diff --git a/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml b/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml index 7fa93e0542..878ddb76be 100644 --- a/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml +++ b/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml @@ -36,6 +36,7 @@ tags: - DarkSide Ransomware - Living Off The Land - ProxyNotShell + - CISA AA22-277A confidence: 100 context: - Source:Endpoint diff --git a/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml b/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml index c8f69706d3..dc2ca5fba4 100644 --- a/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml +++ b/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml @@ -36,6 +36,7 @@ references: tags: analytic_story: - FIN7 + - CISA AA22-277A confidence: 80 context: - Source:Endpoint diff --git a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml index 3826c9058d..c81155fd0c 100644 --- a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml +++ b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml @@ -26,6 +26,7 @@ references: tags: analytic_story: - Hidden Cobra Malware + - CISA AA22-277A asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/endpoint/detect_renamed_winrar.yml b/detections/endpoint/detect_renamed_winrar.yml index 6cbd969d01..fe95086749 100644 --- a/detections/endpoint/detect_renamed_winrar.yml +++ b/detections/endpoint/detect_renamed_winrar.yml @@ -30,6 +30,7 @@ references: tags: analytic_story: - Collection and Staging + - CISA AA22-277A confidence: 90 context: - Source:Endpoint diff --git a/detections/endpoint/excessive_usage_of_taskkill.yml b/detections/endpoint/excessive_usage_of_taskkill.yml index 7e0d7a6775..fe91ac5395 100644 --- a/detections/endpoint/excessive_usage_of_taskkill.yml +++ b/detections/endpoint/excessive_usage_of_taskkill.yml @@ -29,6 +29,7 @@ tags: - Azorult - CISA AA22-264A - AgentTesla + - CISA AA22-277A confidence: 70 context: - Source:Endpoint diff --git a/detections/endpoint/exchange_powershell_module_usage.yml b/detections/endpoint/exchange_powershell_module_usage.yml index eed9d7e64c..f23d51c2c3 100644 --- a/detections/endpoint/exchange_powershell_module_usage.yml +++ b/detections/endpoint/exchange_powershell_module_usage.yml @@ -44,6 +44,7 @@ tags: - ProxyShell - CISA AA22-264A - ProxyNotShell + - CISA AA22-277A asset_type: Endpoint confidence: 80 context: diff --git a/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml b/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml index 0ef2da8938..c42b50cc98 100644 --- a/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml +++ b/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml @@ -40,6 +40,7 @@ tags: - Active Directory Lateral Movement - WhisperGate - Industroyer2 + - CISA AA22-277A confidence: 70 context: - Source:Endpoint diff --git a/detections/endpoint/network_connection_discovery_netstat.yml b/detections/endpoint/network_connection_discovery_netstat.yml index 59fcabd767..df19829af4 100644 --- a/detections/endpoint/network_connection_discovery_netstat.yml +++ b/detections/endpoint/network_connection_discovery_netstat.yml @@ -25,6 +25,7 @@ references: tags: analytic_story: - Active Directory Discovery + - CISA AA22-277A confidence: 50 context: - Source:Endpoint diff --git a/detections/endpoint/network_discovery_using_route_windows_app.yml b/detections/endpoint/network_discovery_using_route_windows_app.yml index ebf5e23634..65fe2d20ec 100644 --- a/detections/endpoint/network_discovery_using_route_windows_app.yml +++ b/detections/endpoint/network_discovery_using_route_windows_app.yml @@ -28,6 +28,7 @@ references: tags: analytic_story: - Active Directory Discovery + - CISA AA22-277A confidence: 30 context: - Source:Endpoint diff --git a/lookups/attacker_tools.csv b/lookups/attacker_tools.csv index 834f72dd09..a872333478 100644 --- a/lookups/attacker_tools.csv +++ b/lookups/attacker_tools.csv @@ -25,4 +25,5 @@ NLAChecker.exe,A scanner tool that checks for Windows hosts for Network Level Au ns.exe,A commonly used tool used by attackers to scan and map file shares SilverBullet.exe,Malware was discovered in our monitoring of honey pots that abuses this open source software for scanning and connecting to hosts. kportscan3.exe, KPortScan 3.0 is a widely used port scanning tool on Hacking Forums to perform network scanning on the internal networks. -advanced_port_scanner.exe, Advanced Port Scanner is a free network scanner allowing you to quickly find open ports on network computers and retrieve versions of programs running on the detected ports. \ No newline at end of file +advanced_port_scanner.exe,Advanced Port Scanner is a free network scanner allowing you to quickly find open ports on network computers and retrieve versions of programs running on the detected ports. +mimikatz.exe,utility Mimikatz is an open-source application that allows users to view and save authentication credentials such as Kerberos tickets. \ No newline at end of file