admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

more

Browse Source
This commit is contained in:
Michael Haag
2023-05-25 06:07:25 -06:00
parent 20c60fb589
commit ec897a5cbb
4 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/net_localgroup_discovery.yml
+2
View File
@@ -26,6 +26,7 @@ known_false_positives: False positives may be present. Tune as needed.
references:
- https://attack.mitre.org/techniques/T1069/001/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md
- https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF
tags:
analytic_story:
- Active Directory Discovery
@@ -33,6 +34,7 @@ tags:
- Azorult
- Windows Post-Exploitation
- Prestige Ransomware
- Volt Typhoon
asset_type: Endpoint
confidence: 50
impact: 30
detections/endpoint/windows_mimikatz_binary_execution.yml
+2
View File
@@ -31,11 +31,13 @@ known_false_positives: False positives should be limited as this is directly loo
references:
- https://www.cisa.gov/uscert/sites/default/files/publications/aa22-320a_joint_csa_iranian_government-sponsored_apt_actors_compromise_federal%20network_deploy_crypto%20miner_credential_harvester.pdf
- https://www.varonis.com/blog/what-is-mimikatz
- https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF
tags:
analytic_story:
- Credential Dumping
- CISA AA22-320A
- Sandworm Tools
- Volt Typhoon
asset_type: Endpoint
confidence: 100
impact: 100
dev/endpoint/net_localgroup_discovery.yml
+2
View File
@@ -26,6 +26,7 @@ known_false_positives: False positives may be present. Tune as needed.
references:
- https://attack.mitre.org/techniques/T1069/001/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md
- https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF
tags:
analytic_story:
- Active Directory Discovery
@@ -33,6 +34,7 @@ tags:
- Azorult
- Windows Post-Exploitation
- Prestige Ransomware
- Volt Typhoon
asset_type: Endpoint
confidence: 50
impact: 30
dev/endpoint/windows_mimikatz_binary_execution.yml
+2
View File
@@ -31,10 +31,12 @@ known_false_positives: False positives should be limited as this is directly loo
references:
- https://www.cisa.gov/uscert/sites/default/files/publications/aa22-320a_joint_csa_iranian_government-sponsored_apt_actors_compromise_federal%20network_deploy_crypto%20miner_credential_harvester.pdf
- https://www.varonis.com/blog/what-is-mimikatz
- https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF
tags:
analytic_story:
- Credential Dumping
- CISA AA22-320A
- Volt Typhoon
asset_type: Endpoint
confidence: 100
impact: 100