From ec897a5cbb82fe93f54bfbe55cda3ddf4445c309 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Thu, 25 May 2023 06:07:25 -0600 Subject: [PATCH] more --- detections/endpoint/net_localgroup_discovery.yml | 2 ++ detections/endpoint/windows_mimikatz_binary_execution.yml | 2 ++ dev/endpoint/net_localgroup_discovery.yml | 2 ++ dev/endpoint/windows_mimikatz_binary_execution.yml | 2 ++ 4 files changed, 8 insertions(+) diff --git a/detections/endpoint/net_localgroup_discovery.yml b/detections/endpoint/net_localgroup_discovery.yml index 6766944d33..8409e77493 100644 --- a/detections/endpoint/net_localgroup_discovery.yml +++ b/detections/endpoint/net_localgroup_discovery.yml @@ -26,6 +26,7 @@ known_false_positives: False positives may be present. Tune as needed. references: - https://attack.mitre.org/techniques/T1069/001/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md +- https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF tags: analytic_story: - Active Directory Discovery @@ -33,6 +34,7 @@ tags: - Azorult - Windows Post-Exploitation - Prestige Ransomware + - Volt Typhoon asset_type: Endpoint confidence: 50 impact: 30 diff --git a/detections/endpoint/windows_mimikatz_binary_execution.yml b/detections/endpoint/windows_mimikatz_binary_execution.yml index 47093447ac..9a876ef214 100644 --- a/detections/endpoint/windows_mimikatz_binary_execution.yml +++ b/detections/endpoint/windows_mimikatz_binary_execution.yml @@ -31,11 +31,13 @@ known_false_positives: False positives should be limited as this is directly loo references: - https://www.cisa.gov/uscert/sites/default/files/publications/aa22-320a_joint_csa_iranian_government-sponsored_apt_actors_compromise_federal%20network_deploy_crypto%20miner_credential_harvester.pdf - https://www.varonis.com/blog/what-is-mimikatz +- https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF tags: analytic_story: - Credential Dumping - CISA AA22-320A - Sandworm Tools + - Volt Typhoon asset_type: Endpoint confidence: 100 impact: 100 diff --git a/dev/endpoint/net_localgroup_discovery.yml b/dev/endpoint/net_localgroup_discovery.yml index c862f1c6fc..230232b494 100644 --- a/dev/endpoint/net_localgroup_discovery.yml +++ b/dev/endpoint/net_localgroup_discovery.yml @@ -26,6 +26,7 @@ known_false_positives: False positives may be present. Tune as needed. references: - https://attack.mitre.org/techniques/T1069/001/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md +- https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF tags: analytic_story: - Active Directory Discovery @@ -33,6 +34,7 @@ tags: - Azorult - Windows Post-Exploitation - Prestige Ransomware + - Volt Typhoon asset_type: Endpoint confidence: 50 impact: 30 diff --git a/dev/endpoint/windows_mimikatz_binary_execution.yml b/dev/endpoint/windows_mimikatz_binary_execution.yml index 8a6431decd..07ccefde0a 100644 --- a/dev/endpoint/windows_mimikatz_binary_execution.yml +++ b/dev/endpoint/windows_mimikatz_binary_execution.yml @@ -31,10 +31,12 @@ known_false_positives: False positives should be limited as this is directly loo references: - https://www.cisa.gov/uscert/sites/default/files/publications/aa22-320a_joint_csa_iranian_government-sponsored_apt_actors_compromise_federal%20network_deploy_crypto%20miner_credential_harvester.pdf - https://www.varonis.com/blog/what-is-mimikatz +- https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF tags: analytic_story: - Credential Dumping - CISA AA22-320A + - Volt Typhoon asset_type: Endpoint confidence: 100 impact: 100