behavior is typically executed when an adversaries or malware ga
| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -64,7 +114,7 @@ This particular behavior is typically executed when an adversaries or malware ga
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `disable_defender_mpengine_registry_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **disable_defender_mpengine_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -87,9 +137,6 @@ admin or user may choose to disable windows defender product
* [Windows Registry Abuse](/stories/windows_registry_abuse)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -99,8 +146,6 @@ admin or user may choose to disable windows defender product
| 49.0 | 70 | 70 | modified/added/deleted registry entry $registry_path$ in $dest$ |
-
-
#### Reference
* [https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/](https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/)
@@ -108,7 +153,7 @@ admin or user may choose to disable windows defender product
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-01-26-disable_defender_spynet_reporting.md b/docs/_posts/2022-01-26-disable_defender_spynet_reporting.md
index 9688a567d9..1bac9efd0a 100644
--- a/docs/_posts/2022-01-26-disable_defender_spynet_reporting.md
+++ b/docs/_posts/2022-01-26-disable_defender_spynet_reporting.md
@@ -27,16 +27,21 @@ tags:
This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the spynet reporting for its telemetry.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2022-01-26
- **Author**: Teoderick Contreras, Splunk
- **ID**: 898debf4-3021-11ec-ba7c-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This analytic is to detect a suspicious modification of registry to disable wind
| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -64,7 +114,7 @@ This analytic is to detect a suspicious modification of registry to disable wind
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `disable_defender_spynet_reporting_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **disable_defender_spynet_reporting_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -87,9 +137,6 @@ admin or user may choose to disable windows defender product
* [Windows Registry Abuse](/stories/windows_registry_abuse)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -99,8 +146,6 @@ admin or user may choose to disable windows defender product
| 49.0 | 70 | 70 | modified/added/deleted registry entry $registry_path$ in $dest$ |
-
-
#### Reference
* [https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/](https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/)
@@ -108,7 +153,7 @@ admin or user may choose to disable windows defender product
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-01-26-disable_defender_submit_samples_consent_feature.md b/docs/_posts/2022-01-26-disable_defender_submit_samples_consent_feature.md
index c843c2709a..83e2346ca1 100644
--- a/docs/_posts/2022-01-26-disable_defender_submit_samples_consent_feature.md
+++ b/docs/_posts/2022-01-26-disable_defender_submit_samples_consent_feature.md
@@ -27,16 +27,21 @@ tags:
his analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the submit samples feature for further analysis..
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2022-01-26
- **Author**: Teoderick Contreras, Splunk
- **ID**: 73922ff8-3022-11ec-bf5e-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ his analytic is to detect a suspicious modification of registry to disable windo
| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -64,7 +114,7 @@ his analytic is to detect a suspicious modification of registry to disable windo
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `disable_defender_submit_samples_consent_feature_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **disable_defender_submit_samples_consent_feature_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -87,9 +137,6 @@ admin or user may choose to disable windows defender product
* [Windows Registry Abuse](/stories/windows_registry_abuse)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -99,8 +146,6 @@ admin or user may choose to disable windows defender product
| 49.0 | 70 | 70 | modified/added/deleted registry entry $Registry.registry_path$ in $dest$ |
-
-
#### Reference
* [https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/](https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/)
@@ -108,7 +153,7 @@ admin or user may choose to disable windows defender product
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-01-26-log4shell_cve-2021-44228_exploitation.md b/docs/_posts/2022-01-26-log4shell_cve-2021-44228_exploitation.md
index 299ebcbad7..ac25bfdba6 100644
--- a/docs/_posts/2022-01-26-log4shell_cve-2021-44228_exploitation.md
+++ b/docs/_posts/2022-01-26-log4shell_cve-2021-44228_exploitation.md
@@ -28,18 +28,23 @@ tags:
#### Description
-This correlation find exploitation of Log4Shell CVE-2021-44228 against systems using detections from Splunk Security Content Analytic Story. It does this by calculating the distinct count of MITRE ATT&CK tactics from Log4Shell detections fired. If the count is larger than 2 or more distinct MITRE ATT&CK tactics we assume high problability of exploitation. The Analytic story breaks down into 3 major phases of a Log4Shell exploitation, specifically 1. Initial Payload delivery eg. `${jndi:ldap://PAYLOAD_INJECTED}` 2. Call back to malicious LDAP server eg. Exploit.class 3. Post Exploitation Activity/Lateral Movement using Powershell or similar T1562.001 Each of these phases fall into different MITRE ATT&CK Tactics (Initial Access, Execution, Command and Control), by looking into 2 or more phases showing up in detections triggerd is how this correlation search finds exploitation. If we get a notable from this correlation search the best way to triage it is by investigating the affected systems against Log4Shell exploitation using Splunk SOAR playbooks.
+This correlation find exploitation of Log4Shell CVE-2021-44228 against systems using detections from Splunk Security Content Analytic Story. It does this by calculating the distinct count of MITRE ATT&CK tactics from Log4Shell detections fired. If the count is larger than 2 or more distinct MITRE ATT&CK tactics we assume high problability of exploitation. The Analytic story breaks down into 3 major phases of a Log4Shell exploitation, specifically> Initial Payload delivery eg. `${jndi:ldap://PAYLOAD_INJECTED}` Call back to malicious LDAP server eg. Exploit.class Post Exploitation Activity/Lateral Movement using Powershell or similar T1562.001 Each of these phases fall into different MITRE ATT&CK Tactics (Initial Access, Execution, Command and Control), by looking into 2 or more phases showing up in detections triggerd is how this correlation search finds exploitation. If we get a notable from this correlation search the best way to triage it is by investigating the affected systems against Log4Shell exploitation using Splunk SOAR playbooks.
-- **Type**: [Correlation](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Correlation](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Risk](https://docs.splunk.com/Documentation/CIM/latest/User/Risk)
-
- **Last Updated**: 2022-01-26
- **Author**: Jose Hernandez, Splunk
- **ID**: 9be30d80-3a39-4df9-9102-64a467b24eac
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -49,6 +54,58 @@ This correlation find exploitation of Log4Shell CVE-2021-44228 against systems u
| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -64,10 +121,10 @@ This correlation find exploitation of Log4Shell CVE-2021-44228 against systems u
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `log4shell_cve-2021-44228_exploitation_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **log4shell_cve-2021-44228_exploitation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -88,10 +145,6 @@ There are no known false positive for this search, but it could contain false po
* [Log4Shell CVE-2021-44228](/stories/log4shell_cve-2021-44228)
-#### Kill Chain Phase
-* Reconnaissance
-* Exploitation
-
#### RBA
@@ -101,8 +154,6 @@ There are no known false positive for this search, but it could contain false po
| 63.0 | 90 | 70 | Log4Shell Exploitation detected against $affected_systems$ |
-
-
#### Reference
* [https://research.splunk.com/stories/log4shell_cve-2021-44228/](https://research.splunk.com/stories/log4shell_cve-2021-44228/)
@@ -111,7 +162,7 @@ There are no known false positive for this search, but it could contain false po
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-01-26-registry_keys_used_for_persistence.md b/docs/_posts/2022-01-26-registry_keys_used_for_persistence.md
index 8dea353247..bd27363836 100644
--- a/docs/_posts/2022-01-26-registry_keys_used_for_persistence.md
+++ b/docs/_posts/2022-01-26-registry_keys_used_for_persistence.md
@@ -29,16 +29,21 @@ tags:
The search looks for modifications to registry keys that can be used to launch an application or service at system startup.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2022-01-26
- **Author**: Jose Hernandez, David Dorsey, Teoderick Contreras, Rod Soto, Splunk
- **ID**: f5f6af30-7aa7-4295-bfe9-07fe87c01a4b
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,57 @@ The search looks for modifications to registry keys that can be used to launch a
| [T1547](https://attack.mitre.org/techniques/T1547/) | Boot or Logon Autostart Execution | Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+* DE.AE
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -66,7 +122,7 @@ The search looks for modifications to registry keys that can be used to launch a
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `registry_keys_used_for_persistence_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **registry_keys_used_for_persistence_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -95,9 +151,6 @@ There are many legitimate applications that must execute on system startup and w
* [Windows Registry Abuse](/stories/windows_registry_abuse)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -107,13 +160,11 @@ There are many legitimate applications that must execute on system startup and w
| 76.0 | 80 | 95 | A registry activity in $registry_path$ related to persistence in host $dest$ |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-01-26-registry_keys_used_for_privilege_escalation.md b/docs/_posts/2022-01-26-registry_keys_used_for_privilege_escalation.md
index 3aaec0a78f..76ccb4209f 100644
--- a/docs/_posts/2022-01-26-registry_keys_used_for_privilege_escalation.md
+++ b/docs/_posts/2022-01-26-registry_keys_used_for_privilege_escalation.md
@@ -28,16 +28,21 @@ tags:
This search looks for modifications to registry keys that can be used to elevate privileges. The registry keys under "Image File Execution Options" are used to intercept calls to an executable and can be used to attach malicious binaries to benign system binaries.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2022-01-26
- **Author**: David Dorsey, Teoderick Contreras, Splunk
- **ID**: c9f4b923-f8af-4155-b697-1354f5bcbc5e
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -45,6 +50,56 @@ This search looks for modifications to registry keys that can be used to elevate
| [T1546](https://attack.mitre.org/techniques/T1546/) | Event Triggered Execution | Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -65,7 +120,7 @@ This search looks for modifications to registry keys that can be used to elevate
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `registry_keys_used_for_privilege_escalation_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **registry_keys_used_for_privilege_escalation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -88,9 +143,6 @@ There are many legitimate applications that must execute upon system startup and
* [Windows Registry Abuse](/stories/windows_registry_abuse)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -100,8 +152,6 @@ There are many legitimate applications that must execute upon system startup and
| 76.0 | 80 | 95 | A registry activity in $registry_path$ related to privilege escalation in host $dest$ |
-
-
#### Reference
* [https://blog.malwarebytes.com/101/2015/12/an-introduction-to-image-file-execution-options/](https://blog.malwarebytes.com/101/2015/12/an-introduction-to-image-file-execution-options/)
@@ -109,7 +159,7 @@ There are many legitimate applications that must execute upon system startup and
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-01-26-remcos_client_registry_install_entry.md b/docs/_posts/2022-01-26-remcos_client_registry_install_entry.md
index 604df9a08c..34b3e28dd9 100644
--- a/docs/_posts/2022-01-26-remcos_client_registry_install_entry.md
+++ b/docs/_posts/2022-01-26-remcos_client_registry_install_entry.md
@@ -24,21 +24,71 @@ tags:
This search detects registry key license at host where Remcos RAT agent is installed.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2022-01-26
- **Author**: Bhavin Patel, Rod Soto, Teoderick Contreras, Splunk
- **ID**: f2a1615a-1d63-11ec-97d2-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -59,7 +109,7 @@ This search detects registry key license at host where Remcos RAT agent is insta
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `remcos_client_registry_install_entry_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **remcos_client_registry_install_entry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -81,9 +131,6 @@ unknown
* [Windows Registry Abuse](/stories/windows_registry_abuse)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -93,8 +140,6 @@ unknown
| 90.0 | 90 | 100 | A registry entry $registry_path$ with registry keyname $registry_key_name$ related to Remcos RAT in host $dest$ |
-
-
#### Reference
* [https://attack.mitre.org/software/S0332/](https://attack.mitre.org/software/S0332/)
@@ -102,7 +147,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-01-26-start_up_during_safe_mode_boot.md b/docs/_posts/2022-01-26-start_up_during_safe_mode_boot.md
index 893352cca1..da8d3e6238 100644
--- a/docs/_posts/2022-01-26-start_up_during_safe_mode_boot.md
+++ b/docs/_posts/2022-01-26-start_up_during_safe_mode_boot.md
@@ -29,16 +29,21 @@ tags:
This search is to detect a modification or registry add to the safeboot registry as an autostart mechanism. This technique was seen in some ransomware to automatically execute its code upon a safe mode boot.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2022-01-26
- **Author**: Teoderick Contreras, Splunk
- **ID**: c6149154-c9d8-11eb-9da7-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,51 @@ This search is to detect a modification or registry add to the safeboot registry
| [T1547](https://attack.mitre.org/techniques/T1547/) | Boot or Logon Autostart Execution | Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -66,7 +116,7 @@ This search is to detect a modification or registry add to the safeboot registry
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `start_up_during_safe_mode_boot_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **start_up_during_safe_mode_boot_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -86,9 +136,6 @@ updated windows application needed in safe boot may used this registry
* [Ransomware](/stories/ransomware)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -98,8 +145,6 @@ updated windows application needed in safe boot may used this registry
| 42.0 | 60 | 70 | Safeboot registry $registry_path$ was added or modified with a new value $registry_value_name$ on $dest$ |
-
-
#### Reference
* [https://malware.news/t/threat-analysis-unit-tau-threat-intelligence-notification-snatch-ransomware/36365](https://malware.news/t/threat-analysis-unit-tau-threat-intelligence-notification-snatch-ransomware/36365)
@@ -107,7 +152,7 @@ updated windows application needed in safe boot may used this registry
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-01-26-time_provider_persistence_registry.md b/docs/_posts/2022-01-26-time_provider_persistence_registry.md
index c215f1c3b2..cc81080794 100644
--- a/docs/_posts/2022-01-26-time_provider_persistence_registry.md
+++ b/docs/_posts/2022-01-26-time_provider_persistence_registry.md
@@ -29,16 +29,21 @@ tags:
This analytic is to detect a suspicious modification of time provider registry for persistence and autostart. This technique can allow the attacker to persist on the compromised host and autostart as soon as the machine boot up. This TTP can be a good indicator of suspicious behavior since this registry is not commonly modified by normal user or even an admin.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2022-01-26
- **Author**: Teoderick Contreras, Splunk
- **ID**: 5ba382c4-2105-11ec-8d8f-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,51 @@ This analytic is to detect a suspicious modification of time provider registry f
| [T1547](https://attack.mitre.org/techniques/T1547/) | Boot or Logon Autostart Execution | Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -66,7 +116,7 @@ This analytic is to detect a suspicious modification of time provider registry f
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `time_provider_persistence_registry_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **time_provider_persistence_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -89,9 +139,6 @@ unknown
* [Windows Registry Abuse](/stories/windows_registry_abuse)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -101,8 +148,6 @@ unknown
| 80.0 | 80 | 100 | modified/added/deleted registry entry $Registry.registry_path$ in $dest$ |
-
-
#### Reference
* [https://pentestlab.blog/2019/10/22/persistence-time-providers/](https://pentestlab.blog/2019/10/22/persistence-time-providers/)
@@ -111,7 +156,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-01-27-disable_etw_through_registry.md b/docs/_posts/2022-01-27-disable_etw_through_registry.md
index 4b60d254b8..0002168ccf 100644
--- a/docs/_posts/2022-01-27-disable_etw_through_registry.md
+++ b/docs/_posts/2022-01-27-disable_etw_through_registry.md
@@ -27,16 +27,21 @@ tags:
this search is to identify modification in registry to disable ETW windows feature to evade detections. This technique was seen in several ransomware, RAT and even APT to impaire defenses of the compromise machine and to be able to execute payload with minimal alert as much as possible.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2022-01-27
- **Author**: Teoderick Contreras, Splunk
- **ID**: f0eacfa4-d33f-11eb-8f9d-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ this search is to identify modification in registry to disable ETW windows featu
| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -64,7 +114,7 @@ this search is to identify modification in registry to disable ETW windows featu
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `disable_etw_through_registry_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **disable_etw_through_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -86,9 +136,6 @@ network operator may disable this feature of windows but not so common.
* [Windows Registry Abuse](/stories/windows_registry_abuse)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -98,8 +145,6 @@ network operator may disable this feature of windows but not so common.
| 25.0 | 50 | 50 | Disable ETW Through Registry |
-
-
#### Reference
* [https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/](https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/)
@@ -107,7 +152,7 @@ network operator may disable this feature of windows but not so common.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-01-27-disable_registry_tool.md b/docs/_posts/2022-01-27-disable_registry_tool.md
index 3917533bc4..a6e8497827 100644
--- a/docs/_posts/2022-01-27-disable_registry_tool.md
+++ b/docs/_posts/2022-01-27-disable_registry_tool.md
@@ -27,16 +27,21 @@ tags:
This search identifies modification of registry to disable the regedit or registry tools of the windows operating system. Since registry tool is a swiss knife in analyzing registry, malware such as RAT or trojan Spy disable this application to prevent the removal of their registry entry such as persistence, file less components and defense evasion.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2022-01-27
- **Author**: Teoderick Contreras, Splunk
- **ID**: cd2cf33c-9201-11eb-a10a-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This search identifies modification of registry to disable the regedit or regist
| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -64,7 +114,7 @@ This search identifies modification of registry to disable the regedit or regist
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `disable_registry_tool_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **disable_registry_tool_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -86,9 +136,6 @@ admin may disable this application for non technical user.
* [Windows Registry Abuse](/stories/windows_registry_abuse)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -98,8 +145,6 @@ admin may disable this application for non technical user.
| 40.0 | 40 | 100 | Disabled Registry Tools on $dest$ |
-
-
#### Reference
* [https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry](https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry)
@@ -107,7 +152,7 @@ admin may disable this application for non technical user.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-01-27-disable_security_logs_using_minint_registry.md b/docs/_posts/2022-01-27-disable_security_logs_using_minint_registry.md
index be1ad9a5e9..cbc4235332 100644
--- a/docs/_posts/2022-01-27-disable_security_logs_using_minint_registry.md
+++ b/docs/_posts/2022-01-27-disable_security_logs_using_minint_registry.md
@@ -24,21 +24,71 @@ tags:
This analytic is to detect a suspicious registry modification to disable security audit logs. This technique was shared by a researcher to disable Security logs of windows by adding this registry. The Windows will think it is WinPE and will not log any event to the Security Log
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2022-01-27
- **Author**: Teoderick Contreras, Splunk
- **ID**: 39ebdc68-25b9-11ec-aec7-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -59,7 +109,7 @@ This analytic is to detect a suspicious registry modification to disable securit
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `disable_security_logs_using_minint_registry_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **disable_security_logs_using_minint_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -82,9 +132,6 @@ Unknown.
* [Windows Registry Abuse](/stories/windows_registry_abuse)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -94,8 +141,6 @@ Unknown.
| 80.0 | 80 | 100 | modified/added/deleted registry entry $Registry.registry_path$ in $dest$ |
-
-
#### Reference
* [https://twitter.com/0gtweet/status/1182516740955226112](https://twitter.com/0gtweet/status/1182516740955226112)
@@ -103,7 +148,7 @@ Unknown.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-01-27-disable_show_hidden_files.md b/docs/_posts/2022-01-27-disable_show_hidden_files.md
index 41eb7f6efd..06738053ba 100644
--- a/docs/_posts/2022-01-27-disable_show_hidden_files.md
+++ b/docs/_posts/2022-01-27-disable_show_hidden_files.md
@@ -33,16 +33,21 @@ tags:
The following analytic is to identify a modification in the Windows registry to prevent users from seeing all the files with hidden attributes. This event or techniques are known on some worm and trojan spy malware that will drop hidden files on the infected machine.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2022-01-27
- **Author**: Teoderick Contreras, Mauricio Velazco, Splunk
- **ID**: 6f3ccfa2-91fe-11eb-8f9b-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -54,6 +59,51 @@ The following analytic is to identify a modification in the Windows registry to
| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -74,7 +124,7 @@ The following analytic is to identify a modification in the Windows registry to
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `disable_show_hidden_files_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **disable_show_hidden_files_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -96,9 +146,6 @@ unknown
* [Windows Registry Abuse](/stories/windows_registry_abuse)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -108,8 +155,6 @@ unknown
| 40.0 | 40 | 100 | Disabled 'Show Hidden Files' on $dest$ |
-
-
#### Reference
* [https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Tiotua-P/detailed-analysis.aspx](https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Tiotua-P/detailed-analysis.aspx)
@@ -117,7 +162,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-01-27-disable_uac_remote_restriction.md b/docs/_posts/2022-01-27-disable_uac_remote_restriction.md
index b7248fbdc7..d871e4c89a 100644
--- a/docs/_posts/2022-01-27-disable_uac_remote_restriction.md
+++ b/docs/_posts/2022-01-27-disable_uac_remote_restriction.md
@@ -29,16 +29,21 @@ tags:
This analytic is to detect a suspicious modification of registry to disable UAC remote restriction. This technique was well documented in Microsoft page where attacker may modify this registry value to bypassed UAC feature of windows host. This is a good indicator that some tries to bypassed UAC to suspicious process or gain privilege escalation.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2022-01-27
- **Author**: Teoderick Contreras, Splunk
- **ID**: 9928b732-210e-11ec-b65e-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,51 @@ This analytic is to detect a suspicious modification of registry to disable UAC
| [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -66,7 +116,7 @@ This analytic is to detect a suspicious modification of registry to disable UAC
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `disable_uac_remote_restriction_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **disable_uac_remote_restriction_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -90,9 +140,6 @@ admin may set this policy for non-critical machine.
* [Windows Registry Abuse](/stories/windows_registry_abuse)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -102,8 +149,6 @@ admin may set this policy for non-critical machine.
| 80.0 | 80 | 100 | modified/added/deleted registry entry $Registry.registry_path$ in $dest$ |
-
-
#### Reference
* [https://docs.microsoft.com/en-us/troubleshoot/windows-server/windows-security/user-account-control-and-remote-restriction](https://docs.microsoft.com/en-us/troubleshoot/windows-server/windows-security/user-account-control-and-remote-restriction)
@@ -111,7 +156,7 @@ admin may set this policy for non-critical machine.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-01-27-disable_windows_app_hotkeys.md b/docs/_posts/2022-01-27-disable_windows_app_hotkeys.md
index db691b1f51..25d865b2a0 100644
--- a/docs/_posts/2022-01-27-disable_windows_app_hotkeys.md
+++ b/docs/_posts/2022-01-27-disable_windows_app_hotkeys.md
@@ -27,16 +27,21 @@ tags:
This analytic detects a suspicious registry modification to disable Windows hotkey (shortcut keys) for native Windows applications. This technique is commonly used to disable certain or several Windows applications like `taskmgr.exe` and `cmd.exe`. This technique is used to impair the analyst in analyzing and removing the attacker implant in compromised systems.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2022-01-27
- **Author**: Teoderick Contreras, Splunk
- **ID**: 1490f224-ad8b-11eb-8c4f-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This analytic detects a suspicious registry modification to disable Windows hotk
| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -64,7 +114,7 @@ This analytic detects a suspicious registry modification to disable Windows hotk
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `disable_windows_app_hotkeys_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **disable_windows_app_hotkeys_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -85,9 +135,6 @@ unknown
* [Windows Registry Abuse](/stories/windows_registry_abuse)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -97,8 +144,6 @@ unknown
| 40.0 | 40 | 100 | Disabled 'Windows App Hotkeys' on $dest$ |
-
-
#### Reference
* [https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/](https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/)
@@ -106,7 +151,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-01-27-disable_windows_behavior_monitoring.md b/docs/_posts/2022-01-27-disable_windows_behavior_monitoring.md
index d2430c1da0..4b32b8cc63 100644
--- a/docs/_posts/2022-01-27-disable_windows_behavior_monitoring.md
+++ b/docs/_posts/2022-01-27-disable_windows_behavior_monitoring.md
@@ -27,16 +27,21 @@ tags:
This search is to identifies a modification in registry to disable the windows denfender real time behavior monitoring. This event or technique is commonly seen in RAT, bot, or Trojan to disable AV to evade detections.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2022-01-27
- **Author**: Teoderick Contreras, Splunk
- **ID**: 79439cae-9200-11eb-a4d3-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This search is to identifies a modification in registry to disable the windows d
| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -64,7 +114,7 @@ This search is to identifies a modification in registry to disable the windows d
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `disable_windows_behavior_monitoring_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **disable_windows_behavior_monitoring_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -88,9 +138,6 @@ admin or user may choose to disable this windows features.
* [Windows Registry Abuse](/stories/windows_registry_abuse)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -100,8 +147,6 @@ admin or user may choose to disable this windows features.
| 40.0 | 40 | 100 | Windows Defender real time behavior monitoring disabled on $dest |
-
-
#### Reference
* [https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html](https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html)
@@ -109,7 +154,7 @@ admin or user may choose to disable this windows features.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-01-27-disable_windows_smartscreen_protection.md b/docs/_posts/2022-01-27-disable_windows_smartscreen_protection.md
index bf979f92f9..d4671e7d58 100644
--- a/docs/_posts/2022-01-27-disable_windows_smartscreen_protection.md
+++ b/docs/_posts/2022-01-27-disable_windows_smartscreen_protection.md
@@ -27,16 +27,21 @@ tags:
The following search identifies a modification of registry to disable the smartscreen protection of windows machine. This is windows feature provide an early warning system against website that might engage in phishing attack or malware distribution. This modification are seen in RAT malware to cover their tracks upon downloading other of its component or other payload.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2022-01-27
- **Author**: Teoderick Contreras, Splunk
- **ID**: 664f0fd0-91ff-11eb-a56f-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ The following search identifies a modification of registry to disable the smarts
| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -64,7 +114,7 @@ The following search identifies a modification of registry to disable the smarts
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `disable_windows_smartscreen_protection_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **disable_windows_smartscreen_protection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -86,9 +136,6 @@ admin or user may choose to disable this windows features.
* [Windows Registry Abuse](/stories/windows_registry_abuse)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -98,8 +145,6 @@ admin or user may choose to disable this windows features.
| 25.0 | 50 | 50 | The Windows Smartscreen was disabled on $dest$ by $user$. |
-
-
#### Reference
* [https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html](https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html)
@@ -107,7 +152,7 @@ admin or user may choose to disable this windows features.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-01-27-disabling_cmd_application.md b/docs/_posts/2022-01-27-disabling_cmd_application.md
index e5777fb657..863cf0d13a 100644
--- a/docs/_posts/2022-01-27-disabling_cmd_application.md
+++ b/docs/_posts/2022-01-27-disabling_cmd_application.md
@@ -27,16 +27,21 @@ tags:
this search is to identify modification in registry to disable cmd prompt application. This technique is commonly seen in RAT, Trojan or WORM to prevent triaging or deleting there samples through cmd application which is one of the tool of analyst to traverse on directory and files.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2022-01-27
- **Author**: Teoderick Contreras, Splunk
- **ID**: ff86077c-9212-11eb-a1e6-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ this search is to identify modification in registry to disable cmd prompt applic
| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -64,7 +114,7 @@ this search is to identify modification in registry to disable cmd prompt applic
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `disabling_cmd_application_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **disabling_cmd_application_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -86,9 +136,6 @@ admin may disable this application for non technical user.
* [Windows Registry Abuse](/stories/windows_registry_abuse)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -98,8 +145,6 @@ admin may disable this application for non technical user.
| 25.0 | 50 | 50 | The Windows command prompt was disabled on $dest$ by $user$. |
-
-
#### Reference
* [https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry](https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry)
@@ -107,7 +152,7 @@ admin may disable this application for non technical user.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-01-27-disabling_controlpanel.md b/docs/_posts/2022-01-27-disabling_controlpanel.md
index 54af15c294..7b8e305e79 100644
--- a/docs/_posts/2022-01-27-disabling_controlpanel.md
+++ b/docs/_posts/2022-01-27-disabling_controlpanel.md
@@ -27,16 +27,21 @@ tags:
this search is to identify registry modification to disable control panel window. This technique is commonly seen in malware to prevent their artifacts , persistence removed on the infected machine.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2022-01-27
- **Author**: Teoderick Contreras, Splunk
- **ID**: 6ae0148e-9215-11eb-a94a-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ this search is to identify registry modification to disable control panel window
| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -64,7 +114,7 @@ this search is to identify registry modification to disable control panel window
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `disabling_controlpanel_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **disabling_controlpanel_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -86,9 +136,6 @@ admin may disable this application for non technical user.
* [Windows Registry Abuse](/stories/windows_registry_abuse)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -98,8 +145,6 @@ admin may disable this application for non technical user.
| 25.0 | 50 | 50 | The Windows Control Panel was disabled on $dest$ by $user$. |
-
-
#### Reference
* [https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry](https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry)
@@ -107,7 +152,7 @@ admin may disable this application for non technical user.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-01-27-windows_possible_credential_dumping.md b/docs/_posts/2022-01-27-windows_possible_credential_dumping.md
index a828ae2d4b..f3f96dfe7f 100644
--- a/docs/_posts/2022-01-27-windows_possible_credential_dumping.md
+++ b/docs/_posts/2022-01-27-windows_possible_credential_dumping.md
@@ -30,16 +30,21 @@ CallTrace Stack trace of where open process is called. Included is the DLL and t
dbgcore.dll or dbghelp.dll are two core Windows debug DLLs that have minidump functions which provide a way for applications to produce crashdump files that contain a useful subset of the entire process context. \
The idea behind using ntdll.dll is to blend in by using native api of ntdll.dll. For example in sekurlsa module there are many ntdll exported api, like RtlCopyMemory, used to execute this module which is related to lsass dumping.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2022-01-27
- **Author**: Michael Haag, Splunk
- **ID**: e4723b92-7266-11ec-af45-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -47,6 +52,54 @@ The idea behind using ntdll.dll is to blend in by using native api of ntdll.dll.
| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.AE
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -60,10 +113,10 @@ The idea behind using ntdll.dll is to blend in by using native api of ntdll.dll.
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `windows_possible_credential_dumping_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **windows_possible_credential_dumping_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -88,9 +141,6 @@ False positives will occur based on GrantedAccess 0x1010 and 0x1400, filter base
* [DarkSide Ransomware](/stories/darkside_ransomware)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -100,8 +150,6 @@ False positives will occur based on GrantedAccess 0x1010 and 0x1400, filter base
| 64.0 | 80 | 80 | A process, $SourceImage$, has loaded $ImageLoaded$ that are typically related to credential dumping on $dest$. Review for further details. |
-
-
#### Reference
* [https://en.wikipedia.org/wiki/Local_Security_Authority_Subsystem_Service](https://en.wikipedia.org/wiki/Local_Security_Authority_Subsystem_Service)
@@ -113,7 +161,7 @@ False positives will occur based on GrantedAccess 0x1010 and 0x1400, filter base
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-01-28-disabling_defender_services.md b/docs/_posts/2022-01-28-disabling_defender_services.md
index 3255a54b4a..b60a8f6a1b 100644
--- a/docs/_posts/2022-01-28-disabling_defender_services.md
+++ b/docs/_posts/2022-01-28-disabling_defender_services.md
@@ -27,16 +27,21 @@ tags:
This particular behavior is typically executed when an adversaries or malware gains access to an endpoint and beings to perform execution and to evade detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2022-01-28
- **Author**: Teoderick Contreras, Splunk
- **ID**: 911eacdc-317f-11ec-ad30-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This particular behavior is typically executed when an adversaries or malware ga
| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -64,7 +114,7 @@ This particular behavior is typically executed when an adversaries or malware ga
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `disabling_defender_services_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **disabling_defender_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -87,9 +137,6 @@ admin or user may choose to disable windows defender product
* [Windows Registry Abuse](/stories/windows_registry_abuse)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -99,8 +146,6 @@ admin or user may choose to disable windows defender product
| 49.0 | 70 | 70 | modified/added/deleted registry entry $registry_path$ in $dest$ |
-
-
#### Reference
* [https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/](https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/)
@@ -108,7 +153,7 @@ admin or user may choose to disable windows defender product
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-01-28-disabling_folderoptions_windows_feature.md b/docs/_posts/2022-01-28-disabling_folderoptions_windows_feature.md
index c5810de55a..6f73478f25 100644
--- a/docs/_posts/2022-01-28-disabling_folderoptions_windows_feature.md
+++ b/docs/_posts/2022-01-28-disabling_folderoptions_windows_feature.md
@@ -27,16 +27,21 @@ tags:
This search is to identify registry modification to disable folder options feature of windows to show hidden files, file extension and etc. This technique used by malware in combination if disabling show hidden files feature to hide their files and also to hide the file extension to lure the user base on file icons or fake file extensions.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2022-01-28
- **Author**: Teoderick Contreras, Splunk
- **ID**: 83776de4-921a-11eb-868a-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This search is to identify registry modification to disable folder options featu
| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -64,7 +114,7 @@ This search is to identify registry modification to disable folder options featu
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `disabling_folderoptions_windows_feature_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **disabling_folderoptions_windows_feature_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -86,9 +136,6 @@ admin may disable this application for non technical user.
* [Windows Registry Abuse](/stories/windows_registry_abuse)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -98,8 +145,6 @@ admin may disable this application for non technical user.
| 25.0 | 50 | 50 | The Windows Folder Options, to hide files, was disabled on $dest$ by $user$. |
-
-
#### Reference
* [https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry](https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry)
@@ -107,7 +152,7 @@ admin may disable this application for non technical user.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-01-28-disabling_norun_windows_app.md b/docs/_posts/2022-01-28-disabling_norun_windows_app.md
index 46ff94afef..293755b2a6 100644
--- a/docs/_posts/2022-01-28-disabling_norun_windows_app.md
+++ b/docs/_posts/2022-01-28-disabling_norun_windows_app.md
@@ -27,16 +27,21 @@ tags:
This search is to identify modification of registry to disable run application in window start menu. this application is known to be a helpful shortcut to windows OS user to run known application and also to execute some reg or batch script. This technique is used malware to make cleaning of its infection more harder by preventing known application run easily through run shortcut.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2022-01-28
- **Author**: Teoderick Contreras, Splunk
- **ID**: de81bc46-9213-11eb-adc9-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This search is to identify modification of registry to disable run application i
| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -64,7 +114,7 @@ This search is to identify modification of registry to disable run application i
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `disabling_norun_windows_app_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **disabling_norun_windows_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -86,9 +136,6 @@ admin may disable this application for non technical user.
* [Windows Registry Abuse](/stories/windows_registry_abuse)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -98,8 +145,6 @@ admin may disable this application for non technical user.
| 25.0 | 50 | 50 | The Windows registry was modified to disable run application in window start menu on $dest$ by $user$. |
-
-
#### Reference
* [https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry](https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry)
@@ -108,7 +153,7 @@ admin may disable this application for non technical user.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-01-28-disabling_systemrestore_in_registry.md b/docs/_posts/2022-01-28-disabling_systemrestore_in_registry.md
index 8a0aca455b..3a637bb7e9 100644
--- a/docs/_posts/2022-01-28-disabling_systemrestore_in_registry.md
+++ b/docs/_posts/2022-01-28-disabling_systemrestore_in_registry.md
@@ -24,21 +24,71 @@ tags:
The following search identifies the modification of registry related in disabling the system restore of a machine. This event or behavior are seen in some RAT malware to make the restore of the infected machine difficult and keep their infection on the box.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2022-01-28
- **Author**: Teoderick Contreras, Splunk
- **ID**: f4f837e2-91fb-11eb-8bf6-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1490](https://attack.mitre.org/techniques/T1490/) | Inhibit System Recovery | Impact |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -59,7 +109,7 @@ The following search identifies the modification of registry related in disablin
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `disabling_systemrestore_in_registry_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **disabling_systemrestore_in_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -81,9 +131,6 @@ in some cases admin can disable systemrestore on a machine.
* [Windows Registry Abuse](/stories/windows_registry_abuse)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -93,8 +140,6 @@ in some cases admin can disable systemrestore on a machine.
| 49.0 | 70 | 70 | The Windows registry was modified to disable system restore on $dest$ by $user$. |
-
-
#### Reference
* [https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html](https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html)
@@ -102,7 +147,7 @@ in some cases admin can disable systemrestore on a machine.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-01-28-disabling_task_manager.md b/docs/_posts/2022-01-28-disabling_task_manager.md
index 6eb3572a71..8170c723e6 100644
--- a/docs/_posts/2022-01-28-disabling_task_manager.md
+++ b/docs/_posts/2022-01-28-disabling_task_manager.md
@@ -27,16 +27,21 @@ tags:
This search is to identifies modification of registry to disable the task manager of windows operating system. this event or technique are commonly seen in malware such as RAT, Trojan, TrojanSpy or worm to prevent the user to terminate their process.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2022-01-28
- **Author**: Teoderick Contreras, Splunk
- **ID**: dac279bc-9202-11eb-b7fb-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This search is to identifies modification of registry to disable the task manage
| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -64,7 +114,7 @@ This search is to identifies modification of registry to disable the task manage
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `disabling_task_manager_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **disabling_task_manager_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -86,9 +136,6 @@ admin may disable this application for non technical user.
* [Windows Registry Abuse](/stories/windows_registry_abuse)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -98,8 +145,6 @@ admin may disable this application for non technical user.
| 42.0 | 70 | 60 | The Windows Task Manager was disabled on $dest$ by $user$. |
-
-
#### Reference
* [https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry](https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry)
@@ -108,7 +153,7 @@ admin may disable this application for non technical user.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-01-28-enable_rdp_in_other_port_number.md b/docs/_posts/2022-01-28-enable_rdp_in_other_port_number.md
index b2d5dc69ef..2bec02667e 100644
--- a/docs/_posts/2022-01-28-enable_rdp_in_other_port_number.md
+++ b/docs/_posts/2022-01-28-enable_rdp_in_other_port_number.md
@@ -24,21 +24,71 @@ tags:
This search is to detect a modification to registry to enable rdp to a machine with different port number. This technique was seen in some atttacker tries to do lateral movement and remote access to a compromised machine to gain control of it.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2022-01-28
- **Author**: Teoderick Contreras, Splunk
- **ID**: 99495452-b899-11eb-96dc-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1021](https://attack.mitre.org/techniques/T1021/) | Remote Services | Lateral Movement |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -59,7 +109,7 @@ This search is to detect a modification to registry to enable rdp to a machine w
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `enable_rdp_in_other_port_number_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **enable_rdp_in_other_port_number_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -80,9 +130,6 @@ unknown
* [Windows Registry Abuse](/stories/windows_registry_abuse)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -92,8 +139,6 @@ unknown
| 80.0 | 80 | 100 | RDP was moved to a non-standard port on $dest$ by $user$. |
-
-
#### Reference
* [https://www.mvps.net/docs/how-to-secure-remote-desktop-rdp/](https://www.mvps.net/docs/how-to-secure-remote-desktop-rdp/)
@@ -101,7 +146,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-01-28-enable_wdigest_uselogoncredential_registry.md b/docs/_posts/2022-01-28-enable_wdigest_uselogoncredential_registry.md
index 1dc1ddd812..e1c52338a0 100644
--- a/docs/_posts/2022-01-28-enable_wdigest_uselogoncredential_registry.md
+++ b/docs/_posts/2022-01-28-enable_wdigest_uselogoncredential_registry.md
@@ -27,16 +27,21 @@ tags:
This analytic is to detect a suspicious registry modification to enable plain text credential feature of windows. This technique was used by several malware and also by mimikatz to be able to dumpe the a plain text credential to the compromised or target host. This TTP is really a good indicator that someone wants to dump the crendential of the host so it must be a good pivot for credential dumping techniques.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2022-01-28
- **Author**: Teoderick Contreras, Splunk
- **ID**: 0c7d8ffe-25b1-11ec-9f39-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This analytic is to detect a suspicious registry modification to enable plain te
| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -64,7 +114,7 @@ This analytic is to detect a suspicious registry modification to enable plain te
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `enable_wdigest_uselogoncredential_registry_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **enable_wdigest_uselogoncredential_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -87,9 +137,6 @@ unknown
* [Windows Registry Abuse](/stories/windows_registry_abuse)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -99,8 +146,6 @@ unknown
| 80.0 | 80 | 100 | wdigest registry $registry_path$ was modified in $dest$ |
-
-
#### Reference
* [https://www.csoonline.com/article/3438824/how-to-detect-and-halt-credential-theft-via-windows-wdigest.html](https://www.csoonline.com/article/3438824/how-to-detect-and-halt-credential-theft-via-windows-wdigest.html)
@@ -108,7 +153,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-01-28-etw_registry_disabled.md b/docs/_posts/2022-01-28-etw_registry_disabled.md
index ebb018a996..a36690f13f 100644
--- a/docs/_posts/2022-01-28-etw_registry_disabled.md
+++ b/docs/_posts/2022-01-28-etw_registry_disabled.md
@@ -30,16 +30,21 @@ tags:
This analytic is to detect a registry modification to disable ETW feature of windows. This technique is to evade EDR appliance to evade detections and hide its execution from audit logs.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2022-01-28
- **Author**: Teoderick Contreras, Splunk
- **ID**: 8ed523ac-276b-11ec-ac39-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -49,6 +54,51 @@ This analytic is to detect a registry modification to disable ETW feature of win
| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -69,7 +119,7 @@ This analytic is to detect a registry modification to disable ETW feature of win
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `etw_registry_disabled_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **etw_registry_disabled_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -93,9 +143,6 @@ unknown
* [Windows Registry Abuse](/stories/windows_registry_abuse)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -105,8 +152,6 @@ unknown
| 90.0 | 90 | 100 | modified/added/deleted registry entry $Registry.registry_path$ in $dest$ |
-
-
#### Reference
* [https://gist.github.com/Cyb3rWard0g/a4a115fd3ab518a0e593525a379adee3](https://gist.github.com/Cyb3rWard0g/a4a115fd3ab518a0e593525a379adee3)
@@ -114,7 +159,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-01-28-eventvwr_uac_bypass.md b/docs/_posts/2022-01-28-eventvwr_uac_bypass.md
index 900e9facab..428433df49 100644
--- a/docs/_posts/2022-01-28-eventvwr_uac_bypass.md
+++ b/docs/_posts/2022-01-28-eventvwr_uac_bypass.md
@@ -29,16 +29,21 @@ tags:
The following search identifies Eventvwr bypass by identifying the registry modification into a specific path that eventvwr.msc looks to (but is not valid) upon execution. A successful attack will include a suspicious command to be executed upon eventvwr.msc loading. Upon triage, review the parallel processes that have executed. Identify any additional registry modifications on the endpoint that may look suspicious. Remediate as necessary.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2022-01-28
- **Author**: Michael Haag, Splunk
- **ID**: 9cf8fe08-7ad8-11eb-9819-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,51 @@ The following search identifies Eventvwr bypass by identifying the registry modi
| [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -66,7 +116,7 @@ The following search identifies Eventvwr bypass by identifying the registry modi
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `eventvwr_uac_bypass_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **eventvwr_uac_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -90,9 +140,6 @@ Some false positives may be present and will need to be filtered.
* [Windows Registry Abuse](/stories/windows_registry_abuse)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -102,8 +149,6 @@ Some false positives may be present and will need to be filtered.
| 80.0 | 80 | 100 | Registry values were modified to bypass UAC using Event Viewer on $dest$ by $user$. |
-
-
#### Reference
* [https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/](https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/)
@@ -114,7 +159,7 @@ Some false positives may be present and will need to be filtered.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-01-28-hide_user_account_from_sign-in_screen.md b/docs/_posts/2022-01-28-hide_user_account_from_sign-in_screen.md
index 5a27d0ed23..87dd3c7067 100644
--- a/docs/_posts/2022-01-28-hide_user_account_from_sign-in_screen.md
+++ b/docs/_posts/2022-01-28-hide_user_account_from_sign-in_screen.md
@@ -27,16 +27,21 @@ tags:
This analytic identifies a suspicious registry modification to hide a user account on the Windows Login screen. This technique was seen in some tradecraft where the adversary will create a hidden user account with Admin privileges in login screen to avoid noticing by the user that they already compromise and to persist on that said machine.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2022-01-28
- **Author**: Teoderick Contreras, Splunk
- **ID**: 834ba832-ad89-11eb-937d-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This analytic identifies a suspicious registry modification to hide a user accou
| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -64,7 +114,7 @@ This analytic identifies a suspicious registry modification to hide a user accou
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `hide_user_account_from_sign-in_screen_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **hide_user_account_from_sign-in_screen_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -85,9 +135,6 @@ Unknown. Filter as needed.
* [Windows Registry Abuse](/stories/windows_registry_abuse)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -97,8 +144,6 @@ Unknown. Filter as needed.
| 72.0 | 90 | 80 | Suspicious registry modification ($registry_value_name$) which is used go hide a user account on the Windows Login screen detected on $dest$ executed by $user$ |
-
-
#### Reference
* [https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/](https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/)
@@ -106,7 +151,7 @@ Unknown. Filter as needed.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-01-28-linux_pkexec_privilege_escalation.md b/docs/_posts/2022-01-28-linux_pkexec_privilege_escalation.md
index c8195a363c..98c5d90bf3 100644
--- a/docs/_posts/2022-01-28-linux_pkexec_privilege_escalation.md
+++ b/docs/_posts/2022-01-28-linux_pkexec_privilege_escalation.md
@@ -25,21 +25,75 @@ tags:
The following analytic identifies `pkexec` spawning with no command-line arguments. A vulnerability in Polkit's pkexec component identified as CVE-2021-4034 (PwnKit) which is present in the default configuration of all major Linux distributions and can be exploited to gain full root privileges on the system.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2022-01-28
- **Author**: Michael Haag, Splunk
- **ID**: 03e22c1c-8086-11ec-ac2e-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1068](https://attack.mitre.org/techniques/T1068/) | Exploitation for Privilege Escalation | Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -54,10 +108,10 @@ The following analytic identifies `pkexec` spawning with no command-line argumen
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `linux_pkexec_privilege_escalation_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **linux_pkexec_privilege_escalation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +138,6 @@ False positives may be present, filter as needed.
* [Linux Privilege Escalation](/stories/linux_privilege_escalation)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -96,14 +147,6 @@ False positives may be present, filter as needed.
| 56.0 | 80 | 70 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ related to a local privilege escalation in polkit pkexec. |
-#### CVE
-
-| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
-| ----------- | ----------- | -------------- |
-| [CVE-2021-4034](https://nvd.nist.gov/vuln/detail/CVE-2021-4034) | A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine. | 7.2 |
-
-
-
#### Reference
* [https://www.reddit.com/r/crowdstrike/comments/sdfeig/20220126_cool_query_friday_hunting_pwnkit_local/](https://www.reddit.com/r/crowdstrike/comments/sdfeig/20220126_cool_query_friday_hunting_pwnkit_local/)
@@ -114,7 +157,7 @@ False positives may be present, filter as needed.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-02-01-mimikatz_passtheticket_commandline_parameters.md b/docs/_posts/2022-02-01-mimikatz_passtheticket_commandline_parameters.md
index 4b2506f5c8..9c374923f6 100644
--- a/docs/_posts/2022-02-01-mimikatz_passtheticket_commandline_parameters.md
+++ b/docs/_posts/2022-02-01-mimikatz_passtheticket_commandline_parameters.md
@@ -29,16 +29,21 @@ tags:
The following analytic looks for the use of Mimikatz command line parameters leveraged to execute pass the ticket attacks. Red teams and adversaries alike may use the pass the ticket technique using stolen Kerberos tickets to move laterally within an environment, bypassing normal system access controls. Defenders should be aware that adversaries may customize the source code of Mimikatz and modify the command line parameters. This would effectively bypass this analytic.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2022-02-01
- **Author**: Mauricio Velazco, Splunk
- **ID**: 13bbd574-83ac-11ec-99d4-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
+| ----------- | ----------- | -------------- |
+| [CVE-2021-4034](https://nvd.nist.gov/vuln/detail/CVE-2021-4034) | A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine. | 7.2 |
+
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,51 @@ The following analytic looks for the use of Mimikatz command line parameters lev
| [T1550.003](https://attack.mitre.org/techniques/T1550/003/) | Pass the Ticket | Defense Evasion, Lateral Movement |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -59,10 +109,10 @@ The following analytic looks for the use of Mimikatz command line parameters lev
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `mimikatz_passtheticket_commandline_parameters_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **mimikatz_passtheticket_commandline_parameters_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -86,9 +136,6 @@ Although highly unlikely, legitimate applications may use the same command line
* [Active Directory Kerberos Attacks](/stories/active_directory_kerberos_attacks)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -98,8 +145,6 @@ Although highly unlikely, legitimate applications may use the same command line
| 36.0 | 60 | 60 | Mimikatz command line parameters for pass the ticket attacks were used on $dest$ |
-
-
#### Reference
* [https://github.com/gentilkiwi/mimikatz](https://github.com/gentilkiwi/mimikatz)
@@ -108,7 +153,7 @@ Although highly unlikely, legitimate applications may use the same command line
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-02-01-rubeus_command_line_parameters.md b/docs/_posts/2022-02-01-rubeus_command_line_parameters.md
index 0a6dfe12bb..e9fa2bc27b 100644
--- a/docs/_posts/2022-02-01-rubeus_command_line_parameters.md
+++ b/docs/_posts/2022-02-01-rubeus_command_line_parameters.md
@@ -38,16 +38,21 @@ tags:
Rubeus is a C# toolset for raw Kerberos interaction and abuses. It is heavily adapted from Benjamin Delpys Kekeo project and Vincent LE TOUXs MakeMeEnterpriseAdmin project. This analytic looks for the use of Rubeus command line arguments utilized in common Kerberos attacks like exporting and importing tickets, forging silver and golden tickets, requesting a TGT or TGS, kerberoasting, password spraying, etc. Red teams and adversaries alike use Rubeus for Kerberos attacks within Active Directory networks. Defenders should be aware that adversaries may customize the source code of Rubeus and modify the command line parameters. This would effectively bypass this analytic.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2022-02-01
- **Author**: Mauricio Velazco, Splunk
- **ID**: cca37478-8377-11ec-b59a-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -61,6 +66,51 @@ Rubeus is a C# toolset for raw Kerberos interaction and abuses. It is heavily ad
| [T1558.004](https://attack.mitre.org/techniques/T1558/004/) | AS-REP Roasting | Credential Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -74,10 +124,10 @@ Rubeus is a C# toolset for raw Kerberos interaction and abuses. It is heavily ad
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `rubeus_command_line_parameters_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **rubeus_command_line_parameters_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -101,9 +151,6 @@ Although unlikely, legitimate applications may use the same command line paramet
* [Active Directory Kerberos Attacks](/stories/active_directory_kerberos_attacks)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -113,8 +160,6 @@ Although unlikely, legitimate applications may use the same command line paramet
| 36.0 | 60 | 60 | Rubeus command line parameters were used on $dest$ |
-
-
#### Reference
* [https://github.com/GhostPack/Rubeus](https://github.com/GhostPack/Rubeus)
@@ -124,7 +169,7 @@ Although unlikely, legitimate applications may use the same command line paramet
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-02-01-suspicious_rundll32_rename.md b/docs/_posts/2022-02-01-suspicious_rundll32_rename.md
index a0cffba41c..5ca0057953 100644
--- a/docs/_posts/2022-02-01-suspicious_rundll32_rename.md
+++ b/docs/_posts/2022-02-01-suspicious_rundll32_rename.md
@@ -33,16 +33,21 @@ tags:
The following hunting analytic identifies renamed instances of rundll32.exe executing. rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. During investigation, validate it is the legitimate rundll32.exe executing and what script content it is loading. This query relies on the original filename or internal name from the PE meta data. Expand the query as needed by looking for specific command line arguments outlined in other analytics.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2022-02-01
- **Author**: Michael Haag, Splunk
- **ID**: 7360137f-abad-473e-8189-acbdaa34d114
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -54,6 +59,56 @@ The following hunting analytic identifies renamed instances of rundll32.exe exec
| [T1036.003](https://attack.mitre.org/techniques/T1036/003/) | Rename System Utilities | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -67,11 +122,11 @@ The following hunting analytic identifies renamed instances of rundll32.exe exec
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `suspicious_rundll32_rename_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **suspicious_rundll32_rename_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -99,9 +154,6 @@ Although unlikely, some legitimate applications may use a moved copy of rundll32
* [Masquerading - Rename System Utilities](/stories/masquerading_-_rename_system_utilities)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -111,8 +163,6 @@ Although unlikely, some legitimate applications may use a moved copy of rundll32
| 63.0 | 70 | 90 | Suspicious renamed rundll32.exe binary ran on $dest$ by $user$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1218/011/](https://attack.mitre.org/techniques/T1218/011/)
@@ -122,7 +172,7 @@ Although unlikely, some legitimate applications may use a moved copy of rundll32
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md b/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md
index 5bedae63be..6a83c2e061 100644
--- a/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md
+++ b/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md
@@ -24,21 +24,71 @@ tags:
Certutil.exe may download a file from a remote destination using `-urlcache`. This behavior does require a URL to be passed on the command-line. In addition, `-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will be used. It is not entirely common for `certutil.exe` to contact public IP space. However, it is uncommon for `certutil.exe` to write files to world writeable paths.\ During triage, capture any files on disk and review. Review the reputation of the remote IP or domain in question.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2022-02-03
- **Author**: Michael Haag, Splunk
- **ID**: 415b4306-8bfb-11eb-85c4-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1105](https://attack.mitre.org/techniques/T1105/) | Ingress Tool Transfer | Command And Control |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,11 +102,11 @@ Certutil.exe may download a file from a remote destination using `-urlcache`. Th
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `certutil_download_with_urlcache_and_split_arguments_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **certutil_download_with_urlcache_and_split_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -85,9 +135,6 @@ Limited false positives in most environments, however tune as needed based on pa
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -97,8 +144,6 @@ Limited false positives in most environments, however tune as needed based on pa
| 90.0 | 90 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a file. |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1105/](https://attack.mitre.org/techniques/T1105/)
@@ -108,7 +153,7 @@ Limited false positives in most environments, however tune as needed based on pa
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md b/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md
index 92a9346967..7a179fcdcf 100644
--- a/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md
+++ b/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md
@@ -24,21 +24,71 @@ tags:
Certutil.exe may download a file from a remote destination using `-VerifyCtl`. This behavior does require a URL to be passed on the command-line. In addition, `-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will be used. It is not entirely common for `certutil.exe` to contact public IP space. \ During triage, capture any files on disk and review. Review the reputation of the remote IP or domain in question. Using `-VerifyCtl`, the file will either be written to the current working directory or `%APPDATA%\..\LocalLow\Microsoft\CryptnetUrlCache\Content\CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1105](https://attack.mitre.org/techniques/T1105/) | Ingress Tool Transfer | Command And Control |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,11 +102,11 @@ Certutil.exe may download a file from a remote destination using `-VerifyCtl`. T
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `certutil_download_with_verifyctl_and_split_arguments_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **certutil_download_with_verifyctl_and_split_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -85,9 +135,6 @@ Limited false positives in most environments, however tune as needed based on pa
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -97,8 +144,6 @@ Limited false positives in most environments, however tune as needed based on pa
| 90.0 | 90 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a file. |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1105/](https://attack.mitre.org/techniques/T1105/)
@@ -109,7 +154,7 @@ Limited false positives in most environments, however tune as needed based on pa
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-02-03-o365_added_service_principal.md b/docs/_posts/2022-02-03-o365_added_service_principal.md
index 0776fd912f..aa4f03c7bd 100644
--- a/docs/_posts/2022-02-03-o365_added_service_principal.md
+++ b/docs/_posts/2022-02-03-o365_added_service_principal.md
@@ -26,16 +26,21 @@ tags:
This search detects the creation of a new Federation setting by alerting about an specific event related to its creation.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2022-02-03
- **Author**: Rod Soto, Splunk
- **ID**: 1668812a-6047-11eb-ae93-0242ac130002
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,51 @@ This search detects the creation of a new Federation setting by alerting about a
| [T1136](https://attack.mitre.org/techniques/T1136/) | Create Account | Persistence |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -55,10 +105,10 @@ This search detects the creation of a new Federation setting by alerting about a
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `o365_added_service_principal_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **o365_added_service_principal_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -82,9 +132,6 @@ The creation of a new Federation is not necessarily malicious, however these eve
* [Cloud Federated Credential Abuse](/stories/cloud_federated_credential_abuse)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -94,8 +141,6 @@ The creation of a new Federation is not necessarily malicious, however these eve
| 42.0 | 70 | 60 | User $Actor.ID$ created a new federation setting on $Target.ID$ and added service principal credentials from IP Address $ActorIpAddress$ |
-
-
#### Reference
* [https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf](https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf)
@@ -106,7 +151,7 @@ The creation of a new Federation is not necessarily malicious, however these eve
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-02-03-o365_bypass_mfa_via_trusted_ip.md b/docs/_posts/2022-02-03-o365_bypass_mfa_via_trusted_ip.md
index 58e94151a0..56227cb9c5 100644
--- a/docs/_posts/2022-02-03-o365_bypass_mfa_via_trusted_ip.md
+++ b/docs/_posts/2022-02-03-o365_bypass_mfa_via_trusted_ip.md
@@ -26,16 +26,21 @@ tags:
This search detects newly added IP addresses/CIDR blocks to the list of MFA Trusted IPs to bypass multi factor authentication. Attackers are often known to use this technique so that they can bypass the MFA system.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2022-02-03
- **Author**: Bhavin Patel, Splunk
- **ID**: c783dd98-c703-4252-9e8a-f19d9f66949e
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,51 @@ This search detects newly added IP addresses/CIDR blocks to the list of MFA Trus
| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -60,10 +110,10 @@ This search detects newly added IP addresses/CIDR blocks to the list of MFA Trus
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `o365_bypass_mfa_via_trusted_ip_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **o365_bypass_mfa_via_trusted_ip_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -88,9 +138,6 @@ Unless it is a special case, it is uncommon to continually update Trusted IPs to
* [Office 365 Detections](/stories/office_365_detections)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -100,8 +147,6 @@ Unless it is a special case, it is uncommon to continually update Trusted IPs to
| 42.0 | 70 | 60 | User $user_id$ has added new IP addresses $ip_addresses_new_added$ to a list of trusted IPs to bypass MFA |
-
-
#### Reference
* [https://i.blackhat.com/USA-20/Thursday/us-20-Bienstock-My-Cloud-Is-APTs-Cloud-Investigating-And-Defending-Office-365.pdf](https://i.blackhat.com/USA-20/Thursday/us-20-Bienstock-My-Cloud-Is-APTs-Cloud-Investigating-And-Defending-Office-365.pdf)
@@ -110,7 +155,7 @@ Unless it is a special case, it is uncommon to continually update Trusted IPs to
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-02-03-o365_disable_mfa.md b/docs/_posts/2022-02-03-o365_disable_mfa.md
index 2d2168461d..12662ec347 100644
--- a/docs/_posts/2022-02-03-o365_disable_mfa.md
+++ b/docs/_posts/2022-02-03-o365_disable_mfa.md
@@ -25,21 +25,71 @@ tags:
This search detects when multi factor authentication has been disabled, what entitiy performed the action and against what user
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2022-02-03
- **Author**: Rod Soto, Splunk
- **ID**: c783dd98-c703-4252-9e8a-f19d9f5c949e
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1556](https://attack.mitre.org/techniques/T1556/) | Modify Authentication Process | Credential Access, Defense Evasion, Persistence |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +102,10 @@ This search detects when multi factor authentication has been disabled, what ent
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `o365_disable_mfa_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **o365_disable_mfa_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -78,9 +128,6 @@ Unless it is a special case, it is uncommon to disable MFA or Strong Authenticat
* [Office 365 Detections](/stories/office_365_detections)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -90,8 +137,6 @@ Unless it is a special case, it is uncommon to disable MFA or Strong Authenticat
| 64.0 | 80 | 80 | User $user$ has executed an operation $Operation$ for this destination $dest$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1556/](https://attack.mitre.org/techniques/T1556/)
@@ -99,7 +144,7 @@ Unless it is a special case, it is uncommon to disable MFA or Strong Authenticat
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-02-07-rubeus_kerberos_ticket_exports_through_winlogon_access.md b/docs/_posts/2022-02-07-rubeus_kerberos_ticket_exports_through_winlogon_access.md
index 2fa220e7d6..db38882aa7 100644
--- a/docs/_posts/2022-02-07-rubeus_kerberos_ticket_exports_through_winlogon_access.md
+++ b/docs/_posts/2022-02-07-rubeus_kerberos_ticket_exports_through_winlogon_access.md
@@ -28,16 +28,21 @@ tags:
The following analytic looks for a process accessing the winlogon.exe system process. The Splunk Threat Research team identified this behavior when using the Rubeus tool to monitor for and export kerberos tickets from memory. Before being able to export tickets. Rubeus will try to escalate privileges to SYSTEM by obtaining a handle to winlogon.exe before trying to monitor for kerberos tickets. Exporting tickets from memory is typically the first step for pass the ticket attacks. Red teams and adversaries alike may use the pass the ticket technique using stolen Kerberos tickets to move laterally within an environment, bypassing normal system access controls. Defenders should be aware that adversaries may customize the source code of Rubeus to potentially bypass this analytic.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2022-02-07
- **Author**: Mauricio Velazco, Splunk
- **ID**: 5ed8c50a-8869-11ec-876f-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -45,6 +50,51 @@ The following analytic looks for a process accessing the winlogon.exe system pro
| [T1550.003](https://attack.mitre.org/techniques/T1550/003/) | Pass the Ticket | Defense Evasion, Lateral Movement |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -58,10 +108,10 @@ The following analytic looks for a process accessing the winlogon.exe system pro
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `rubeus_kerberos_ticket_exports_through_winlogon_access_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **rubeus_kerberos_ticket_exports_through_winlogon_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +134,6 @@ Legitimate applications may obtain a handle for winlogon.exe. Filter as needed
* [Active Directory Kerberos Attacks](/stories/active_directory_kerberos_attacks)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -96,8 +143,6 @@ Legitimate applications may obtain a handle for winlogon.exe. Filter as needed
| 36.0 | 60 | 60 | Winlogon.exe was accessed by $SourceImage$ on $dest$ |
-
-
#### Reference
* [https://github.com/GhostPack/Rubeus](https://github.com/GhostPack/Rubeus)
@@ -107,7 +152,7 @@ Legitimate applications may obtain a handle for winlogon.exe. Filter as needed
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-02-07-windows_remote_assistance_spawning_process.md b/docs/_posts/2022-02-07-windows_remote_assistance_spawning_process.md
index bdfbb3f291..0f60a6cb66 100644
--- a/docs/_posts/2022-02-07-windows_remote_assistance_spawning_process.md
+++ b/docs/_posts/2022-02-07-windows_remote_assistance_spawning_process.md
@@ -25,21 +25,71 @@ tags:
The following analytic identifies the use of Microsoft Remote Assistance, msra.exe, spawning PowerShell.exe or cmd.exe as a child process. Msra.exe by default has no command-line arguments and typically spawns itself. It will generate a network connection to the remote system that is connected. This behavior is indicative of another process injected into msra.exe. Review the parent process or cross process events to identify source.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2022-02-07
- **Author**: Michael Haag, Splunk
- **ID**: ced50492-8849-11ec-9f68-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -53,11 +103,11 @@ The following analytic identifies the use of Microsoft Remote Assistance, msra.e
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [windows_shells](https://github.com/splunk/security_content/blob/develop/macros/windows_shells.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `windows_remote_assistance_spawning_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **windows_remote_assistance_spawning_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +134,6 @@ False positives should be limited, filter as needed. Add additional shells as ne
* [Unusual Processes](/stories/unusual_processes)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -96,8 +143,6 @@ False positives should be limited, filter as needed. Add additional shells as ne
| 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$, generating behavior not common with msra.exe. |
-
-
#### Reference
* [https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/](https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/)
@@ -105,7 +150,7 @@ False positives should be limited, filter as needed. Add additional shells as ne
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md b/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md
index 7c404a9be6..4dcf94b19a 100644
--- a/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md
+++ b/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md
@@ -31,16 +31,21 @@ tags:
The following analytic identifies Schtasks.exe creating a new task to start and run as an elevated user - SYSTEM. This is commonly used by adversaries to spawn a process in an elevated state.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2022-02-07
- **Author**: Michael Haag, Splunk
- **ID**: 41a0e58e-884c-11ec-9976-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -48,6 +53,51 @@ The following analytic identifies Schtasks.exe creating a new task to start and
| [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -61,11 +111,11 @@ The following analytic identifies Schtasks.exe creating a new task to start and
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_schtasks](https://github.com/splunk/security_content/blob/develop/macros/process_schtasks.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `windows_schtasks_create_run_as_system_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **windows_schtasks_create_run_as_system_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -92,9 +142,6 @@ False positives will be limited to legitimate applications creating a task to ru
* [Windows Persistence Techniques](/stories/windows_persistence_techniques)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -104,8 +151,6 @@ False positives will be limited to legitimate applications creating a task to ru
| 48.0 | 80 | 60 | An $process_name$ was created on endpoint $dest$ attempting to spawn as SYSTEM. |
-
-
#### Reference
* [https://pentestlab.blog/2019/11/04/persistence-scheduled-tasks/](https://pentestlab.blog/2019/11/04/persistence-scheduled-tasks/)
@@ -115,7 +160,7 @@ False positives will be limited to legitimate applications creating a task to ru
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md b/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md
index c51b5ca360..35cd16df7b 100644
--- a/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md
+++ b/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md
@@ -27,16 +27,21 @@ tags:
The following analytic identifies rundll32.exe loading an export function by ordinal value. Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly, may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Utilizing ordinal values makes it a bit more complicated for analysts to understand the behavior until the DLL is reviewed.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2022-02-08
- **Author**: Michael Haag, David Dorsey, Splunk
- **ID**: 6c135f8d-5e60-454e-80b7-c56eed739833
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,56 @@ The following analytic identifies rundll32.exe loading an export function by ord
| [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Installation
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -58,11 +113,11 @@ The following analytic identifies rundll32.exe loading an export function by ord
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `rundll_loading_dll_by_ordinal_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **rundll_loading_dll_by_ordinal_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -91,9 +146,6 @@ False positives are possible with native utilities and third party applications.
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Installation
-
#### RBA
@@ -103,8 +155,6 @@ False positives are possible with native utilities and third party applications.
| 49.0 | 70 | 70 | A rundll32 process $process_name$ with ordinal parameter like this process commandline $process$ on host $dest$. |
-
-
#### Reference
* [https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/](https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/)
@@ -112,7 +162,7 @@ False positives are possible with native utilities and third party applications.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-02-08-unusual_number_of_kerberos_service_tickets_requested.md b/docs/_posts/2022-02-08-unusual_number_of_kerberos_service_tickets_requested.md
index 16477d31a0..d7cc33cf1c 100644
--- a/docs/_posts/2022-02-08-unusual_number_of_kerberos_service_tickets_requested.md
+++ b/docs/_posts/2022-02-08-unusual_number_of_kerberos_service_tickets_requested.md
@@ -27,16 +27,21 @@ tags:
The following hunting analytic leverages Kerberos Event 4769, A Kerberos service ticket was requested, to identify a potential kerberoasting attack against Active Directory networks. Kerberoasting allows an adversary to request kerberos tickets for domain accounts typically used as service accounts and attempt to crack them offline allowing them to obtain privileged access to the domain.\
The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number service ticket requests. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2022-02-08
- **Author**: Mauricio Velazco, Splunk
- **ID**: eb3e6702-8936-11ec-98fe-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ The detection calculates the standard deviation for each host and leverages the
| [T1558.003](https://attack.mitre.org/techniques/T1558/003/) | Kerberoasting | Credential Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -61,7 +111,7 @@ The detection calculates the standard deviation for each host and leverages the
The SPL above uses the following Macros:
* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
-Note that `unusual_number_of_kerberos_service_tickets_requested_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **unusual_number_of_kerberos_service_tickets_requested_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +134,6 @@ An single endpoint requesting a large number of kerberos service tickets is not
* [Active Directory Kerberos Attacks](/stories/active_directory_kerberos_attacks)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -96,8 +143,6 @@ An single endpoint requesting a large number of kerberos service tickets is not
| 36.0 | 60 | 60 | tbd |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1558/003/](https://attack.mitre.org/techniques/T1558/003/)
@@ -106,7 +151,7 @@ An single endpoint requesting a large number of kerberos service tickets is not
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-02-09-kerberoasting_spn_request_with_rc4_encryption.md b/docs/_posts/2022-02-09-kerberoasting_spn_request_with_rc4_encryption.md
index 5017bf40c9..7be28a30c8 100644
--- a/docs/_posts/2022-02-09-kerberoasting_spn_request_with_rc4_encryption.md
+++ b/docs/_posts/2022-02-09-kerberoasting_spn_request_with_rc4_encryption.md
@@ -26,16 +26,21 @@ tags:
The following analytic leverages Kerberos Event 4769, A Kerberos service ticket was requested, to identify a potential kerberoasting attack against Active Directory networks. Kerberoasting allows an adversary to request kerberos tickets for domain accounts typically used as service accounts and attempt to crack them offline allowing them to obtain privileged access to the domain. This analytic looks for a specific combination of the Ticket_Options field based on common kerberoasting tools. Defenders should be aware that it may be possible for a Kerberoast attack to use different Ticket_Options.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2022-02-09
- **Author**: Jose Hernandez, Patrick Bareiss, Mauricio Velazco, Splunk
- **ID**: 5cc67381-44fa-4111-8a37-7a230943f027
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,56 @@ The following analytic leverages Kerberos Event 4769, A Kerberos service ticket
| [T1558.003](https://attack.mitre.org/techniques/T1558/003/) | Kerberoasting | Credential Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -55,10 +110,10 @@ The following analytic leverages Kerberos Event 4769, A Kerberos service ticket
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `kerberoasting_spn_request_with_rc4_encryption_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **kerberoasting_spn_request_with_rc4_encryption_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -81,9 +136,6 @@ Older systems that support kerberos RC4 by default like NetApp may generate fals
* [Active Directory Kerberos Attacks](/stories/active_directory_kerberos_attacks)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -93,8 +145,6 @@ Older systems that support kerberos RC4 by default like NetApp may generate fals
| 72.0 | 90 | 80 | Potential kerberoasting attack via service principal name requests detected on $dest$ |
-
-
#### Reference
* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1208/T1208.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1208/T1208.md)
@@ -103,7 +153,7 @@ Older systems that support kerberos RC4 by default like NetApp may generate fals
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-02-11-linux_system_network_discovery.md b/docs/_posts/2022-02-11-linux_system_network_discovery.md
index 7d256c9210..2dacb89f78 100644
--- a/docs/_posts/2022-02-11-linux_system_network_discovery.md
+++ b/docs/_posts/2022-02-11-linux_system_network_discovery.md
@@ -24,21 +24,77 @@ tags:
This analytic is to look for possible enumeration of local network configuration. This technique is commonly used as part of recon of adversaries or threat actor to know some network information for its next or further attack. This anomaly detections may capture normal event made by administrator during auditing or testing network connection of specific host or network to network.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2022-02-11
- **Author**: Teoderick Contreras, Splunk
- **ID**: 535cb214-8b47-11ec-a2c7-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1016](https://attack.mitre.org/techniques/T1016/) | System Network Configuration Discovery | Discovery |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Reconnaissance
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -53,7 +109,7 @@ This analytic is to look for possible enumeration of local network configuration
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `linux_system_network_discovery_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **linux_system_network_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -76,9 +132,6 @@ Administrator or network operator can execute this command. Please update the fi
* [Network Discovery](/stories/network_discovery)
-#### Kill Chain Phase
-* Reconnaissance
-
#### RBA
@@ -88,8 +141,6 @@ Administrator or network operator can execute this command. Please update the fi
| 9.0 | 30 | 30 | A commandline $process$ executed on $dest$ |
-
-
#### Reference
* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1016/T1016.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1016/T1016.md)
@@ -97,7 +148,7 @@ Administrator or network operator can execute this command. Please update the fi
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-02-14-linux_dd_file_overwrite.md b/docs/_posts/2022-02-14-linux_dd_file_overwrite.md
index eb1df7da2c..9d6dac3223 100644
--- a/docs/_posts/2022-02-14-linux_dd_file_overwrite.md
+++ b/docs/_posts/2022-02-14-linux_dd_file_overwrite.md
@@ -24,21 +24,77 @@ tags:
This analytic is to look for dd command to overwrite file. This technique was abused by adversaries or threat actor to destroy files or data on specific system or in a large number of host within network to interrupt host avilability, services and many more. This is also used to destroy data where it make the file irrecoverable by forensic techniques through overwriting files, data or local and remote drives.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2022-02-14
- **Author**: Teoderick Contreras, Splunk
- **ID**: 9b6aae5e-8d85-11ec-b2ae-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1485](https://attack.mitre.org/techniques/T1485/) | Data Destruction | Impact |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +108,10 @@ This analytic is to look for dd command to overwrite file. This technique was ab
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `linux_dd_file_overwrite_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **linux_dd_file_overwrite_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -78,9 +134,6 @@ Administrator or network operator can execute this command. Please update the fi
* [Data Destruction](/stories/data_destruction)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -90,8 +143,6 @@ Administrator or network operator can execute this command. Please update the fi
| 64.0 | 80 | 80 | A commandline $process$ executed on $dest$ |
-
-
#### Reference
* [https://gtfobins.github.io/gtfobins/dd/](https://gtfobins.github.io/gtfobins/dd/)
@@ -100,7 +151,7 @@ Administrator or network operator can execute this command. Please update the fi
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-02-15-detection_of_dns_tunnels.md b/docs/_posts/2022-02-15-detection_of_dns_tunnels.md
index d827a872a6..e95f131154 100644
--- a/docs/_posts/2022-02-15-detection_of_dns_tunnels.md
+++ b/docs/_posts/2022-02-15-detection_of_dns_tunnels.md
@@ -25,21 +25,77 @@ tags:
This search is used to detect DNS tunneling, by calculating the sum of the length of DNS queries and DNS answers. The search also filters out potential false positives by filtering out queries made to internal systems and the queries originating from internal DNS, Web, and Email servers. Endpoints using DNS as a method of transmission for data exfiltration, command and control, or evasion of security controls can often be detected by noting an unusually large volume of DNS traffic. \
NOTE:Deprecated because existing detection is doing the same. This detection is replaced with two other variations, if you are using MLTK then you can use this search `ESCU - DNS Query Length Outliers - MLTK - Rule` or use the standard deviation version `ESCU - DNS Query Length With High Standard Deviation - Rule`, as an alternantive.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Network_Resolution](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkResolution)
-
- **Last Updated**: 2022-02-15
- **Author**: Bhavin Patel, Splunk
- **ID**: 104658f4-afdc-499f-9719-17a43f9826f4
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1048.003](https://attack.mitre.org/techniques/T1048/003/) | Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol | Exfiltration |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Command & Control
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* PR.DS
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 13
+
+
+
+
+
+
+
#### Search
```
@@ -62,7 +118,7 @@ NOTE:Deprecated because existing detection is doing the same. This detection is
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `detection_of_dns_tunnels_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detection_of_dns_tunnels_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,10 +140,6 @@ It's possible that normal DNS traffic will exhibit this behavior. If an alert is
* [Command and Control](/stories/command_and_control)
-#### Kill Chain Phase
-* Command & Control
-* Actions on Objectives
-
#### RBA
@@ -97,13 +149,11 @@ It's possible that normal DNS traffic will exhibit this behavior. If an alert is
| 25.0 | 50 | 50 | tbd |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-02-15-windows_diskshadow_proxy_execution.md b/docs/_posts/2022-02-15-windows_diskshadow_proxy_execution.md
index 2c5306e356..c6a5449ad3 100644
--- a/docs/_posts/2022-02-15-windows_diskshadow_proxy_execution.md
+++ b/docs/_posts/2022-02-15-windows_diskshadow_proxy_execution.md
@@ -24,21 +24,75 @@ tags:
DiskShadow.exe is a Microsoft Signed binary present on Windows Server. It has a scripting mode intended for complex scripted backup operations. This feature also allows for execution of arbitrary unsigned code. This analytic looks for the usage of the scripting mode flags in executions of DiskShadow. During triage, compare to known backup behavior in your environment and then review the scripts called by diskshadow.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2022-02-15
- **Author**: Lou Stella, Splunk
- **ID**: 58adae9e-8ea3-11ec-90f6-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -52,11 +106,11 @@ DiskShadow.exe is a Microsoft Signed binary present on Windows Server. It has a
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_diskshadow](https://github.com/splunk/security_content/blob/develop/macros/process_diskshadow.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `windows_diskshadow_proxy_execution_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **windows_diskshadow_proxy_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -80,9 +134,6 @@ Administrators using the DiskShadow tool in their infrastructure as a main backu
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -92,8 +143,6 @@ Administrators using the DiskShadow tool in their infrastructure as a main backu
| 49.0 | 70 | 70 | Possible Signed Binary Proxy Execution on $dest$ |
-
-
#### Reference
* [https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/](https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/)
@@ -101,7 +150,7 @@ Administrators using the DiskShadow tool in their infrastructure as a main backu
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-02-15-windows_rasautou_dll_execution.md b/docs/_posts/2022-02-15-windows_rasautou_dll_execution.md
index 9e294d6006..9bec2a26f5 100644
--- a/docs/_posts/2022-02-15-windows_rasautou_dll_execution.md
+++ b/docs/_posts/2022-02-15-windows_rasautou_dll_execution.md
@@ -32,16 +32,21 @@ tags:
The following analytic identifies the Windows Windows Remote Auto Dialer, rasautou.exe executing an arbitrary DLL. This technique is used to execute arbitrary shellcode or DLLs via the rasautou.exe LOLBin capability. During triage, review parent and child process behavior including file and image loads.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2022-02-15
- **Author**: Michael Haag, Splunk
- **ID**: 6f42b8be-8e96-11ec-ad5a-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -51,6 +56,51 @@ The following analytic identifies the Windows Windows Remote Auto Dialer, rasaut
| [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -64,10 +114,10 @@ The following analytic identifies the Windows Windows Remote Auto Dialer, rasaut
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `windows_rasautou_dll_execution_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **windows_rasautou_dll_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -94,9 +144,6 @@ False positives will be limited to applications that require Rasautou.exe to loa
* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -106,8 +153,6 @@ False positives will be limited to applications that require Rasautou.exe to loa
| 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ attempting to load a DLL in a suspicious manner. |
-
-
#### Reference
* [https://github.com/mandiant/DueDLLigence](https://github.com/mandiant/DueDLLigence)
@@ -118,7 +163,7 @@ False positives will be limited to applications that require Rasautou.exe to loa
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-02-17-windows_disable_notification_center.md b/docs/_posts/2022-02-17-windows_disable_notification_center.md
index 3cd6939ef9..e2bc0969bd 100644
--- a/docs/_posts/2022-02-17-windows_disable_notification_center.md
+++ b/docs/_posts/2022-02-17-windows_disable_notification_center.md
@@ -24,21 +24,76 @@ tags:
The following search identifies a modification of registry to disable the windows notification center feature in a windows host machine. This registry modification removes notification and action center from the notification area on the task bar. This modification are seen in RAT malware to cover their tracks upon downloading other of its component or other payload.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2022-02-17
- **Author**: Teoderick Contreras, Splunk
- **ID**: 1cd983c8-8fd6-11ec-a09d-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -59,7 +114,7 @@ The following search identifies a modification of registry to disable the window
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `windows_disable_notification_center_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **windows_disable_notification_center_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -81,9 +136,6 @@ admin or user may choose to disable this windows features.
* [Windows Registry Abuse](/stories/windows_registry_abuse)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -93,8 +145,6 @@ admin or user may choose to disable this windows features.
| 48.0 | 60 | 80 | The Windows notification center was disabled on $dest$ by $user$. |
-
-
#### Reference
* [https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html](https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html)
@@ -102,7 +152,7 @@ admin or user may choose to disable this windows features.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-02-17-windows_raw_access_to_master_boot_record_drive.md b/docs/_posts/2022-02-17-windows_raw_access_to_master_boot_record_drive.md
index 0d1f481d2e..f5db7edcb5 100644
--- a/docs/_posts/2022-02-17-windows_raw_access_to_master_boot_record_drive.md
+++ b/docs/_posts/2022-02-17-windows_raw_access_to_master_boot_record_drive.md
@@ -27,16 +27,21 @@ tags:
This analytic is to look for suspicious raw access read to drive where the master boot record is placed. This technique was seen in several attacks by adversaries or threat actor to wipe, encrypt or overwrite the master boot record code as part of their impact payload. This detection is a good indicator that there is a process try to read or write on MBR sector.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2022-02-17
- **Author**: Teoderick Contreras, Splunk
- **ID**: 7b83f666-900c-11ec-a2d9-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,57 @@ This analytic is to look for suspicious raw access read to drive where the maste
| [T1561](https://attack.mitre.org/techniques/T1561/) | Disk Wipe | Impact |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -56,10 +112,10 @@ This analytic is to look for suspicious raw access read to drive where the maste
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `windows_raw_access_to_master_boot_record_drive_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **windows_raw_access_to_master_boot_record_drive_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -85,9 +141,6 @@ This event is really notable but we found minimal number of normal application f
* [Hermetic Wiper](/stories/hermetic_wiper)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -97,8 +150,6 @@ This event is really notable but we found minimal number of normal application f
| 90.0 | 90 | 100 | process accessing MBR $device$ in $dest$ |
-
-
#### Reference
* [https://www.splunk.com/en_us/blog/security/threat-advisory-strt-ta02-destructive-software.html](https://www.splunk.com/en_us/blog/security/threat-advisory-strt-ta02-destructive-software.html)
@@ -108,7 +159,7 @@ This event is really notable but we found minimal number of normal application f
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-02-18-detect_regasm_with_network_connection.md b/docs/_posts/2022-02-18-detect_regasm_with_network_connection.md
index efc3b81d21..697c39bd16 100644
--- a/docs/_posts/2022-02-18-detect_regasm_with_network_connection.md
+++ b/docs/_posts/2022-02-18-detect_regasm_with_network_connection.md
@@ -26,16 +26,21 @@ tags:
The following analytic identifies regasm.exe with a network connection to a public IP address, exluding private IP space. This particular technique has been used in the wild to bypass application control products. Regasm.exe and Regsvcs.exe are signed by Microsoft. By contacting a remote command and control server, the adversary will have the ability to escalate privileges and complete the objectives. During investigation, identify and retrieve the content being loaded. Review parallel processes for additional suspicious behavior. Gather any other file modifications and review accordingly. Review the reputation of the remote IP or domain and block as needed. regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2022-02-18
- **Author**: Michael Haag, Splunk
- **ID**: 07921114-6db4-4e2e-ae58-3ea8a52ae93f
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,56 @@ The following analytic identifies regasm.exe with a network connection to a publ
| [T1218.009](https://attack.mitre.org/techniques/T1218/009/) | Regsvcs/Regasm | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -56,10 +111,10 @@ The following analytic identifies regasm.exe with a network connection to a publ
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_regasm_with_network_connection_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_regasm_with_network_connection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +139,6 @@ Although unlikely, limited instances of regasm.exe with a network connection may
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -96,8 +148,6 @@ Although unlikely, limited instances of regasm.exe with a network connection may
| 80.0 | 80 | 100 | An instance of $process_name$ contacting a remote destination was identified on endpoint $Computer$ by user $user$. This behavior is not normal for $process_name$. |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1218/009/](https://attack.mitre.org/techniques/T1218/009/)
@@ -107,7 +157,7 @@ Although unlikely, limited instances of regasm.exe with a network connection may
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-02-18-detect_regsvcs_with_network_connection.md b/docs/_posts/2022-02-18-detect_regsvcs_with_network_connection.md
index 234043c6e9..24486be582 100644
--- a/docs/_posts/2022-02-18-detect_regsvcs_with_network_connection.md
+++ b/docs/_posts/2022-02-18-detect_regsvcs_with_network_connection.md
@@ -26,16 +26,21 @@ tags:
The following analytic identifies Regsvcs.exe with a network connection to a public IP address, exluding private IP space. This particular technique has been used in the wild to bypass application control products. Regasm.exe and Regsvcs.exe are signed by Microsoft. By contacting a remote command and control server, the adversary will have the ability to escalate privileges and complete the objectives. During investigation, identify and retrieve the content being loaded. Review parallel processes for additional suspicious behavior. Gather any other file modifications and review accordingly. Review the reputation of the remote IP or domain and block as needed. regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2022-02-18
- **Author**: Michael Haag, Splunk
- **ID**: e3e7a1c0-f2b9-445c-8493-f30a63522d1a
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,56 @@ The following analytic identifies Regsvcs.exe with a network connection to a pub
| [T1218.009](https://attack.mitre.org/techniques/T1218/009/) | Regsvcs/Regasm | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -56,10 +111,10 @@ The following analytic identifies Regsvcs.exe with a network connection to a pub
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_regsvcs_with_network_connection_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_regsvcs_with_network_connection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -83,9 +138,6 @@ Although unlikely, limited instances of regsvcs.exe may cause a false positive.
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -95,8 +147,6 @@ Although unlikely, limited instances of regsvcs.exe may cause a false positive.
| 80.0 | 80 | 100 | An instance of $process_name$ contacting a remote destination was identified on endpoint $Computer$ by user $user$. This behavior is not normal for $process_name$. |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1218/009/](https://attack.mitre.org/techniques/T1218/009/)
@@ -106,7 +156,7 @@ Although unlikely, limited instances of regsvcs.exe may cause a false positive.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-02-18-disabled_kerberos_pre-authentication_discovery_with_powerview.md b/docs/_posts/2022-02-18-disabled_kerberos_pre-authentication_discovery_with_powerview.md
index b302578092..e1c59dcffd 100644
--- a/docs/_posts/2022-02-18-disabled_kerberos_pre-authentication_discovery_with_powerview.md
+++ b/docs/_posts/2022-02-18-disabled_kerberos_pre-authentication_discovery_with_powerview.md
@@ -26,16 +26,21 @@ tags:
The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainUser` commandlet with specific parameters. `Get-DomainUser` is part of PowerView, a PowerShell tool used to perform enumeration on Windows Active Directory networks. As the name suggests, `Get-DomainUser` is used to identify domain users and combining it with `-PreauthNotRequired` allows adversaries to discover domain accounts with Kerberos Pre Authentication disabled.\ Red Teams and adversaries alike use may leverage PowerView to enumerate these accounts and attempt to crack their passwords offline.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2022-02-18
- **Author**: Mauricio Velazco, Splunk
- **ID**: b0b34e2c-90de-11ec-baeb-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,51 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
| [T1558.004](https://attack.mitre.org/techniques/T1558/004/) | AS-REP Roasting | Credential Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -54,10 +104,10 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `disabled_kerberos_pre-authentication_discovery_with_powerview_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **disabled_kerberos_pre-authentication_discovery_with_powerview_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -77,9 +127,6 @@ Administrators or power users may use PowerView for troubleshooting
* [Active Directory Kerberos Attacks](/stories/active_directory_kerberos_attacks)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -89,8 +136,6 @@ Administrators or power users may use PowerView for troubleshooting
| 54.0 | 60 | 90 | Disabled Kerberos Pre-Authentication Discovery With PowerView from $dest$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1558/004/](https://attack.mitre.org/techniques/T1558/004/)
@@ -100,7 +145,7 @@ Administrators or power users may use PowerView for troubleshooting
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-02-18-interactive_session_on_remote_endpoint_with_powershell.md b/docs/_posts/2022-02-18-interactive_session_on_remote_endpoint_with_powershell.md
index 6d8221cd28..4f3d05ca85 100644
--- a/docs/_posts/2022-02-18-interactive_session_on_remote_endpoint_with_powershell.md
+++ b/docs/_posts/2022-02-18-interactive_session_on_remote_endpoint_with_powershell.md
@@ -26,16 +26,21 @@ tags:
The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the usage of the `Enter-PSSession`. This commandlet can be used to open an interactive session on a remote endpoint leveraging the WinRM protocol. Red Teams and adversaries alike may abuse WinRM and `Enter-PSSession` for lateral movement and remote code execution.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2022-02-18
- **Author**: Mauricio Velazco, Splunk
- **ID**: a4e8f3a4-48b2-11ec-bcfc-3e22fbd008af
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,51 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
| [T1021.006](https://attack.mitre.org/techniques/T1021/006/) | Windows Remote Management | Lateral Movement |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -54,10 +104,10 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `interactive_session_on_remote_endpoint_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **interactive_session_on_remote_endpoint_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -77,9 +127,6 @@ Administrators may leverage WinRM and `Enter-PSSession` for administrative and t
* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -89,8 +136,6 @@ Administrators may leverage WinRM and `Enter-PSSession` for administrative and t
| 45.0 | 90 | 50 | An interactive session was opened on a remote endpoint from $ComputerName |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1021/006/](https://attack.mitre.org/techniques/T1021/006/)
@@ -99,7 +144,7 @@ Administrators may leverage WinRM and `Enter-PSSession` for administrative and t
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-02-18-net_profiler_uac_bypass.md b/docs/_posts/2022-02-18-net_profiler_uac_bypass.md
index 0a8285eb74..5a1d767dda 100644
--- a/docs/_posts/2022-02-18-net_profiler_uac_bypass.md
+++ b/docs/_posts/2022-02-18-net_profiler_uac_bypass.md
@@ -29,16 +29,21 @@ tags:
This search is to detect modification of registry to bypass UAC windows feature. This technique is to add a payload dll path on .NET COR file path that will be loaded by mmc.exe as soon it was executed. This detection rely on monitoring the registry key and values in the detection area. It may happened that windows update some dll related to mmc.exe and add dll path in this registry. In this case filtering is needed.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2022-02-18
- **Author**: Teoderick Contreras, Splunk
- **ID**: 0252ca80-e30d-11eb-8aa3-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,51 @@ This search is to detect modification of registry to bypass UAC windows feature.
| [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -59,10 +109,10 @@ This search is to detect modification of registry to bypass UAC windows feature.
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `net_profiler_uac_bypass_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **net_profiler_uac_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -82,9 +132,6 @@ limited false positive. It may trigger by some windows update that will modify t
* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -94,8 +141,6 @@ limited false positive. It may trigger by some windows update that will modify t
| 63.0 | 70 | 90 | Suspicious modification of registry $registry_path$ with possible payload path $registry_value_name$ in $dest$ |
-
-
#### Reference
* [https://offsec.almond.consulting/UAC-bypass-dotnet.html](https://offsec.almond.consulting/UAC-bypass-dotnet.html)
@@ -103,7 +148,7 @@ limited false positive. It may trigger by some windows update that will modify t
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-02-18-o365_excessive_authentication_failures_alert.md b/docs/_posts/2022-02-18-o365_excessive_authentication_failures_alert.md
index 91a365785c..e8f0f99335 100644
--- a/docs/_posts/2022-02-18-o365_excessive_authentication_failures_alert.md
+++ b/docs/_posts/2022-02-18-o365_excessive_authentication_failures_alert.md
@@ -23,21 +23,71 @@ tags:
This search detects when an excessive number of authentication failures occur this search also includes attempts against MFA prompt codes
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2022-02-18
- **Author**: Rod Soto, Splunk
- **ID**: d441364c-349c-453b-b55f-12eccab67cf9
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1110](https://attack.mitre.org/techniques/T1110/) | Brute Force | Credential Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -51,10 +101,10 @@ This search detects when an excessive number of authentication failures occur th
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `o365_excessive_authentication_failures_alert_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **o365_excessive_authentication_failures_alert_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -76,9 +126,6 @@ The threshold for alert is above 10 attempts and this should reduce the number o
* [Office 365 Detections](/stories/office_365_detections)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -88,8 +135,6 @@ The threshold for alert is above 10 attempts and this should reduce the number o
| 64.0 | 80 | 80 | User $user$ has caused excessive number of authentication failures from $src_ip$ using UserAgent $UserAgent$. |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1110/](https://attack.mitre.org/techniques/T1110/)
@@ -97,7 +142,7 @@ The threshold for alert is above 10 attempts and this should reduce the number o
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-02-18-process_deleting_its_process_file_path.md b/docs/_posts/2022-02-18-process_deleting_its_process_file_path.md
index eaa34437da..3eeb6d0ab4 100644
--- a/docs/_posts/2022-02-18-process_deleting_its_process_file_path.md
+++ b/docs/_posts/2022-02-18-process_deleting_its_process_file_path.md
@@ -24,21 +24,71 @@ tags:
This detection is to identify a suspicious process that tries to delete the process file path related to its process. This technique is known to be defense evasion once a certain condition of malware is satisfied or not. Clop ransomware use this technique where it will try to delete its process file path using a .bat command if the keyboard layout is not the layout it tries to infect.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2022-02-18
- **Author**: Teoderick Contreras
- **ID**: f7eda4bc-871c-11eb-b110-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1070](https://attack.mitre.org/techniques/T1070/) | Indicator Removal on Host | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -53,10 +103,10 @@ This detection is to identify a suspicious process that tries to delete the proc
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `process_deleting_its_process_file_path_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **process_deleting_its_process_file_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* EventCode
@@ -83,9 +133,6 @@ unknown
* [WhisperGate](/stories/whispergate)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -95,8 +142,6 @@ unknown
| 60.0 | 60 | 100 | A process $Image$ tries to delete its process path in commandline $cmdline$ as part of defense evasion in host $Computer$ |
-
-
#### Reference
* [https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html](https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html)
@@ -106,7 +151,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-02-18-rundll32_dnsquery.md b/docs/_posts/2022-02-18-rundll32_dnsquery.md
index 9588759a9b..640a455271 100644
--- a/docs/_posts/2022-02-18-rundll32_dnsquery.md
+++ b/docs/_posts/2022-02-18-rundll32_dnsquery.md
@@ -27,16 +27,21 @@ tags:
This search is to detect a suspicious rundll32.exe process having a http connection and do a dns query in some web domain. This technique was seen in IcedID malware where the rundll32 that execute its payload will contact amazon.com to check internet connect and to communicate to its C&C server to download config and other file component.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2022-02-18
- **Author**: Teoderick Contreras, Splunk
- **ID**: f1483f5e-ee29-11eb-9d23-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ This search is to detect a suspicious rundll32.exe process having a http connect
| [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -56,10 +106,10 @@ This search is to detect a suspicious rundll32.exe process having a http connect
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `rundll32_dnsquery_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **rundll32_dnsquery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -81,9 +131,6 @@ unknown
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -93,8 +140,6 @@ unknown
| 56.0 | 70 | 80 | rundll32 process $process_name$ having a dns query to $QueryName$ in host $Computer$ |
-
-
#### Reference
* [https://any.run/malware-trends/icedid](https://any.run/malware-trends/icedid)
@@ -102,7 +147,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-02-18-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md b/docs/_posts/2022-02-18-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md
index ec47142761..e2c3712343 100644
--- a/docs/_posts/2022-02-18-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md
+++ b/docs/_posts/2022-02-18-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md
@@ -27,16 +27,21 @@ tags:
Monitor for changes of the ExecutionPolicy in the registry to the values "unrestricted" or "bypass," which allows the execution of malicious scripts.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2022-02-18
- **Author**: Patrick Bareiss, Splunk
- **ID**: c2590137-0b08-4985-9ec5-6ae23d92f63d
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,57 @@ Monitor for changes of the ExecutionPolicy in the registry to the values "unrest
| [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Installation
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +113,10 @@ Monitor for changes of the ExecutionPolicy in the registry to the values "unrest
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -82,10 +138,6 @@ Administrators may attempt to change the default execution policy on a system fo
* [HAFNIUM Group](/stories/hafnium_group)
-#### Kill Chain Phase
-* Installation
-* Actions on Objectives
-
#### RBA
@@ -95,13 +147,11 @@ Administrators may attempt to change the default execution policy on a system fo
| 48.0 | 60 | 80 | A registry modification in $registry_path$ with reg key $registry_key_name$ and reg value $registry_value_name$ in host $dest$ |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-02-22-disabled_kerberos_pre-authentication_discovery_with_get-aduser.md b/docs/_posts/2022-02-22-disabled_kerberos_pre-authentication_discovery_with_get-aduser.md
index d28d16e508..f20f996b8e 100644
--- a/docs/_posts/2022-02-22-disabled_kerberos_pre-authentication_discovery_with_get-aduser.md
+++ b/docs/_posts/2022-02-22-disabled_kerberos_pre-authentication_discovery_with_get-aduser.md
@@ -26,16 +26,21 @@ tags:
The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-ADUser` commandlet with specific parameters. `Get-ADUser` is part of the Active Directory PowerShell module used to manage Windows Active Directory networks. As the name suggests, `Get-ADUser` is used to query for domain users. With the appropiate parameters, Get-ADUser allows adversaries to discover domain accounts with Kerberos Pre Authentication disabled.\ Red Teams and adversaries alike use may abuse Get-ADUSer to enumerate these accounts and attempt to crack their passwords offline.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2022-02-22
- **Author**: Mauricio Velazco, Splunk
- **ID**: 114c6bfe-9406-11ec-bcce-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,51 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
| [T1558.004](https://attack.mitre.org/techniques/T1558/004/) | AS-REP Roasting | Credential Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -54,10 +104,10 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `disabled_kerberos_pre-authentication_discovery_with_get-aduser_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **disabled_kerberos_pre-authentication_discovery_with_get-aduser_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -77,9 +127,6 @@ Administrators or power users may use search for accounts with Kerberos Pre Auth
* [Active Directory Kerberos Attacks](/stories/active_directory_kerberos_attacks)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -89,8 +136,6 @@ Administrators or power users may use search for accounts with Kerberos Pre Auth
| 54.0 | 60 | 90 | Disabled Kerberos Pre-Authentication Discovery With Get-ADUser from $dest$ |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1558/004/](https://attack.mitre.org/techniques/T1558/004/)
@@ -100,7 +145,7 @@ Administrators or power users may use search for accounts with Kerberos Pre Auth
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-02-22-kerberos_pre-authentication_flag_disabled_in_useraccountcontrol.md b/docs/_posts/2022-02-22-kerberos_pre-authentication_flag_disabled_in_useraccountcontrol.md
index 1abc03d678..10185d2ffd 100644
--- a/docs/_posts/2022-02-22-kerberos_pre-authentication_flag_disabled_in_useraccountcontrol.md
+++ b/docs/_posts/2022-02-22-kerberos_pre-authentication_flag_disabled_in_useraccountcontrol.md
@@ -26,16 +26,21 @@ tags:
The following analytic leverages Windows Security Event 4738, `A user account was changed`, to identify a change performed on a domain user object that disables Kerberos Pre-Authentication. Disabling the Pre Authentication flag in the UserAccountControl property allows an adversary to easily perform a brute force attack against the user's password offline leveraging the ASP REP Roasting technique. Red Teams and adversaries alike who have obtained privileges in an Active Directory network may use this technique as a backdoor or a way to escalate privileges.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2022-02-22
- **Author**: Mauricio Velazco, Splunk
- **ID**: 0cb847ee-9423-11ec-b2df-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,51 @@ The following analytic leverages Windows Security Event 4738, `A user account wa
| [T1558.004](https://attack.mitre.org/techniques/T1558/004/) | AS-REP Roasting | Credential Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -55,7 +105,7 @@ The following analytic leverages Windows Security Event 4738, `A user account wa
The SPL above uses the following Macros:
* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
-Note that `kerberos_pre-authentication_flag_disabled_in_useraccountcontrol_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **kerberos_pre-authentication_flag_disabled_in_useraccountcontrol_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -75,9 +125,6 @@ Unknown.
* [Active Directory Kerberos Attacks](/stories/active_directory_kerberos_attacks)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -87,8 +134,6 @@ Unknown.
| 45.0 | 50 | 90 | Kerberos Pre Authentication was Disabled for $Account_Name$ |
-
-
#### Reference
* [https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/useraccountcontrol-manipulate-account-properties](https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/useraccountcontrol-manipulate-account-properties)
@@ -98,7 +143,7 @@ Unknown.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-02-22-scheduled_task_deleted_or_created_via_cmd.md b/docs/_posts/2022-02-22-scheduled_task_deleted_or_created_via_cmd.md
index be6cfab2f8..f7b8fe52f7 100644
--- a/docs/_posts/2022-02-22-scheduled_task_deleted_or_created_via_cmd.md
+++ b/docs/_posts/2022-02-22-scheduled_task_deleted_or_created_via_cmd.md
@@ -31,16 +31,21 @@ tags:
The following analytic identifies the creation or deletion of a scheduled task using schtasks.exe with flags - create or delete being passed on the command-line. This has been associated with the Dragonfly threat actor, and the SUNBURST attack against Solarwinds. This analytic replaces "Scheduled Task used in BadRabbit Ransomware".
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2022-02-22
- **Author**: Bhavin Patel, Splunk
- **ID**: d5af132c-7c17-439c-9d31-13d55340f36c
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -48,6 +53,55 @@ The following analytic identifies the creation or deletion of a scheduled task u
| [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.IP
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+
+
+
+
+
+
+
#### Search
```
@@ -61,10 +115,10 @@ The following analytic identifies the creation or deletion of a scheduled task u
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `scheduled_task_deleted_or_created_via_cmd_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **scheduled_task_deleted_or_created_via_cmd_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -89,9 +143,6 @@ It is possible scripts or administrators may trigger this analytic. Filter as ne
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -101,8 +152,6 @@ It is possible scripts or administrators may trigger this analytic. Filter as ne
| 56.0 | 70 | 80 | A schedule task process $process_name$ with create or delete commandline $process$ in host $dest$ |
-
-
#### Reference
* [https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/](https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/)
@@ -110,7 +159,7 @@ It is possible scripts or administrators may trigger this analytic. Filter as ne
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-02-22-windows_wmi_process_call_create.md b/docs/_posts/2022-02-22-windows_wmi_process_call_create.md
index 52e0318430..f0cd00e8be 100644
--- a/docs/_posts/2022-02-22-windows_wmi_process_call_create.md
+++ b/docs/_posts/2022-02-22-windows_wmi_process_call_create.md
@@ -24,21 +24,77 @@ tags:
This analytic is to look for wmi commandlines to execute or create process. This technique was used by adversaries or threat actor to execute their malicious payload in local or remote host. This hunting query is a good pivot to start to look further which process trigger the wmi or what process it execute locally or remotely.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2022-02-22
- **Author**: Teoderick Contreras, Splunk
- **ID**: 0661c2de-93de-11ec-9833-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1047](https://attack.mitre.org/techniques/T1047/) | Windows Management Instrumentation | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -52,11 +108,11 @@ This analytic is to look for wmi commandlines to execute or create process. This
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `windows_wmi_process_call_create_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **windows_wmi_process_call_create_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +140,6 @@ Administrators may execute this command for testing or auditing.
* [Suspicious WMI Use](/stories/suspicious_wmi_use)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -96,8 +149,6 @@ Administrators may execute this command for testing or auditing.
| 25.0 | 50 | 50 | process with $process$ commandline executed in $dest$ |
-
-
#### Reference
* [https://github.com/NVISOsecurity/sigma-public/blob/master/rules/windows/process_creation/win_susp_wmi_execution.yml](https://github.com/NVISOsecurity/sigma-public/blob/master/rules/windows/process_creation/win_susp_wmi_execution.yml)
@@ -106,7 +157,7 @@ Administrators may execute this command for testing or auditing.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-02-23-kerberos_pre-authentication_flag_disabled_with_powershell.md b/docs/_posts/2022-02-23-kerberos_pre-authentication_flag_disabled_with_powershell.md
index 00e2b0e04c..82db512bd7 100644
--- a/docs/_posts/2022-02-23-kerberos_pre-authentication_flag_disabled_with_powershell.md
+++ b/docs/_posts/2022-02-23-kerberos_pre-authentication_flag_disabled_with_powershell.md
@@ -26,16 +26,21 @@ tags:
The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Set-ADAccountControl` commandlet with specific parameters. `Set-ADAccountControl` is part of the Active Directory PowerShell module used to manage Windows Active Directory networks. As the name suggests, `Set-ADAccountControl` is used to modify User Account Control values for an Active Directory domain account. With the appropiate parameters, Set-ADAccountControl allows adversaries to disable Kerberos Pre-Authentication for an account to to easily perform a brute force attack against the user's password offline leveraging the ASP REP Roasting technique. Red Teams and adversaries alike who have obtained privileges in an Active Directory network may use this technique as a backdoor or a way to escalate privileges.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2022-02-23
- **Author**: Mauricio Velazco, Splunk
- **ID**: 59b51620-94c9-11ec-b3d5-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,51 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
| [T1558.004](https://attack.mitre.org/techniques/T1558/004/) | AS-REP Roasting | Credential Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -54,10 +104,10 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `kerberos_pre-authentication_flag_disabled_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **kerberos_pre-authentication_flag_disabled_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -73,9 +123,6 @@ Although unlikely, Administrators may need to set this flag for legitimate purpo
* [Active Directory Kerberos Attacks](/stories/active_directory_kerberos_attacks)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -85,8 +132,6 @@ Although unlikely, Administrators may need to set this flag for legitimate purpo
| 45.0 | 50 | 90 | Kerberos Pre Authentication was Disabled using PowerShell on $dest$ |
-
-
#### Reference
* [https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/useraccountcontrol-manipulate-account-properties](https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/useraccountcontrol-manipulate-account-properties)
@@ -96,7 +141,7 @@ Although unlikely, Administrators may need to set this flag for legitimate purpo
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-02-23-windows_event_for_service_disabled.md b/docs/_posts/2022-02-23-windows_event_for_service_disabled.md
index a3859a0ae9..89c3ce9f75 100644
--- a/docs/_posts/2022-02-23-windows_event_for_service_disabled.md
+++ b/docs/_posts/2022-02-23-windows_event_for_service_disabled.md
@@ -27,16 +27,21 @@ tags:
This analytic will identify suspicious system event of services that was modified from start to disabled. This technique is seen where the adversary attempts to disable security app services, other malware services to evade the defense systems on the compromised host
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2022-02-23
- **Author**: Teoderick Contreras, Splunk
- **ID**: 9c2620a8-94a1-11ec-b40c-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,57 @@ This analytic will identify suspicious system event of services that was modifie
| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -56,10 +112,10 @@ This analytic will identify suspicious system event of services that was modifie
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `windows_event_for_service_disabled_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **windows_event_for_service_disabled_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -80,9 +136,6 @@ Windows service update may cause this event. In that scenario, filtering is need
* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -92,8 +145,6 @@ Windows service update may cause this event. In that scenario, filtering is need
| 36.0 | 60 | 60 | Service was disabled on $Computer$ |
-
-
#### Reference
* [https://blog.talosintelligence.com/2018/02/olympic-destroyer.html](https://blog.talosintelligence.com/2018/02/olympic-destroyer.html)
@@ -101,7 +152,7 @@ Windows service update may cause this event. In that scenario, filtering is need
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-02-23-windows_excessive_disabled_services_event.md b/docs/_posts/2022-02-23-windows_excessive_disabled_services_event.md
index 49520c4703..2b50b29d1e 100644
--- a/docs/_posts/2022-02-23-windows_excessive_disabled_services_event.md
+++ b/docs/_posts/2022-02-23-windows_excessive_disabled_services_event.md
@@ -27,16 +27,21 @@ tags:
This analytic will identify suspicious excessive number of system events of services that was modified from start to disabled. This technique is seen where the adversary attempts to disable security app services, other malware services oer serve as an destructive impact to complete the objective on the compromised system. One good example for this scenario is Olympic destroyer where it disable all active services in the compromised host as part of its destructive impact and defense evasion.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2022-02-23
- **Author**: Teoderick Contreras, Splunk
- **ID**: c3f85976-94a5-11ec-9a58-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,57 @@ This analytic will identify suspicious excessive number of system events of serv
| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +113,10 @@ This analytic will identify suspicious excessive number of system events of serv
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `windows_excessive_disabled_services_event_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **windows_excessive_disabled_services_event_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -81,9 +137,6 @@ Unknown
* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -93,8 +146,6 @@ Unknown
| 81.0 | 90 | 90 | Service was disabled in $Computer$ |
-
-
#### Reference
* [https://blog.talosintelligence.com/2018/02/olympic-destroyer.html](https://blog.talosintelligence.com/2018/02/olympic-destroyer.html)
@@ -102,7 +153,7 @@ Unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-02-23-windows_process_with_namedpipe_commandline.md b/docs/_posts/2022-02-23-windows_process_with_namedpipe_commandline.md
index 753121473e..55982e231d 100644
--- a/docs/_posts/2022-02-23-windows_process_with_namedpipe_commandline.md
+++ b/docs/_posts/2022-02-23-windows_process_with_namedpipe_commandline.md
@@ -25,21 +25,77 @@ tags:
This analytic is to look for process commandline that contains named pipe. This technique was seen in some adversaries, threat actor and malware like olympic destroyer to communicate to its other child processes after process injection that serve as defense evasion and privilege escalation. On the other hand this analytic may catch some normal process that using this technique for example browser application. In that scenario we include common process path we've seen during testing that cause false positive which is the program files. False positive may still be arise if the normal application is in other folder path.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2022-02-23
- **Author**: Teoderick Contreras, Splunk
- **ID**: e64399d4-94a8-11ec-a9da-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -53,10 +109,10 @@ This analytic is to look for process commandline that contains named pipe. This
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `windows_process_with_namedpipe_commandline_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **windows_process_with_namedpipe_commandline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +140,6 @@ Normal browser application may use this technique. Please update the filter macr
* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -96,8 +149,6 @@ Normal browser application may use this technique. Please update the filter macr
| 49.0 | 70 | 70 | Process with named pipe in $process$ on $dest$ |
-
-
#### Reference
* [https://blog.talosintelligence.com/2018/02/olympic-destroyer.html](https://blog.talosintelligence.com/2018/02/olympic-destroyer.html)
@@ -105,7 +156,7 @@ Normal browser application may use this technique. Please update the filter macr
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-02-23-windows_service_creation_using_registry_entry.md b/docs/_posts/2022-02-23-windows_service_creation_using_registry_entry.md
index ac3847c0b3..d7f9ae2801 100644
--- a/docs/_posts/2022-02-23-windows_service_creation_using_registry_entry.md
+++ b/docs/_posts/2022-02-23-windows_service_creation_using_registry_entry.md
@@ -26,21 +26,77 @@ tags:
This analytic is to look for suspicious modification or creation of registry to have service entry. This technique is abused by adversaries or threat actor to persist, gain privileges in the machine or even lateral movement. This technique can be executed using reg.exe application or using windows API like for example the CrashOveride malware. This detection is a good indicator that a process is trying to create a service entry using registry ImagePath.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2022-02-23
- **Author**: Teoderick Contreras, Splunk
- **ID**: 25212358-948e-11ec-ad47-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1574.011](https://attack.mitre.org/techniques/T1574/011/) | Services Registry Permissions Weakness | Defense Evasion, Persistence, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -61,7 +117,7 @@ This analytic is to look for suspicious modification or creation of registry to
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `windows_service_creation_using_registry_entry_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **windows_service_creation_using_registry_entry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -92,9 +148,6 @@ Third party tools may used this technique to create services but not so common.
* [Windows Registry Abuse](/stories/windows_registry_abuse)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -104,8 +157,6 @@ Third party tools may used this technique to create services but not so common.
| 64.0 | 80 | 80 | A Windows Service was created on a endpoint from $dest$ |
-
-
#### Reference
* [https://github.com/redcanaryco/atomic-red-team/blob/36d49de4c8b00bf36054294b4a1fcbab3917d7c5/atomics/T1574.011/T1574.011.md](https://github.com/redcanaryco/atomic-red-team/blob/36d49de4c8b00bf36054294b4a1fcbab3917d7c5/atomics/T1574.011/T1574.011.md)
@@ -113,7 +164,7 @@ Third party tools may used this technique to create services but not so common.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-02-24-aws_lambda_updatefunctioncode.md b/docs/_posts/2022-02-24-aws_lambda_updatefunctioncode.md
index 5481d60106..3b772c1128 100644
--- a/docs/_posts/2022-02-24-aws_lambda_updatefunctioncode.md
+++ b/docs/_posts/2022-02-24-aws_lambda_updatefunctioncode.md
@@ -23,21 +23,77 @@ tags:
This analytic is designed to detect IAM users attempting to update/modify AWS lambda code via the AWS CLI to gain persistence, futher access into your AWS environment and to facilitate planting backdoors. In this instance, an attacker may upload malicious code/binary to a lambda function which will be executed automatically when the funnction is triggered.
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2022-02-24
- **Author**: Bhavin Patel, Splunk
- **ID**: 211b80d3-6340-4345-11ad-212bf3d0d111
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1204](https://attack.mitre.org/techniques/T1204/) | User Execution | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.DS
+* PR.AC
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 13
+
+
+
+
+
+
+
#### Search
```
@@ -50,7 +106,7 @@ This analytic is designed to detect IAM users attempting to update/modify AWS la
The SPL above uses the following Macros:
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
-Note that `aws_lambda_updatefunctioncode_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **aws_lambda_updatefunctioncode_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -69,9 +125,6 @@ While this search has no known false positives, it is possible that an AWS admin
* [Suspicious Cloud User Activities](/stories/suspicious_cloud_user_activities)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -81,8 +134,6 @@ While this search has no known false positives, it is possible that an AWS admin
| 63.0 | 70 | 90 | User $user_arn$ is attempting to update the lambda function code of $function_updated$ from this IP $src_ip$ |
-
-
#### Reference
* [http://detectioninthe.cloud/execution/modify_lambda_function_code/](http://detectioninthe.cloud/execution/modify_lambda_function_code/)
@@ -91,7 +142,7 @@ While this search has no known false positives, it is possible that an AWS admin
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-02-25-windows_disable_memory_crash_dump.md b/docs/_posts/2022-02-25-windows_disable_memory_crash_dump.md
index 807c35dba5..aad9823397 100644
--- a/docs/_posts/2022-02-25-windows_disable_memory_crash_dump.md
+++ b/docs/_posts/2022-02-25-windows_disable_memory_crash_dump.md
@@ -24,21 +24,77 @@ tags:
The following analytic identifies a process that is attempting to disable the ability on Windows to generate a memory crash dump. This was recently identified being utilized by HermeticWiper. To disable crash dumps, the value must be set to 0. This feature is typically modified to perform a memory crash dump when a computer stops unexpectedly because of a Stop error (also known as a blue screen, system crash, or bug check).
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2022-02-25
- **Author**: Michael Haag, Splunk
- **ID**: 59e54602-9680-11ec-a8a6-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1485](https://attack.mitre.org/techniques/T1485/) | Data Destruction | Impact |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -57,7 +113,7 @@ The following analytic identifies a process that is attempting to disable the ab
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `windows_disable_memory_crash_dump_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **windows_disable_memory_crash_dump_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -89,9 +145,6 @@ unknown
* [Windows Registry Abuse](/stories/windows_registry_abuse)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -101,8 +154,6 @@ unknown
| 90.0 | 90 | 100 | A process $process_name$ was identified attempting to disable memory crash dumps on $dest$. |
-
-
#### Reference
* [https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html](https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html)
@@ -111,7 +162,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-02-25-windows_file_without_extension_in_critical_folder.md b/docs/_posts/2022-02-25-windows_file_without_extension_in_critical_folder.md
index f376ed2933..4920f10377 100644
--- a/docs/_posts/2022-02-25-windows_file_without_extension_in_critical_folder.md
+++ b/docs/_posts/2022-02-25-windows_file_without_extension_in_critical_folder.md
@@ -24,21 +24,77 @@ tags:
This analytic is to look for suspicious file creation in the critical folder like "System32\Drivers" folder without file extension. This artifacts was seen in latest hermeticwiper where it drops its driver component in Driver Directory both the compressed(without file extension) and the actual driver component (with .sys file extension). This TTP is really a good indication that a host might be compromised by this destructive malware that wipes the boot sector of the system.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2022-02-25
- **Author**: Teoderick Contreras, Bhavin Patel, Splunk
- **ID**: 0dbcac64-963c-11ec-bf04-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1485](https://attack.mitre.org/techniques/T1485/) | Data Destruction | Impact |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -58,10 +114,10 @@ This analytic is to look for suspicious file creation in the critical folder lik
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `windows_file_without_extension_in_critical_folder_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **windows_file_without_extension_in_critical_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -88,9 +144,6 @@ Unknown at this point
* [Hermetic Wiper](/stories/hermetic_wiper)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -100,8 +153,6 @@ Unknown at this point
| 90.0 | 90 | 100 | Driver file with out file extension drop in $file_path$ in $dest$ |
-
-
#### Reference
* [https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html](https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html)
@@ -109,7 +160,7 @@ Unknown at this point
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-02-25-windows_raw_access_to_disk_volume_partition.md b/docs/_posts/2022-02-25-windows_raw_access_to_disk_volume_partition.md
index 78d7ead015..09fa8ebf84 100644
--- a/docs/_posts/2022-02-25-windows_raw_access_to_disk_volume_partition.md
+++ b/docs/_posts/2022-02-25-windows_raw_access_to_disk_volume_partition.md
@@ -27,16 +27,21 @@ tags:
This analytic is to look for suspicious raw access read to device disk partition of the host machine. This technique was seen in several attacks by adversaries or threat actor to wipe, encrypt or overwrite the boot sector of each partition as part of their impact payload for example the "hermeticwiper" malware. This detection is a good indicator that there is a process try to read or write on boot sector.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2022-02-25
- **Author**: Teoderick Contreras, Splunk
- **ID**: a85aa37e-9647-11ec-90c5-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,57 @@ This analytic is to look for suspicious raw access read to device disk partition
| [T1561](https://attack.mitre.org/techniques/T1561/) | Disk Wipe | Impact |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -56,10 +112,10 @@ This analytic is to look for suspicious raw access read to device disk partition
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `windows_raw_access_to_disk_volume_partition_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **windows_raw_access_to_disk_volume_partition_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +140,6 @@ This event is really notable but we found minimal number of normal application f
* [Hermetic Wiper](/stories/hermetic_wiper)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -96,8 +149,6 @@ This event is really notable but we found minimal number of normal application f
| 90.0 | 90 | 100 | Process accessing disk partition $device$ in $dest$ |
-
-
#### Reference
* [https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html](https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html)
@@ -105,7 +156,7 @@ This event is really notable but we found minimal number of normal application f
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-02-28-excessive_distinct_processes_from_windows_temp.md b/docs/_posts/2022-02-28-excessive_distinct_processes_from_windows_temp.md
index 2ab840a0d8..b6fd1bc350 100644
--- a/docs/_posts/2022-02-28-excessive_distinct_processes_from_windows_temp.md
+++ b/docs/_posts/2022-02-28-excessive_distinct_processes_from_windows_temp.md
@@ -24,21 +24,71 @@ tags:
This analytic will identify suspicious series of process executions. We have observed that post exploit framework tools like Koadic and Meterpreter will launch an excessive number of processes with distinct file paths from Windows\Temp to execute actions on objective. This behavior is extremely anomalous compared to typical application behaviors that use Windows\Temp.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Microsoft Windows](https://splunkbase.splunk.com/app/742)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Microsoft Windows](https://splunkbase.splunk.com/app/742)
- **Last Updated**: 2022-02-28
- **Author**: Michael Hart, Mauricio Velazco, Splunk
- **ID**: 23587b6a-c479-11eb-b671-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -53,10 +103,10 @@ This analytic will identify suspicious series of process executions. We have ob
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `excessive_distinct_processes_from_windows_temp_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **excessive_distinct_processes_from_windows_temp_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -75,9 +125,6 @@ Many benign applications will create processes from executables in Windows\Temp,
* [Meterpreter](/stories/meterpreter)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -87,8 +134,6 @@ Many benign applications will create processes from executables in Windows\Temp,
| 80.0 | 80 | 100 | Multiple processes were executed out of windows\temp within a short amount of time on $dest$. |
-
-
#### Reference
* [https://www.offensive-security.com/metasploit-unleashed/about-meterpreter/](https://www.offensive-security.com/metasploit-unleashed/about-meterpreter/)
@@ -96,7 +141,7 @@ Many benign applications will create processes from executables in Windows\Temp,
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-03-02-windows_modify_show_compress_color_and_info_tip_registry.md b/docs/_posts/2022-03-02-windows_modify_show_compress_color_and_info_tip_registry.md
index 81d2f94a08..26d0f0fe7b 100644
--- a/docs/_posts/2022-03-02-windows_modify_show_compress_color_and_info_tip_registry.md
+++ b/docs/_posts/2022-03-02-windows_modify_show_compress_color_and_info_tip_registry.md
@@ -24,21 +24,77 @@ tags:
This analytic is to look for suspicious registry modification related to file compression color and information tips. This IOC was seen in hermetic wiper where it has a thread that will create this registry entry to change the color of compressed or encrypted files in NTFS file system as well as the pop up information tips. This is a good indicator that a process tries to modified one of the registry GlobalFolderOptions related to file compression attribution in terms of color in NTFS file system.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2022-03-02
- **Author**: Teoderick Contreras, Splunk
- **ID**: b7548c2e-9a10-11ec-99e3-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -59,7 +115,7 @@ This analytic is to look for suspicious registry modification related to file co
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `windows_modify_show_compress_color_and_info_tip_registry_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **windows_modify_show_compress_color_and_info_tip_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -82,9 +138,6 @@ unknown
* [Windows Registry Abuse](/stories/windows_registry_abuse)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -94,8 +147,6 @@ unknown
| 25.0 | 50 | 50 | Registry modification in "ShowCompColor" and "ShowInfoTips" on $dest$ |
-
-
#### Reference
* [https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html](https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html)
@@ -103,7 +154,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-03-03-aws_createaccesskey.md b/docs/_posts/2022-03-03-aws_createaccesskey.md
index 40469587ca..6dd7347cd5 100644
--- a/docs/_posts/2022-03-03-aws_createaccesskey.md
+++ b/docs/_posts/2022-03-03-aws_createaccesskey.md
@@ -26,16 +26,21 @@ tags:
This search looks for AWS CloudTrail events where a user A who has already permission to create access keys, makes an API call to create access keys for another user B. Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B)
-- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2022-03-03
- **Author**: Bhavin Patel, Splunk
- **ID**: 2a9b80d3-6340-4345-11ad-212bf3d0d111
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,57 @@ This search looks for AWS CloudTrail events where a user A who has already permi
| [T1136](https://attack.mitre.org/techniques/T1136/) | Create Account | Persistence |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.DS
+* PR.AC
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 13
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +113,10 @@ This search looks for AWS CloudTrail events where a user A who has already permi
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `aws_createaccesskey_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **aws_createaccesskey_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -80,9 +136,6 @@ While this search has no known false positives, it is possible that an AWS admin
* [AWS IAM Privilege Escalation](/stories/aws_iam_privilege_escalation)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -92,8 +145,6 @@ While this search has no known false positives, it is possible that an AWS admin
| 63.0 | 70 | 90 | User $user_arn$ is attempting to create access keys for $requestParameters.userName$ from this IP $src$ |
-
-
#### Reference
* [https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws](https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws)
@@ -102,7 +153,7 @@ While this search has no known false positives, it is possible that an AWS admin
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-03-03-aws_updateloginprofile.md b/docs/_posts/2022-03-03-aws_updateloginprofile.md
index 595f9c2fe6..ecbe2fa65c 100644
--- a/docs/_posts/2022-03-03-aws_updateloginprofile.md
+++ b/docs/_posts/2022-03-03-aws_updateloginprofile.md
@@ -26,16 +26,21 @@ tags:
This search looks for AWS CloudTrail events where a user A who has already permission to update login profile, makes an API call to update login profile for another user B . Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B)
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2022-03-03
- **Author**: Bhavin Patel, Splunk
- **ID**: 2a9b80d3-6a40-4115-11ad-212bf3d0d111
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,57 @@ This search looks for AWS CloudTrail events where a user A who has already permi
| [T1136](https://attack.mitre.org/techniques/T1136/) | Create Account | Persistence |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.DS
+* PR.AC
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 13
+
+
+
+
+
+
+
#### Search
```
@@ -57,10 +113,10 @@ This search looks for AWS CloudTrail events where a user A who has already permi
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `aws_updateloginprofile_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **aws_updateloginprofile_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -80,9 +136,6 @@ While this search has no known false positives, it is possible that an AWS admin
* [AWS IAM Privilege Escalation](/stories/aws_iam_privilege_escalation)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -92,8 +145,6 @@ While this search has no known false positives, it is possible that an AWS admin
| 30.0 | 50 | 60 | From IP address $sourceIPAddress$, user agent $userAgent$ has trigged an event $eventName$ for updating the existing login profile, potentially giving user $user_arn$ more access privilleges |
-
-
#### Reference
* [https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws](https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws)
@@ -102,7 +153,7 @@ While this search has no known false positives, it is possible that an AWS admin
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-03-04-macos_lolbin.md b/docs/_posts/2022-03-04-macos_lolbin.md
index 1c92d68f28..3d61e4171d 100644
--- a/docs/_posts/2022-03-04-macos_lolbin.md
+++ b/docs/_posts/2022-03-04-macos_lolbin.md
@@ -27,16 +27,21 @@ tags:
Detect multiple executions of Living off the Land (LOLbin) binaries in a short period of time.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2022-03-04
- **Author**: Patrick Bareiss, Splunk
- **ID**: 58d270fb-5b39-418e-a855-4b8ac046805e
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,57 @@ Detect multiple executions of Living off the Land (LOLbin) binaries in a short p
| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -61,7 +117,7 @@ The SPL above uses the following Macros:
* [osquery](https://github.com/splunk/security_content/blob/develop/macros/osquery.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `macos_lolbin_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **macos_lolbin_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +140,6 @@ None identified.
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -96,8 +149,6 @@ None identified.
| 25.0 | 50 | 50 | Multiplle LOLbin are executed on host $host$ by user $user$ |
-
-
#### Reference
* [https://osquery.readthedocs.io/en/stable/deployment/process-auditing/](https://osquery.readthedocs.io/en/stable/deployment/process-auditing/)
@@ -105,7 +156,7 @@ None identified.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-03-08-suspicious_msbuild_path.md b/docs/_posts/2022-03-08-suspicious_msbuild_path.md
index 2d278d2aab..3c46db4ea8 100644
--- a/docs/_posts/2022-03-08-suspicious_msbuild_path.md
+++ b/docs/_posts/2022-03-08-suspicious_msbuild_path.md
@@ -33,16 +33,21 @@ tags:
The following analytic identifies msbuild.exe executing from a non-standard path. Msbuild.exe is natively found in C:\Windows\Microsoft.NET\Framework\v4.0.30319 and C:\Windows\Microsoft.NET\Framework64\v4.0.30319. Instances of Visual Studio will run a copy of msbuild.exe. A moved instance of MSBuild is suspicious, however there are instances of build applications that will move or use a copy of MSBuild.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2022-03-08
- **Author**: Michael Haag, Splunk
- **ID**: f5198224-551c-11eb-ae93-0242ac130002
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -54,6 +59,56 @@ The following analytic identifies msbuild.exe executing from a non-standard path
| [T1127.001](https://attack.mitre.org/techniques/T1127/001/) | MSBuild | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -67,11 +122,11 @@ The following analytic identifies msbuild.exe executing from a non-standard path
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `suspicious_msbuild_path_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **suspicious_msbuild_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -101,9 +156,6 @@ Some legitimate applications may use a moved copy of msbuild.exe, triggering a f
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -113,8 +165,6 @@ Some legitimate applications may use a moved copy of msbuild.exe, triggering a f
| 49.0 | 70 | 70 | Msbuild.exe ran from an uncommon path on $dest$ execyted by $user$ |
-
-
#### Reference
* [https://lolbas-project.github.io/lolbas/Binaries/Msbuild/](https://lolbas-project.github.io/lolbas/Binaries/Msbuild/)
@@ -123,7 +173,7 @@ Some legitimate applications may use a moved copy of msbuild.exe, triggering a f
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-03-08-windows_disable_change_password_through_registry.md b/docs/_posts/2022-03-08-windows_disable_change_password_through_registry.md
index f452b05736..24e2910587 100644
--- a/docs/_posts/2022-03-08-windows_disable_change_password_through_registry.md
+++ b/docs/_posts/2022-03-08-windows_disable_change_password_through_registry.md
@@ -24,21 +24,77 @@ tags:
This analytic is to detect a suspicious registry modification to disable change password feature of the windows host. This registry modification may disables the Change Password button on the Windows Security dialog box (which appears when you press Ctrl+Alt+Del). As a result, users cannot change their Windows password on demand. This technique was seen in some malware family like ransomware to prevent the user to change the password after ownning the network or a system during attack. This windows feature may implemented by administrator to prevent normal user to change the password of a critical host or server, In this type of scenario filter is needed to minimized false positive.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2022-03-08
- **Author**: Teoderick Contreras, Splunk
- **ID**: 0df33e1a-9ef6-11ec-a1ad-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -59,7 +115,7 @@ This analytic is to detect a suspicious registry modification to disable change
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `windows_disable_change_password_through_registry_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **windows_disable_change_password_through_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -88,9 +144,6 @@ This windows feature may implemented by administrator to prevent normal user to
* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -100,8 +153,6 @@ This windows feature may implemented by administrator to prevent normal user to
| 49.0 | 70 | 70 | Registry modification in "DisableChangePassword" on $dest$ |
-
-
#### Reference
* [https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom_heartbleed.thdobah](https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom_heartbleed.thdobah)
@@ -109,7 +160,7 @@ This windows feature may implemented by administrator to prevent normal user to
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-03-08-windows_disable_lock_workstation_feature_through_registry.md b/docs/_posts/2022-03-08-windows_disable_lock_workstation_feature_through_registry.md
index 9c7b8ffda9..99704a9980 100644
--- a/docs/_posts/2022-03-08-windows_disable_lock_workstation_feature_through_registry.md
+++ b/docs/_posts/2022-03-08-windows_disable_lock_workstation_feature_through_registry.md
@@ -24,21 +24,77 @@ tags:
This analytic is to detect a suspicious registry modification to disable Lock Computer windows features. This registry modification prevent the user from locking its screen or computer that are being abused by several malware for example ransomware. This technique was used by threat actor to make its payload more impactful to the compromised host.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2022-03-08
- **Author**: Teoderick Contreras, Splunk
- **ID**: c82adbc6-9f00-11ec-a81f-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -59,7 +115,7 @@ This analytic is to detect a suspicious registry modification to disable Lock Co
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `windows_disable_lock_workstation_feature_through_registry_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **windows_disable_lock_workstation_feature_through_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -88,9 +144,6 @@ unknown
* [Windows Registry Abuse](/stories/windows_registry_abuse)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -100,8 +153,6 @@ unknown
| 49.0 | 70 | 70 | Registry modification in "DisableLockWorkstation" on $dest$ |
-
-
#### Reference
* [https://www.bleepingcomputer.com/news/security/in-dev-ransomware-forces-you-do-to-survey-before-unlocking-computer/](https://www.bleepingcomputer.com/news/security/in-dev-ransomware-forces-you-do-to-survey-before-unlocking-computer/)
@@ -110,7 +161,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-03-08-windows_disable_logoff_button_through_registry.md b/docs/_posts/2022-03-08-windows_disable_logoff_button_through_registry.md
index 2c9e6ab677..d72acb6401 100644
--- a/docs/_posts/2022-03-08-windows_disable_logoff_button_through_registry.md
+++ b/docs/_posts/2022-03-08-windows_disable_logoff_button_through_registry.md
@@ -24,21 +24,77 @@ tags:
This analytic is to detect a suspicious registry modification to disable logoff feature in windows host. This registry when enable will prevent users to log off of the system by using any method, including programs run from the command line, such as scripts. It also disables or removes all menu items and buttons that log the user off of the system. This technique was seen abused by ransomware malware to make the compromised host un-useful and hard to remove other registry modification made on the machine that needs restart to take effect. This windows feature may implement by administrator in some server where shutdown is critical. In that scenario filter of machine and users that can modify this registry is needed.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2022-03-08
- **Author**: Teoderick Contreras, Splunk
- **ID**: b2fb6830-9ed1-11ec-9fcb-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -59,7 +115,7 @@ This analytic is to detect a suspicious registry modification to disable logoff
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `windows_disable_logoff_button_through_registry_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **windows_disable_logoff_button_through_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -87,9 +143,6 @@ This windows feature may implement by administrator in some server where shutdow
* [Windows Registry Abuse](/stories/windows_registry_abuse)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -99,8 +152,6 @@ This windows feature may implement by administrator in some server where shutdow
| 49.0 | 70 | 70 | Registry modification in "NoLogOff" on $dest$ |
-
-
#### Reference
* [https://www.hybrid-analysis.com/sample/e2d4018fd3bd541c153af98ef7c25b2bf4a66bc3bfb89e437cde89fd08a9dd7b/5b1f4d947ca3e10f22714774](https://www.hybrid-analysis.com/sample/e2d4018fd3bd541c153af98ef7c25b2bf4a66bc3bfb89e437cde89fd08a9dd7b/5b1f4d947ca3e10f22714774)
@@ -110,7 +161,7 @@ This windows feature may implement by administrator in some server where shutdow
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-03-08-windows_disable_shutdown_button_through_registry.md b/docs/_posts/2022-03-08-windows_disable_shutdown_button_through_registry.md
index abbf435529..3c1e4a0bd7 100644
--- a/docs/_posts/2022-03-08-windows_disable_shutdown_button_through_registry.md
+++ b/docs/_posts/2022-03-08-windows_disable_shutdown_button_through_registry.md
@@ -24,21 +24,77 @@ tags:
This analytic is to detect a suspicious registry modification to disable shutdown button on the logon user. This technique was seen in several malware especially in ransomware family like killdisk malware variant to make the compromised host un-useful and hard to remove other registry modification made on the machine that needs restart to take effect. This windows feature may implement by administrator in some server where shutdown is critical. In that scenario filter of machine and users that can modify this registry is needed.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2022-03-08
- **Author**: Teoderick Contreras, Splunk
- **ID**: 55fb2958-9ecd-11ec-a06a-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -59,7 +115,7 @@ This analytic is to detect a suspicious registry modification to disable shutdow
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `windows_disable_shutdown_button_through_registry_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **windows_disable_shutdown_button_through_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -87,9 +143,6 @@ This windows feature may implement by administrator in some server where shutdow
* [Windows Registry Abuse](/stories/windows_registry_abuse)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -99,8 +152,6 @@ This windows feature may implement by administrator in some server where shutdow
| 49.0 | 70 | 70 | Registry modification in "shutdownwithoutlogon" on $dest$ |
-
-
#### Reference
* [https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom.msil.screenlocker.a/](https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom.msil.screenlocker.a/)
@@ -108,7 +159,7 @@ This windows feature may implement by administrator in some server where shutdow
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-03-08-windows_disable_windows_group_policy_features_through_registry.md b/docs/_posts/2022-03-08-windows_disable_windows_group_policy_features_through_registry.md
index 83a428e3fe..b7016fb78e 100644
--- a/docs/_posts/2022-03-08-windows_disable_windows_group_policy_features_through_registry.md
+++ b/docs/_posts/2022-03-08-windows_disable_windows_group_policy_features_through_registry.md
@@ -24,21 +24,77 @@ tags:
This analytic is to detect a suspicious registry modification to disable windows features. These techniques are seen in several ransomware malware to impair the compromised host to make it hard for analyst to mitigate or response from the attack. Disabling these known features make the analysis and forensic response more hard. Disabling these feature is not so common but can still be implemented by the administrator for security purposes. In this scenario filters for users that are allowed doing this is needed.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2022-03-08
- **Author**: Teoderick Contreras, Splunk
- **ID**: 63a449ae-9f04-11ec-945e-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -59,7 +115,7 @@ This analytic is to detect a suspicious registry modification to disable windows
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `windows_disable_windows_group_policy_features_through_registry_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **windows_disable_windows_group_policy_features_through_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -88,9 +144,6 @@ unknown
* [Windows Registry Abuse](/stories/windows_registry_abuse)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -100,8 +153,6 @@ unknown
| 49.0 | 70 | 70 | Registry modification to disable windows features on $dest$ |
-
-
#### Reference
* [https://hybrid-analysis.com/sample/ef1c427394c205580576d18ba68d5911089c7da0386f19d1ca126929d3e671ab?environmentId=120&lang=en](https://hybrid-analysis.com/sample/ef1c427394c205580576d18ba68d5911089c7da0386f19d1ca126929d3e671ab?environmentId=120&lang=en)
@@ -111,7 +162,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-03-08-windows_hide_notification_features_through_registry.md b/docs/_posts/2022-03-08-windows_hide_notification_features_through_registry.md
index 420e91eefe..3eb452f62a 100644
--- a/docs/_posts/2022-03-08-windows_hide_notification_features_through_registry.md
+++ b/docs/_posts/2022-03-08-windows_hide_notification_features_through_registry.md
@@ -24,21 +24,77 @@ tags:
This analytic is to detect a suspicious registry modification to hide common windows notification feature from compromised host. This technique was seen in some ransomware family to add more impact to its payload that are visually seen by user aside from the encrypted files and ransomware notes. Even this a good anomaly detection, administrator may implement this changes for auditing or security reason. In this scenario filter is needed.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2022-03-08
- **Author**: Teoderick Contreras, Splunk
- **ID**: cafa4bce-9f06-11ec-a7b2-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -59,7 +115,7 @@ This analytic is to detect a suspicious registry modification to hide common win
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `windows_hide_notification_features_through_registry_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **windows_hide_notification_features_through_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -88,9 +144,6 @@ unknown
* [Windows Registry Abuse](/stories/windows_registry_abuse)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -100,8 +153,6 @@ unknown
| 49.0 | 70 | 70 | Registry modification to hide windows notification on $dest$ |
-
-
#### Reference
* [https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/Ransom.Win32.ONALOCKER.A/](https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/Ransom.Win32.ONALOCKER.A/)
@@ -109,7 +160,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-03-15-detect_regasm_with_no_command_line_arguments.md b/docs/_posts/2022-03-15-detect_regasm_with_no_command_line_arguments.md
index 8d6b9b7117..190d61e635 100644
--- a/docs/_posts/2022-03-15-detect_regasm_with_no_command_line_arguments.md
+++ b/docs/_posts/2022-03-15-detect_regasm_with_no_command_line_arguments.md
@@ -27,16 +27,21 @@ tags:
The following analytic identifies regasm.exe with no command line arguments. This particular behavior occurs when another process injects into regasm.exe, no command line arguments will be present. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. Regasm.exe are natively found in `C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe` and `C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe`.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2022-03-15
- **Author**: Michael Haag, Splunk
- **ID**: c3bc1430-04e7-4178-835f-047d8e6e97df
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,56 @@ The following analytic identifies regasm.exe with no command line arguments. Thi
| [T1218.009](https://attack.mitre.org/techniques/T1218/009/) | Regsvcs/Regasm | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -58,11 +113,11 @@ The following analytic identifies regasm.exe with no command line arguments. Thi
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_regasm](https://github.com/splunk/security_content/blob/develop/macros/process_regasm.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_regasm_with_no_command_line_arguments_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_regasm_with_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -90,9 +145,6 @@ Although unlikely, limited instances of regasm.exe or may cause a false positive
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -102,8 +154,6 @@ Although unlikely, limited instances of regasm.exe or may cause a false positive
| 49.0 | 70 | 70 | The process $process_name$ was spawned by $parent_process_name$ without any command-line arguments on $dest$ by $user$. |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1218/009/](https://attack.mitre.org/techniques/T1218/009/)
@@ -113,7 +163,7 @@ Although unlikely, limited instances of regasm.exe or may cause a false positive
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md b/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md
index 4b5f3e1624..74812b1354 100644
--- a/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md
+++ b/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md
@@ -27,16 +27,21 @@ tags:
The following analytic identifies regsvcs.exe with no command line arguments. This particular behavior occurs when another process injects into regsvcs.exe, no command line arguments will be present. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. Regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2022-03-15
- **Author**: Michael Haag, Splunk
- **ID**: 6b74d578-a02e-4e94-a0d1-39440d0bf254
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,56 @@ The following analytic identifies regsvcs.exe with no command line arguments. Th
| [T1218.009](https://attack.mitre.org/techniques/T1218/009/) | Regsvcs/Regasm | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -58,11 +113,11 @@ The following analytic identifies regsvcs.exe with no command line arguments. Th
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_regsvcs](https://github.com/splunk/security_content/blob/develop/macros/process_regsvcs.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `detect_regsvcs_with_no_command_line_arguments_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **detect_regsvcs_with_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -90,9 +145,6 @@ Although unlikely, limited instances of regsvcs.exe may cause a false positive.
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -102,8 +154,6 @@ Although unlikely, limited instances of regsvcs.exe may cause a false positive.
| 49.0 | 70 | 70 | The process $process_name$ was spawned by $parent_process_name$ without any command-line arguments on $dest$ by $user$. |
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1218/009/](https://attack.mitre.org/techniques/T1218/009/)
@@ -113,7 +163,7 @@ Although unlikely, limited instances of regsvcs.exe may cause a false positive.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-03-15-dllhost_with_no_command_line_arguments_with_network.md b/docs/_posts/2022-03-15-dllhost_with_no_command_line_arguments_with_network.md
index 5e406c1dad..772ed5f046 100644
--- a/docs/_posts/2022-03-15-dllhost_with_no_command_line_arguments_with_network.md
+++ b/docs/_posts/2022-03-15-dllhost_with_no_command_line_arguments_with_network.md
@@ -25,21 +25,71 @@ tags:
The following analytic identifies DLLHost.exe with no command line arguments with a network connection. It is unusual for DLLHost.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, triage any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. DLLHost.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2022-03-15
- **Author**: Michael Haag, Splunk
- **ID**: f1c07594-a141-11eb-8407-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -59,10 +109,10 @@ The following analytic identifies DLLHost.exe with no command line arguments wit
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `dllhost_with_no_command_line_arguments_with_network_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **dllhost_with_no_command_line_arguments_with_network_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +134,6 @@ Although unlikely, some legitimate third party applications may use a moved copy
* [Cobalt Strike](/stories/cobalt_strike)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -96,8 +143,6 @@ Although unlikely, some legitimate third party applications may use a moved copy
| 49.0 | 70 | 70 | The process $process_name$ was spawned by $parent_image$ without any command-line arguments on $dest$ by $user$. |
-
-
#### Reference
* [https://raw.githubusercontent.com/threatexpress/malleable-c2/c3385e481159a759f79b8acfe11acf240893b830/jquery-c2.4.2.profile](https://raw.githubusercontent.com/threatexpress/malleable-c2/c3385e481159a759f79b8acfe11acf240893b830/jquery-c2.4.2.profile)
@@ -106,7 +151,7 @@ Although unlikely, some legitimate third party applications may use a moved copy
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-03-15-gpupdate_with_no_command_line_arguments_with_network.md b/docs/_posts/2022-03-15-gpupdate_with_no_command_line_arguments_with_network.md
index b7638adbb9..dac22000fe 100644
--- a/docs/_posts/2022-03-15-gpupdate_with_no_command_line_arguments_with_network.md
+++ b/docs/_posts/2022-03-15-gpupdate_with_no_command_line_arguments_with_network.md
@@ -25,21 +25,71 @@ tags:
The following analytic identifies gpupdate.exe with no command line arguments and with a network connection. It is unusual for gpupdate.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, triage any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. gpupdate.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2022-03-15
- **Author**: Michael Haag, Splunk
- **ID**: 2c853856-a140-11eb-a5b5-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -59,10 +109,10 @@ The following analytic identifies gpupdate.exe with no command line arguments an
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `gpupdate_with_no_command_line_arguments_with_network_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **gpupdate_with_no_command_line_arguments_with_network_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +134,6 @@ Limited false positives may be present in small environments. Tuning may be requ
* [Cobalt Strike](/stories/cobalt_strike)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -96,8 +143,6 @@ Limited false positives may be present in small environments. Tuning may be requ
| 81.0 | 90 | 90 | Process gpupdate.exe with parent_process $parent_process_name$ is executed on $dest$ by user $user$, followed by an outbound network connection to $connection_to_CNC$ on port $dest_port$. This behaviour is seen with cobaltstrike. |
-
-
#### Reference
* [https://raw.githubusercontent.com/xx0hcd/Malleable-C2-Profiles/0ef8cf4556e26f6d4190c56ba697c2159faa5822/crimeware/trick_ryuk.profile](https://raw.githubusercontent.com/xx0hcd/Malleable-C2-Profiles/0ef8cf4556e26f6d4190c56ba697c2159faa5822/crimeware/trick_ryuk.profile)
@@ -106,7 +151,7 @@ Limited false positives may be present in small environments. Tuning may be requ
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-03-15-rundll32_with_no_command_line_arguments_with_network.md b/docs/_posts/2022-03-15-rundll32_with_no_command_line_arguments_with_network.md
index 6a4305a6d5..c2ad89a4c9 100644
--- a/docs/_posts/2022-03-15-rundll32_with_no_command_line_arguments_with_network.md
+++ b/docs/_posts/2022-03-15-rundll32_with_no_command_line_arguments_with_network.md
@@ -28,16 +28,21 @@ tags:
The following analytic identifies rundll32.exe with no command line arguments and performing a network connection. It is unusual for rundll32.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, triage any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2022-03-15
- **Author**: Michael Haag, Splunk
- **ID**: 35307032-a12d-11eb-835f-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -45,6 +50,55 @@ The following analytic identifies rundll32.exe with no command line arguments an
| [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -64,11 +118,11 @@ The following analytic identifies rundll32.exe with no command line arguments an
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `rundll32_with_no_command_line_arguments_with_network_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **rundll32_with_no_command_line_arguments_with_network_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -97,9 +151,6 @@ Although unlikely, some legitimate applications may use a moved copy of rundll32
* [PrintNightmare CVE-2021-34527](/stories/printnightmare_cve-2021-34527)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -109,14 +160,6 @@ Although unlikely, some legitimate applications may use a moved copy of rundll32
| 70.0 | 70 | 100 | A rundll32 process $process_name$ with no commandline argument like this process commandline $process$ in host $dest$ |
-#### CVE
-
-| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
-| ----------- | ----------- | -------------- |
-| [CVE-2021-34527](https://nvd.nist.gov/vuln/detail/CVE-2021-34527) | Windows Print Spooler Remote Code Execution Vulnerability | 9.0 |
-
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1218/011/](https://attack.mitre.org/techniques/T1218/011/)
@@ -127,7 +170,7 @@ Although unlikely, some legitimate applications may use a moved copy of rundll32
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-03-15-searchprotocolhost_with_no_command_line_with_network.md b/docs/_posts/2022-03-15-searchprotocolhost_with_no_command_line_with_network.md
index 3fdcedd431..f31630945d 100644
--- a/docs/_posts/2022-03-15-searchprotocolhost_with_no_command_line_with_network.md
+++ b/docs/_posts/2022-03-15-searchprotocolhost_with_no_command_line_with_network.md
@@ -25,21 +25,71 @@ tags:
The following analytic identifies searchprotocolhost.exe with no command line arguments and with a network connection. It is unusual for searchprotocolhost.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. searchprotocolhost.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2022-03-15
- **Author**: Michael Haag, Splunk
- **ID**: b690df8c-a145-11eb-a38b-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
+| ----------- | ----------- | -------------- |
+| [CVE-2021-34527](https://nvd.nist.gov/vuln/detail/CVE-2021-34527) | Windows Print Spooler Remote Code Execution Vulnerability | 9.0 |
+
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -59,10 +109,10 @@ The following analytic identifies searchprotocolhost.exe with no command line ar
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `searchprotocolhost_with_no_command_line_with_network_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **searchprotocolhost_with_no_command_line_with_network_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -83,9 +133,6 @@ Limited false positives may be present in small environments. Tuning may be requ
* [Cobalt Strike](/stories/cobalt_strike)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -95,8 +142,6 @@ Limited false positives may be present in small environments. Tuning may be requ
| 70.0 | 70 | 100 | A searchprotocolhost.exe process $process_name$ with no commandline in host $dest$ |
-
-
#### Reference
* [https://github.com/fireeye/red_team_tool_countermeasures/blob/master/rules/PGF/supplemental/hxioc/SUSPICIOUS%20EXECUTION%20OF%20SEARCHPROTOCOLHOST%20(METHODOLOGY).ioc](https://github.com/fireeye/red_team_tool_countermeasures/blob/master/rules/PGF/supplemental/hxioc/SUSPICIOUS%20EXECUTION%20OF%20SEARCHPROTOCOLHOST%20(METHODOLOGY).ioc)
@@ -104,7 +149,7 @@ Limited false positives may be present in small environments. Tuning may be requ
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-03-15-suspicious_dllhost_no_command_line_arguments.md b/docs/_posts/2022-03-15-suspicious_dllhost_no_command_line_arguments.md
index 415c8ceb06..b9db2e133e 100644
--- a/docs/_posts/2022-03-15-suspicious_dllhost_no_command_line_arguments.md
+++ b/docs/_posts/2022-03-15-suspicious_dllhost_no_command_line_arguments.md
@@ -25,21 +25,71 @@ tags:
The following analytic identifies DLLHost.exe with no command line arguments. It is unusual for DLLHost.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. DLLHost.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2022-03-15
- **Author**: Michael Haag, Splunk
- **ID**: ff61e98c-0337-4593-a78f-72a676c56f26
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -55,10 +105,10 @@ The following analytic identifies DLLHost.exe with no command line arguments. It
#### Macros
The SPL above uses the following Macros:
* [process_dllhost](https://github.com/splunk/security_content/blob/develop/macros/process_dllhost.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `suspicious_dllhost_no_command_line_arguments_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **suspicious_dllhost_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -85,9 +135,6 @@ Limited false positives may be present in small environments. Tuning may be requ
* [Cobalt Strike](/stories/cobalt_strike)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -97,8 +144,6 @@ Limited false positives may be present in small environments. Tuning may be requ
| 49.0 | 70 | 70 | Suspicious dllhost.exe process with no command line arguments executed on $dest$ by $user$ |
-
-
#### Reference
* [https://raw.githubusercontent.com/threatexpress/malleable-c2/c3385e481159a759f79b8acfe11acf240893b830/jquery-c2.4.2.profile](https://raw.githubusercontent.com/threatexpress/malleable-c2/c3385e481159a759f79b8acfe11acf240893b830/jquery-c2.4.2.profile)
@@ -107,7 +152,7 @@ Limited false positives may be present in small environments. Tuning may be requ
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md b/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md
index 51cdbcdc24..0b1c616369 100644
--- a/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md
+++ b/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md
@@ -25,21 +25,71 @@ tags:
The following analytic identifies gpupdate.exe with no command line arguments. It is unusual for gpupdate.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. gpupdate.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2022-03-15
- **Author**: Michael Haag, Splunk
- **ID**: f308490a-473a-40ef-ae64-dd7a6eba284a
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -54,11 +104,11 @@ The following analytic identifies gpupdate.exe with no command line arguments. I
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_gpupdate](https://github.com/splunk/security_content/blob/develop/macros/process_gpupdate.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `suspicious_gpupdate_no_command_line_arguments_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **suspicious_gpupdate_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -85,9 +135,6 @@ Limited false positives may be present in small environments. Tuning may be requ
* [Cobalt Strike](/stories/cobalt_strike)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -97,8 +144,6 @@ Limited false positives may be present in small environments. Tuning may be requ
| 49.0 | 70 | 70 | Suspicious gpupdate.exe process with no command line arguments executed on $dest$ by $user$ |
-
-
#### Reference
* [https://raw.githubusercontent.com/xx0hcd/Malleable-C2-Profiles/0ef8cf4556e26f6d4190c56ba697c2159faa5822/crimeware/trick_ryuk.profile](https://raw.githubusercontent.com/xx0hcd/Malleable-C2-Profiles/0ef8cf4556e26f6d4190c56ba697c2159faa5822/crimeware/trick_ryuk.profile)
@@ -107,7 +152,7 @@ Limited false positives may be present in small environments. Tuning may be requ
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-03-15-suspicious_rundll32_no_command_line_arguments.md b/docs/_posts/2022-03-15-suspicious_rundll32_no_command_line_arguments.md
index c23b335219..94299762a1 100644
--- a/docs/_posts/2022-03-15-suspicious_rundll32_no_command_line_arguments.md
+++ b/docs/_posts/2022-03-15-suspicious_rundll32_no_command_line_arguments.md
@@ -28,16 +28,21 @@ tags:
The following analytic identifies rundll32.exe with no command line arguments. It is unusual for rundll32.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2022-03-15
- **Author**: Michael Haag, Splunk
- **ID**: e451bd16-e4c5-4109-8eb1-c4c6ecf048b4
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -45,6 +50,60 @@ The following analytic identifies rundll32.exe with no command line arguments. I
| [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
#### Search
```
@@ -59,11 +118,11 @@ The following analytic identifies rundll32.exe with no command line arguments. I
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `suspicious_rundll32_no_command_line_arguments_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **suspicious_rundll32_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -92,9 +151,6 @@ Although unlikely, some legitimate applications may use a moved copy of rundll32
* [PrintNightmare CVE-2021-34527](/stories/printnightmare_cve-2021-34527)
-#### Kill Chain Phase
-* Actions on Objectives
-
#### RBA
@@ -104,14 +160,6 @@ Although unlikely, some legitimate applications may use a moved copy of rundll32
| 49.0 | 70 | 70 | Suspicious rundll32.exe process with no command line arguments executed on $dest$ by $user$ |
-#### CVE
-
-| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
-| ----------- | ----------- | -------------- |
-| [CVE-2021-34527](https://nvd.nist.gov/vuln/detail/CVE-2021-34527) | Windows Print Spooler Remote Code Execution Vulnerability | 9.0 |
-
-
-
#### Reference
* [https://attack.mitre.org/techniques/T1218/011/](https://attack.mitre.org/techniques/T1218/011/)
@@ -122,7 +170,7 @@ Although unlikely, some legitimate applications may use a moved copy of rundll32
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-03-15-suspicious_searchprotocolhost_no_command_line_arguments.md b/docs/_posts/2022-03-15-suspicious_searchprotocolhost_no_command_line_arguments.md
index 5586c92696..986cc33ef5 100644
--- a/docs/_posts/2022-03-15-suspicious_searchprotocolhost_no_command_line_arguments.md
+++ b/docs/_posts/2022-03-15-suspicious_searchprotocolhost_no_command_line_arguments.md
@@ -25,21 +25,71 @@ tags:
The following analytic identifies searchprotocolhost.exe with no command line arguments. It is unusual for searchprotocolhost.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. searchprotocolhost.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2022-03-15
- **Author**: Michael Haag, Splunk
- **ID**: f52d2db8-31f9-4aa7-a176-25779effe55c
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
+| ----------- | ----------- | -------------- |
+| [CVE-2021-34527](https://nvd.nist.gov/vuln/detail/CVE-2021-34527) | Windows Print Spooler Remote Code Execution Vulnerability | 9.0 |
+
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -54,10 +104,10 @@ The following analytic identifies searchprotocolhost.exe with no command line ar
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `suspicious_searchprotocolhost_no_command_line_arguments_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **suspicious_searchprotocolhost_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +134,6 @@ Limited false positives may be present in small environments. Tuning may be requ
* [Cobalt Strike](/stories/cobalt_strike)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -96,8 +143,6 @@ Limited false positives may be present in small environments. Tuning may be requ
| 49.0 | 70 | 70 | Suspicious searchprotocolhost.exe process with no command line arguments executed on $dest$ by $user$ |
-
-
#### Reference
* [https://github.com/fireeye/red_team_tool_countermeasures/blob/master/rules/PGF/supplemental/hxioc/SUSPICIOUS%20EXECUTION%20OF%20SEARCHPROTOCOLHOST%20(METHODOLOGY).ioc](https://github.com/fireeye/red_team_tool_countermeasures/blob/master/rules/PGF/supplemental/hxioc/SUSPICIOUS%20EXECUTION%20OF%20SEARCHPROTOCOLHOST%20(METHODOLOGY).ioc)
@@ -105,7 +150,7 @@ Limited false positives may be present in small environments. Tuning may be requ
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md b/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md
index 8474231d70..6ba3466b6c 100644
--- a/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md
+++ b/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md
@@ -30,16 +30,21 @@ When `InstallUtil.exe` is used in a malicous manner, the path to an executable o
If used by a developer, typically this will be found with multiple command-line switches/arguments and spawn from Visual Studio. \
During triage review resulting network connections, file modifications, and parallel processes. Capture any artifacts and review further.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2022-03-16
- **Author**: Michael Haag, Splunk
- **ID**: 4fbf9270-43da-11ec-9486-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -47,6 +52,51 @@ During triage review resulting network connections, file modifications, and para
| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -65,11 +115,11 @@ During triage review resulting network connections, file modifications, and para
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `windows_installutil_remote_network_connection_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **windows_installutil_remote_network_connection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -100,9 +150,6 @@ Limited false positives should be present as InstallUtil is not typically used t
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -112,8 +159,6 @@ Limited false positives should be present as InstallUtil is not typically used t
| 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ generating a remote download. |
-
-
#### Reference
* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md)
@@ -121,7 +166,7 @@ Limited false positives should be present as InstallUtil is not typically used t
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md b/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md
index 95d79b653f..167481cd52 100644
--- a/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md
+++ b/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md
@@ -31,16 +31,21 @@ When `InstallUtil.exe` is used in a malicous manner, the path to an executable o
If used by a developer, typically this will be found with multiple command-line switches/arguments and spawn from Visual Studio. \
During triage review resulting network connections, file modifications, and parallel processes. Capture any artifacts and review further.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-
- **Last Updated**: 2022-03-16
- **Author**: Michael Haag, Splunk
- **ID**: 1a52c836-43ef-11ec-a36c-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -48,6 +53,51 @@ During triage review resulting network connections, file modifications, and para
| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -66,11 +116,11 @@ During triage review resulting network connections, file modifications, and para
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `windows_installutil_uninstall_option_with_network_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **windows_installutil_uninstall_option_with_network_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -101,9 +151,6 @@ Limited false positives should be present as InstallUtil is not typically used t
* [Living Off The Land](/stories/living_off_the_land)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -113,8 +160,6 @@ Limited false positives should be present as InstallUtil is not typically used t
| 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ performing an uninstall. |
-
-
#### Reference
* [https://evi1cg.me/archives/AppLocker_Bypass_Techniques.html#menu_index_12](https://evi1cg.me/archives/AppLocker_Bypass_Techniques.html#menu_index_12)
@@ -124,7 +169,7 @@ Limited false positives should be present as InstallUtil is not typically used t
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-03-17-modify_acl_permission_to_files_or_folder.md b/docs/_posts/2022-03-17-modify_acl_permission_to_files_or_folder.md
index a1b5349872..3b06db008c 100644
--- a/docs/_posts/2022-03-17-modify_acl_permission_to_files_or_folder.md
+++ b/docs/_posts/2022-03-17-modify_acl_permission_to_files_or_folder.md
@@ -24,21 +24,71 @@ tags:
This analytic identifies suspicious modification of ACL permission to a files or folder to make it available to everyone. This technique may be used by the adversary to evade ACLs or protected files access. This changes is commonly configured by the file or directory owner with appropriate permission. This behavior is a good indicator if this command seen on a machine utilized by an account with no permission to do so.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2022-03-17
- **Author**: Teoderick Contreras, Splunk
- **ID**: 7e8458cc-acca-11eb-9e3f-acde48001122
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1222](https://attack.mitre.org/techniques/T1222/) | File and Directory Permissions Modification | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+
+
+
+
+
+
+CIS20
+ +
+
+
+
+
+
+
+
#### Search
```
@@ -52,10 +102,10 @@ This analytic identifies suspicious modification of ACL permission to a files or
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `modify_acl_permission_to_files_or_folder_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **modify_acl_permission_to_files_or_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -77,9 +127,6 @@ administrators may use this command. Filter as needed.
* [XMRig](/stories/xmrig)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -89,8 +136,6 @@ administrators may use this command. Filter as needed.
| 32.0 | 40 | 80 | Suspicious ACL permission modification on $dest$ |
-
-
#### Reference
* [https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/](https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/)
@@ -98,7 +143,7 @@ administrators may use this command. Filter as needed.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-03-24-splunk_dos_via_malformed_s2s_request.md b/docs/_posts/2022-03-24-splunk_dos_via_malformed_s2s_request.md
index 9d894a6f56..0c17715d52 100644
--- a/docs/_posts/2022-03-24-splunk_dos_via_malformed_s2s_request.md
+++ b/docs/_posts/2022-03-24-splunk_dos_via_malformed_s2s_request.md
@@ -13,7 +13,7 @@ tags:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- -
+ - CVE-2021-3422
---
@@ -24,21 +24,81 @@ tags:
On March 24th, 2022, Splunk published a security advisory for a possible Denial of Service stemming from the lack of validation in a specific key-value field in the Splunk-to-Splunk (S2S) protocol. This detection will alert on attempted exploitation in patched versions of Splunk.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2022-03-24
- **Author**: Lou Stella, Splunk
- **ID**: fc246e56-953b-40c1-8634-868f9e474cbd
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1498](https://attack.mitre.org/techniques/T1498/) | Network Denial of Service | Impact |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -51,7 +111,7 @@ On March 24th, 2022, Splunk published a security advisory for a possible Denial
The SPL above uses the following Macros:
* [splunkd](https://github.com/splunk/security_content/blob/develop/macros/splunkd.yml)
-Note that `splunk_dos_via_malformed_s2s_request_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **splunk_dos_via_malformed_s2s_request_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* host
@@ -71,9 +131,6 @@ None.
* [Splunk Vulnerabilities](/stories/splunk_vulnerabilities)
-#### Kill Chain Phase
-* Exploitation
-
#### RBA
@@ -83,14 +140,6 @@ None.
| 50.0 | 50 | 100 | An attempt to exploit CVE-2021-3422 was detected from $src$ against $host$ |
-#### CVE
-
-| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
-| ----------- | ----------- | -------------- |
-| [](https://nvd.nist.gov/vuln/detail/) | | |
-
-
-
#### Reference
* [https://www.splunk.com/en_us/product-security/announcements/svd-2022-0301.html](https://www.splunk.com/en_us/product-security/announcements/svd-2022-0301.html)
@@ -98,7 +147,7 @@ None.
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-03-28-sql_injection_with_long_urls.md b/docs/_posts/2022-03-28-sql_injection_with_long_urls.md
index d7be6f2dbc..b660e3cbae 100644
--- a/docs/_posts/2022-03-28-sql_injection_with_long_urls.md
+++ b/docs/_posts/2022-03-28-sql_injection_with_long_urls.md
@@ -26,21 +26,81 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search looks for long URLs that have several SQL commands visible within them.
-- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Web](https://docs.splunk.com/Documentation/CIM/latest/User/Web)
-
- **Last Updated**: 2022-03-28
- **Author**: Bhavin Patel, Splunk
- **ID**: e0aad4cf-0790-423b-8328-7564d0d938f9
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
+| ----------- | ----------- | -------------- |
+| [CVE-2021-3422](https://nvd.nist.gov/vuln/detail/CVE-2021-3422) | The lack of validation of a key-value field in the Splunk-to-Splunk protocol results in a denial-of-service in Splunk Enterprise instances configured to index Universal Forwarder traffic. The vulnerability impacts Splunk Enterprise versions before 7.3.9, 8.0 versions before 8.0.9, and 8.1 versions before 8.1.3. It does not impact Universal Forwarders. When Splunk forwarding is secured using TLS or a Token, the attack requires compromising the certificate or token, or both. Implementation of either or both reduces the severity to Medium. | None |
+
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1190](https://attack.mitre.org/techniques/T1190/) | Exploit Public-Facing Application | Initial Access |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Delivery
+
+
+
+
+
+
+NIST
+ +
+
+* PR.DS
+* ID.RA
+* PR.PT
+* PR.IP
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 4
+* CIS 13
+* CIS 18
+
+
+
+
+
+
+
#### Search
```
@@ -57,7 +117,7 @@ This search looks for long URLs that have several SQL commands visible within th
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `sql_injection_with_long_urls_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **sql_injection_with_long_urls_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -80,9 +140,6 @@ It's possible that legitimate traffic will have long URLs or long user agent str
* [SQL Injection](/stories/sql_injection)
-#### Kill Chain Phase
-* Delivery
-
#### RBA
@@ -92,13 +149,11 @@ It's possible that legitimate traffic will have long URLs or long user agent str
| 25.0 | 50 | 50 | SQL injection attempt with url $url$ detected on $dest$ |
-
-
#### Reference
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-03-28-windows_deleted_registry_by_a_non_critical_process_file_path.md b/docs/_posts/2022-03-28-windows_deleted_registry_by_a_non_critical_process_file_path.md
index d3203f8416..3d715d019f 100644
--- a/docs/_posts/2022-03-28-windows_deleted_registry_by_a_non_critical_process_file_path.md
+++ b/docs/_posts/2022-03-28-windows_deleted_registry_by_a_non_critical_process_file_path.md
@@ -23,21 +23,76 @@ tags:
This analytic is to detect deletion of registry with suspicious process file path. This technique was seen in Double Zero wiper malware where it will delete all the subkey in HKLM, HKCU and HKU registry hive as part of its destructive payload to the targeted hosts. This anomaly detections can catch possible malware or advesaries deleting registry as part of defense evasion or even payload impact but can also catch for third party application updates or installation. In this scenario false positive filter is needed.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2022-03-28
- **Author**: Teoderick Contreras, Splunk
- **ID**: 15e70689-f55b-489e-8a80-6d0cd6d8aad2
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -58,7 +113,7 @@ This analytic is to detect deletion of registry with suspicious process file pat
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-Note that `windows_deleted_registry_by_a_non_critical_process_file_path_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **windows_deleted_registry_by_a_non_critical_process_file_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -88,8 +143,6 @@ This detection can catch for third party application updates or installation. In
* [Double Zero Destructor](/stories/double_zero_destructor)
-#### Kill Chain Phase
-
#### RBA
@@ -99,8 +152,6 @@ This detection can catch for third party application updates or installation. In
| 36.0 | 60 | 60 | registry was deleted by a suspicious $process_name$ with proces path $process_path in $dest$ |
-
-
#### Reference
* [https://blog.talosintelligence.com/2022/03/threat-advisory-doublezero.html](https://blog.talosintelligence.com/2022/03/threat-advisory-doublezero.html)
@@ -108,7 +159,7 @@ This detection can catch for third party application updates or installation. In
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-03-28-windows_terminating_lsass_process.md b/docs/_posts/2022-03-28-windows_terminating_lsass_process.md
index ed43b81fc3..9dfd2c5d9e 100644
--- a/docs/_posts/2022-03-28-windows_terminating_lsass_process.md
+++ b/docs/_posts/2022-03-28-windows_terminating_lsass_process.md
@@ -26,16 +26,21 @@ tags:
This analytic is to detect a suspicious process terminating Lsass process. Lsass process is known to be a critical process that is responsible for enforcing security policy system. This process was commonly targetted by threat actor or red teamer to gain privilege escalation or persistence in the targeted machine because it handles credentials of the logon users. In this analytic we tried to detect a suspicious process having a granted access PROCESS_TERMINATE to lsass process to modify or delete protected registrys. This technique was seen in doublezero malware that tries to wipe files and registry in compromised hosts. This anomaly detection can be a good pivot of incident response for possible credential dumping or evading security policy in a host or network environment.
-- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-
- **Last Updated**: 2022-03-28
- **Author**: Teoderick Contreras, Splunk
- **ID**: 7ab3c319-a4e7-4211-9e8c-40a049d0dba6
-#### [ATT&CK](https://attack.mitre.org/)
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,56 @@ This analytic is to detect a suspicious process terminating Lsass process. Lsass
| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+
+
+
+
+Kill Chain Phase
+ +
+
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
#### Search
```
@@ -56,10 +111,10 @@ This analytic is to detect a suspicious process terminating Lsass process. Lsass
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-Note that `windows_terminating_lsass_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+Note that **windows_terminating_lsass_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -83,8 +138,6 @@ unknown
* [Double Zero Destructor](/stories/double_zero_destructor)
-#### Kill Chain Phase
-
#### RBA
@@ -94,8 +147,6 @@ unknown
| 64.0 | 80 | 80 | a process $SourceImage$ terminates Lsass process in $dest$ |
-
-
#### Reference
* [https://blog.talosintelligence.com/2022/03/threat-advisory-doublezero.html](https://blog.talosintelligence.com/2022/03/threat-advisory-doublezero.html)
@@ -103,7 +154,7 @@ unknown
#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
diff --git a/docs/_posts/2022-04-04-github_actions_disable_security_workflow.md b/docs/_posts/2022-04-04-github_actions_disable_security_workflow.md
new file mode 100644
index 0000000000..1fcf9c74ae
--- /dev/null
+++ b/docs/_posts/2022-04-04-github_actions_disable_security_workflow.md
@@ -0,0 +1,170 @@
+---
+title: "GitHub Actions Disable Security Workflow"
+excerpt: "Compromise Software Supply Chain
+, Supply Chain Compromise
+"
+categories:
+ - Cloud
+last_modified_at: 2022-04-04
+toc: true
+toc_label: ""
+tags:
+ - Compromise Software Supply Chain
+ - Supply Chain Compromise
+ - Initial Access
+ - Initial Access
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+This search detects a disabled security workflow in GitHub Actions. An attacker can disable a security workflow in GitHub actions to hide malicious code in it.
+
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-04-04
+- **Author**: Patrick Bareiss, Splunk
+- **ID**: 0459f1a5-c0ac-4987-82d6-65081209f854
+
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1195.002](https://attack.mitre.org/techniques/T1195/002/) | Compromise Software Supply Chain | Initial Access |
+
+| [T1195](https://attack.mitre.org/techniques/T1195/) | Supply Chain Compromise | Initial Access |
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.DS
+* PR.AC
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 13
+
+
+
+
+
+
+
+#### Search
+
+```
+`github` workflow_run.event=push OR workflow_run.event=pull_request
+| stats values(workflow_run.name) as workflow_run.name by workflow_run.head_commit.id workflow_run.event workflow_run.head_branch workflow_run.head_commit.author.email workflow_run.head_commit.author.name workflow_run.head_commit.message workflow_run.head_commit.timestamp workflow_run.head_repository.full_name workflow_run.head_repository.owner.id workflow_run.head_repository.owner.login workflow_run.head_repository.owner.type
+| rename workflow_run.head_commit.author.name as user, workflow_run.head_commit.author.email as user_email, workflow_run.head_repository.full_name as repository, workflow_run.head_branch as branch
+| search NOT workflow_run.name=*security-testing*
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `github_actions_disable_security_workflow_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+Note that **github_actions_disable_security_workflow_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* workflow_run.event
+* workflow_run.name
+* workflow_run.head_commit.id
+* workflow_run.event workflow_run.head_branch
+* workflow_run.head_commit.author.email
+* workflow_run.head_commit.author.name
+* workflow_run.head_commit.message
+* workflow_run.head_commit.timestamp
+* workflow_run.head_repository.full_name
+* workflow_run.head_repository.owner.id
+* workflow_run.head_repository.owner.login
+* workflow_run.head_repository.owner.type
+
+
+#### How To Implement
+You must index GitHub logs. You can follow the url in reference to onboard GitHub logs. Sometimes GitHub logs are truncated, make sure to disable it in props.conf. Replace *security-testing* with the name of your security testing workflow in GitHub Actions.
+
+#### Known False Positives
+unknown
+
+#### Associated Analytic story
+* [Dev Sec Ops](/stories/dev_sec_ops)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 27.0 | 30 | 90 | Security Workflow is disabled in branch $branch$ for repository $repository$ |
+
+
+#### Reference
+
+* [https://www.splunk.com/en_us/blog/tips-and-tricks/getting-github-data-with-webhooks.html](https://www.splunk.com/en_us/blog/tips-and-tricks/getting-github-data-with-webhooks.html)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1195.002/github_actions_disable_security_workflow/github_actions_disable_security_workflow.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1195.002/github_actions_disable_security_workflow/github_actions_disable_security_workflow.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/cloud/github_actions_disable_security_workflow.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-04-04-windows_event_for_service_disabled.md b/docs/_posts/2022-04-04-windows_event_for_service_disabled.md
new file mode 100644
index 0000000000..5c68e5cdea
--- /dev/null
+++ b/docs/_posts/2022-04-04-windows_event_for_service_disabled.md
@@ -0,0 +1,163 @@
+---
+title: "Windows Event For Service Disabled"
+excerpt: "Disable or Modify Tools
+, Impair Defenses
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-04-04
+toc: true
+toc_label: ""
+tags:
+ - Disable or Modify Tools
+ - Impair Defenses
+ - Defense Evasion
+ - Defense Evasion
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+ - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+This analytic will identify suspicious system event of services that was modified from start to disabled. This technique is seen where the adversary attempts to disable security app services, other malware services to evade the defense systems on the compromised host
+
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-04-04
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: 9c2620a8-94a1-11ec-b40c-acde48001122
+
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion |
+
+| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Exploitation
+
+
+
+
+
+
+NIST
+ +
+
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
+#### Search
+
+```
+`wineventlog_system` EventCode=7040 Message = "*service was changed from demand start to disabled."
+| stats count min(_time) as firstTime max(_time) as lastTime by ComputerName EventCode Message User Sid service service_name
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `windows_event_for_service_disabled_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+Note that **windows_event_for_service_disabled_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* ComputerName
+* EventCode
+* Message
+* User
+* Sid
+
+
+#### How To Implement
+To successfully implement this search, you need to be ingesting logs with the Service name, Service File Name Service Start type, and Service Type from your endpoints.
+
+#### Known False Positives
+Windows service update may cause this event. In that scenario, filtering is needed.
+
+#### Associated Analytic story
+* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 36.0 | 60 | 60 | Service was disabled on $Computer$ |
+
+
+#### Reference
+
+* [https://blog.talosintelligence.com/2018/02/olympic-destroyer.html](https://blog.talosintelligence.com/2018/02/olympic-destroyer.html)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/olympic_destroyer/system.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/olympic_destroyer/system.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_event_for_service_disabled.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_stories/dev_sec_ops.md b/docs/_stories/dev_sec_ops.md
index 83abc82d01..4d6b59a19b 100644
--- a/docs/_stories/dev_sec_ops.md
+++ b/docs/_stories/dev_sec_ops.md
@@ -40,6 +40,7 @@ DevSecOps is a collaborative framework, which thinks about application and infra
| [Circle CI Disable Security Step](/cloud/circle_ci_disable_security_step/) | [Compromise Client Software Binary](/tags/#compromise-client-software-binary)| Anomaly |
| [Correlation by Repository and Risk](/cloud/correlation_by_repository_and_risk/) | [Malicious Image](/tags/#malicious-image), [User Execution](/tags/#user-execution)| Correlation |
| [Correlation by User and Risk](/cloud/correlation_by_user_and_risk/) | [Malicious Image](/tags/#malicious-image), [User Execution](/tags/#user-execution)| Correlation |
+| [GitHub Actions Disable Security Workflow](/cloud/github_actions_disable_security_workflow/) | [Compromise Software Supply Chain](/tags/#compromise-software-supply-chain), [Supply Chain Compromise](/tags/#supply-chain-compromise)| Anomaly |
| [Github Commit Changes In Master](/cloud/github_commit_changes_in_master/) | [Trusted Relationship](/tags/#trusted-relationship)| Anomaly |
| [Github Commit In Develop](/cloud/github_commit_in_develop/) | [Trusted Relationship](/tags/#trusted-relationship)| Anomaly |
| [GitHub Dependabot Alert](/cloud/github_dependabot_alert/) | [Compromise Software Dependencies and Development Tools](/tags/#compromise-software-dependencies-and-development-tools), [Supply Chain Compromise](/tags/#supply-chain-compromise)| Anomaly |
diff --git a/docs/index.markdown b/docs/index.markdown
index bcabeb2798..0f7a3ec561 100644
--- a/docs/index.markdown
+++ b/docs/index.markdown
@@ -28,7 +28,7 @@ feature_row:
- image_path: /static/feature_playbooks.png
alt: "100% free"
title: "Playbooks"
- excerpt: "See all **31** automated investigation 🔭 and response 🛠 playbooks "
+ excerpt: "See all **31** automated investigation 🔭 and response 🛠 playbooks."
url: "/playbooks"
btn_class: "btn--primary"
btn_label: "Explore"
@@ -48,29 +48,6 @@ Below is a snapshot in time of what technique we currently have some detection c
[](https://mitremap.splunkresearch.com/)
-## View Our Content 🔎
-
-* [Analytic Stories](/stories)
-* [Detections](/detections)
-* [Playbooks](/playbooks)
-
-If you prefer working with the command line, check out our [API](https://docs.splunkresearch.com/?version=latest):
-
-```
-curl -s https://content.splunkresearch.com | jq
-{
- "hello": "welcome to Splunks Research security content api"
-}
-```
-
-## Test Out The Detections 🏗
-
-Replay any detection dataset to a Splunk Enterprise Server by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively use:
-
-
-
-The [Splunk Attack Range](https://github.com/splunk/attack_range) which allows you to create a isolated environment to launch attacks and test/build detections.
-
## Questions? 📞
Please use the [GitHub issue tracker](https://github.com/splunk/attack_range/issues) to submit bugs or request features.
@@ -83,4 +60,3 @@ If you have questions or need support, you can:
## Contribute Content 🥰
If you want to help the rest of the security community by sharing your own detections, see our [contributor guide](https://github.com/splunk/security_content/wiki/Contributing-to-the-Project) for more information on how to get involved!
-
diff --git a/tests/cloud/github_actions_disable_security_workflow.test.yml b/tests/cloud/github_actions_disable_security_workflow.test.yml
new file mode 100644
index 0000000000..0ea9814a02
--- /dev/null
+++ b/tests/cloud/github_actions_disable_security_workflow.test.yml
@@ -0,0 +1,12 @@
+name: GitHub Actions Disable Security Workflow Unit Test
+tests:
+- name: GitHub Actions Disable Security Workflow
+ file: cloud/github_actions_disable_security_workflow.yml
+ pass_condition: '| stats count | where count > 0'
+ earliest_time: -30d
+ latest_time: now
+ attack_data:
+ - file_name: github_actions_disable_security_workflow.log
+ data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1195.002/github_actions_disable_security_workflow/github_actions_disable_security_workflow.log
+ source: github
+ sourcetype: aws:firehose:json
\ No newline at end of file
diff --git a/tests/endpoint/kerberos_service_ticket_request_using_rc4_encryption.test.yml b/tests/endpoint/kerberos_service_ticket_request_using_rc4_encryption.test.yml
new file mode 100644
index 0000000000..6e60958583
--- /dev/null
+++ b/tests/endpoint/kerberos_service_ticket_request_using_rc4_encryption.test.yml
@@ -0,0 +1,12 @@
+name: Kerberos Service Ticket Request Using RC4 Encryption Unit Test
+tests:
+- name: Kerberos Service Ticket Request Using RC4 Encryption
+ file: endpoint/kerberos_service_ticket_request_using_rc4_encryption.yml
+ pass_condition: '| stats count | where count > 0'
+ earliest_time: '-24h'
+ latest_time: 'now'
+ attack_data:
+ - file_name: windows-security.log
+ data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.001/impacket/windows-security.log
+ source: WinEventLog:Security
+ sourcetype: WinEventLog
\ No newline at end of file
diff --git a/tests/endpoint/kerberos_tgt_request_using_rc4_encryption.test.yml b/tests/endpoint/kerberos_tgt_request_using_rc4_encryption.test.yml
new file mode 100644
index 0000000000..ea49994fde
--- /dev/null
+++ b/tests/endpoint/kerberos_tgt_request_using_rc4_encryption.test.yml
@@ -0,0 +1,12 @@
+name: Kerberos TGT Request Using RC4 Encryption Unit Test
+tests:
+- name: Kerberos TGT Request Using RC4 Encryption
+ file: endpoint/kerberos_tgt_request_using_rc4_encryption.yml
+ pass_condition: '| stats count | where count > 0'
+ earliest_time: '-24h'
+ latest_time: 'now'
+ attack_data:
+ - file_name: windows-security.log
+ data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550/impacket/windows-security.log
+ source: WinEventLog:Security
+ sourcetype: WinEventLog
\ No newline at end of file
diff --git a/tests/endpoint/kerberos_user_enumeration.test.yml b/tests/endpoint/kerberos_user_enumeration.test.yml
new file mode 100644
index 0000000000..4c2b415fd5
--- /dev/null
+++ b/tests/endpoint/kerberos_user_enumeration.test.yml
@@ -0,0 +1,12 @@
+name: Kerberos User Enumeration Unit Test
+tests:
+- name: Kerberos User Enumeration
+ file: endpoint/kerberos_user_enumeration.yml
+ pass_condition: '| stats count | where count > 0'
+ earliest_time: '-24h'
+ latest_time: 'now'
+ attack_data:
+ - file_name: windows-security.log
+ data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1589.002/kerbrute/windows-security.log
+ source: WinEventLog:Security
+ sourcetype: WinEventLog
\ No newline at end of file
diff --git a/tests/endpoint/macos_plutil.test.yml b/tests/endpoint/macos_plutil.test.yml
new file mode 100644
index 0000000000..38ca7fab1f
--- /dev/null
+++ b/tests/endpoint/macos_plutil.test.yml
@@ -0,0 +1,12 @@
+name: MacOS plutil Unit Test
+tests:
+- name: MacOS plutil
+ file: endpoint/macos_plutil.yml
+ pass_condition: '| stats count | where count > 0'
+ earliest_time: '-24h'
+ latest_time: 'now'
+ attack_data:
+ - file_name: osquery.log
+ data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.011/atomic_red_team/osquery.log
+ source: osquery
+ sourcetype: osquery:results
\ No newline at end of file
diff --git a/tests/endpoint/ssa___fsutil_zeroing_file.test.yml b/tests/endpoint/ssa___fsutil_zeroing_file.test.yml
index 3f6202f8a0..f1ec271d45 100644
--- a/tests/endpoint/ssa___fsutil_zeroing_file.test.yml
+++ b/tests/endpoint/ssa___fsutil_zeroing_file.test.yml
@@ -5,6 +5,6 @@ tests:
pass_condition: '@count_gt(0)'
description: Test detection of FSUtil Zeroing File
attack_data:
- - file_name: windows-sysmon.log
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/fsutil_file_zero/windows-sysmon.log
- source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+ - file_name: windows-security.log
+ data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/fsutil_file_zero/windows-security.log
+ source: WinEventLog:Security
diff --git a/tests/endpoint/unknown_process_using_the_kerberos_protocol.test.yml b/tests/endpoint/unknown_process_using_the_kerberos_protocol.test.yml
new file mode 100644
index 0000000000..de6efbae0c
--- /dev/null
+++ b/tests/endpoint/unknown_process_using_the_kerberos_protocol.test.yml
@@ -0,0 +1,16 @@
+name: Unknown Process Using The Kerberos Protocol Unit Test
+tests:
+- name: Unknown Process Using The Kerberos Protocol
+ file: endpoint/unknown_process_using_the_kerberos_protocol.yml
+ pass_condition: '| stats count | where count > 0'
+ earliest_time: '-7d'
+ latest_time: 'now'
+ attack_data:
+ - file_name: windows-security.log
+ data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550/rubeus/windows-security.log
+ source: WinEventLog:Security
+ sourcetype: WinEventLog
+ - file_name: windows-sysmon.log
+ data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550/rubeus/windows-sysmon.log
+ source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+ sourcetype: xmlwineventlog
diff --git a/tests/endpoint/windows_get_adcomputer_unconstrained_delegation_discovery.test.yml b/tests/endpoint/windows_get_adcomputer_unconstrained_delegation_discovery.test.yml
new file mode 100644
index 0000000000..75c098155a
--- /dev/null
+++ b/tests/endpoint/windows_get_adcomputer_unconstrained_delegation_discovery.test.yml
@@ -0,0 +1,13 @@
+name: Windows Get-AdComputer Unconstrained Delegation Discovery Unit Test
+tests:
+- name: Windows Get-AdComputer Unconstrained Delegation Discovery
+ file: endpoint/windows_get_adcomputer_unconstrained_delegation_discovery.yml
+ pass_condition: '| stats count | where count > 0'
+ earliest_time: -24h
+ latest_time: now
+ attack_data:
+ - file_name: windows-powershell.log
+ data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/unconstrained2/windows-powershell.log
+ source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+ sourcetype: WinEventLog
+
diff --git a/tests/endpoint/windows_powerview_constrained_delegation_discovery.test.yml b/tests/endpoint/windows_powerview_constrained_delegation_discovery.test.yml
new file mode 100644
index 0000000000..075cbaa95f
--- /dev/null
+++ b/tests/endpoint/windows_powerview_constrained_delegation_discovery.test.yml
@@ -0,0 +1,12 @@
+name: Windows PowerView Constrained Delegation Discovery Unit Test
+tests:
+- name: Windows PowerView Constrained Delegation Discovery
+ file: endpoint/windows_powerview_constrained_delegation_discovery.yml
+ pass_condition: '| stats count | where count > 0'
+ earliest_time: -24h
+ latest_time: now
+ attack_data:
+ - file_name: windows-powershell.log
+ data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/constrained/windows-powershell.log
+ source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+ sourcetype: WinEventLog
diff --git a/tests/endpoint/windows_powerview_unconstrained_delegation_discovery.test.yml b/tests/endpoint/windows_powerview_unconstrained_delegation_discovery.test.yml
new file mode 100644
index 0000000000..1100c49d4c
--- /dev/null
+++ b/tests/endpoint/windows_powerview_unconstrained_delegation_discovery.test.yml
@@ -0,0 +1,12 @@
+name: Windows PowerView Unconstrained Delegation Discovery Unit Test
+tests:
+- name: Windows PowerView Unconstrained Delegation Discovery
+ file: endpoint/windows_powerview_unconstrained_delegation_discovery.yml
+ pass_condition: '| stats count | where count > 0'
+ earliest_time: -24h
+ latest_time: now
+ attack_data:
+ - file_name: windows-powershell.log
+ data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/unconstrained/windows-powershell.log
+ source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+ sourcetype: WinEventLog
CVE
+ +
+
+
+
+