admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
github-actions[bot]
2021-08-31 18:15:32 +00:00
committed by GitHub
parent 21ce693569 e2a6b775b6
commit fc18c0d67e
5 changed files with 33 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bin/generate.py
+2 -2
View File
@@ -361,7 +361,7 @@ def add_rba(detection):
if entity['type'].lower() in risk_object_user_types:
for r in entity['role']:
if 'attacker' == r.lower():
if 'attacker' == r.lower() or 'victim' ==r.lower():
risk_object['risk_object_type'] = 'user'
risk_object['risk_object_field'] = entity['name']
@@ -373,7 +373,7 @@ def add_rba(detection):
elif entity['type'].lower() in risk_object_system_types:
for r in entity['role']:
if 'attacker' == r.lower():
if 'attacker' == r.lower() or 'victim' ==r.lower():
risk_object['risk_object_type'] = 'system'
risk_object['risk_object_field'] = entity['name']
detections/endpoint/disable_registry_tool.yml
+8 -3
View File
@@ -29,8 +29,8 @@ tags:
automated_detection_testing: passed
confidence: 100
context:
- Source: Endpoint
- Stage: Defense Evasion
- Source:Endpoint
- Stage:Defense Evasion
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
@@ -38,9 +38,14 @@ tags:
impact: 40
kill_chain_phases:
- Exploitation
message: Disabled Registry Tools
message: Disabled Registry Tools on $dest$
mitre_attack_id:
- T1562.001
observable:
- name: dest
type: Endpoint
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
detections/endpoint/disable_show_hidden_files.yml
+8 -3
View File
@@ -31,8 +31,8 @@ tags:
automated_detection_testing: passed
confidence: 100
context:
- Source: Endpoint
- Stage: Defense Evasion
- Source:Endpoint
- Stage:Defense Evasion
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
@@ -40,10 +40,15 @@ tags:
impact: 40
kill_chain_phases:
- Exploitation
message: Disabled 'Show Hidden Files'
message: Disabled 'Show Hidden Files' on $dest$
mitre_attack_id:
- T1564.001
- T1562.001
observable:
- name: dest
type: Endpoint
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
detections/endpoint/disable_windows_app_hotkeys.yml
+8 -3
View File
@@ -33,16 +33,21 @@ tags:
automated_detection_testing: passed
confidence: 100
context:
- Source: Endpoint
- Stage: Defense Evasion
- Source:Endpoint
- Stage:Defense Evasion
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/hotkey_disabled_hidden_user/windows-sysmon.log
impact: 40
kill_chain_phases:
- Exploitation
message: Disabled 'Windows App Hotkeys'
message: Disabled 'Windows App Hotkeys' on $dest$
mitre_attack_id:
- T1562.001
observable:
- name: dest
type: Endpoint
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
detections/endpoint/start_up_during_safe_mode_boot.yml
+7 -2
View File
@@ -37,10 +37,15 @@ tags:
impact: 60
kill_chain_phases:
- Exploitation
message: Safeboot registry $Registry.registry_path$ was added or modified with a
new value $Registry.registry_value_name$
message: Safeboot registry $registry_path$ was added or modified with a
new value $registry_value_name$ on $dest$
mitre_attack_id:
- T1547.001
observable:
- name: dest
type: Endpoint
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security