From 63b2266c04ca1a885345712abd3ffecd38254a9a Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 14 Oct 2021 10:24:20 +0200 Subject: [PATCH] CARS_UPDATE_MITRE_ID_B7 CARS_UPDATE_MITRE_ID_B7 --- ...wershell_process___connect_to_internet_with_hidden_window.yml | 1 + .../endpoint/msbuild_suspicious_spawned_by_script_process.yml | 1 + detections/endpoint/registry_keys_used_for_persistence.yml | 1 + detections/endpoint/sdelete_application_execution.yml | 1 + detections/endpoint/suspicious_copy_on_system32.yml | 1 + detections/endpoint/suspicious_wevtutil_usage.yml | 1 + detections/endpoint/vbscript_execution_using_wscript_app.yml | 1 + detections/endpoint/verclsid_clsid_execution.yml | 1 + .../endpoint/wscript_or_cscript_suspicious_child_process.yml | 1 + 9 files changed, 9 insertions(+) diff --git a/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml b/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml index 7b5444fb72..8aaaed0b6c 100644 --- a/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml +++ b/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml @@ -56,6 +56,7 @@ tags: $dest$ executed by user $user$. mitre_attack_id: - T1059.001 + - T1059 nist: - PR.PT - DE.CM diff --git a/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml b/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml index d0687e4c57..f26c884958 100644 --- a/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml +++ b/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml @@ -32,6 +32,7 @@ tags: - Exploitation mitre_attack_id: - T1127.001 + - T1127 product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index 33f290cdd1..621e1e0782 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -64,6 +64,7 @@ tags: message: A registry activity in $registry_path$ related to persistence in host $dest$ mitre_attack_id: - T1547.001 + - T1547 nist: - PR.PT - DE.CM diff --git a/detections/endpoint/sdelete_application_execution.yml b/detections/endpoint/sdelete_application_execution.yml index 0ded4ef8bc..ee1942f7f2 100644 --- a/detections/endpoint/sdelete_application_execution.yml +++ b/detections/endpoint/sdelete_application_execution.yml @@ -33,6 +33,7 @@ tags: mitre_attack_id: - T1485 - T1070.004 + - T1070 product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/suspicious_copy_on_system32.yml b/detections/endpoint/suspicious_copy_on_system32.yml index 3eb05fde0f..522c819fbe 100644 --- a/detections/endpoint/suspicious_copy_on_system32.yml +++ b/detections/endpoint/suspicious_copy_on_system32.yml @@ -31,6 +31,7 @@ tags: - Exploitation mitre_attack_id: - T1036.003 + - T1036 product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/suspicious_wevtutil_usage.yml b/detections/endpoint/suspicious_wevtutil_usage.yml index 4c32b8f3d4..c85fa3b2b0 100644 --- a/detections/endpoint/suspicious_wevtutil_usage.yml +++ b/detections/endpoint/suspicious_wevtutil_usage.yml @@ -47,6 +47,7 @@ tags: message: Wevtutil.exe being used to clear Event Logs on $dest$ by $user$ mitre_attack_id: - T1070.001 + - T1070 nist: - DE.DP - PR.IP diff --git a/detections/endpoint/vbscript_execution_using_wscript_app.yml b/detections/endpoint/vbscript_execution_using_wscript_app.yml index 5cb1e55d97..3b24917446 100644 --- a/detections/endpoint/vbscript_execution_using_wscript_app.yml +++ b/detections/endpoint/vbscript_execution_using_wscript_app.yml @@ -32,6 +32,7 @@ tags: - Exploitation mitre_attack_id: - T1059.005 + - T1059 product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/verclsid_clsid_execution.yml b/detections/endpoint/verclsid_clsid_execution.yml index 556ef2e416..105298f16c 100644 --- a/detections/endpoint/verclsid_clsid_execution.yml +++ b/detections/endpoint/verclsid_clsid_execution.yml @@ -34,6 +34,7 @@ tags: - Exploitation mitre_attack_id: - T1218.012 + - T1218 product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml b/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml index 1d680f7db2..9d44bd1adf 100644 --- a/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml +++ b/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml @@ -41,6 +41,7 @@ tags: - T1055 - T1543 - T1134.004 + - T1134 product: - Splunk Enterprise - Splunk Enterprise Security