From 3d80496f79060be801e1dbb6419d6e883d2879c4 Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Tue, 31 Aug 2021 10:49:39 -0700
Subject: [PATCH 1/2] if victim then risk

---
 bin/generate.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/bin/generate.py b/bin/generate.py
index 86abe3e838..241fddcb5f 100644
--- a/bin/generate.py
+++ b/bin/generate.py
@@ -361,7 +361,7 @@ def add_rba(detection):
             if entity['type'].lower() in risk_object_user_types:
                 
                 for r in entity['role']:
-                    if 'attacker' == r.lower():
+                    if 'attacker' == r.lower() or 'victim' ==r.lower():
 
                         risk_object['risk_object_type'] = 'user'
                         risk_object['risk_object_field'] = entity['name']
@@ -373,7 +373,7 @@ def add_rba(detection):
             elif entity['type'].lower() in risk_object_system_types:
                 
                 for r in entity['role']:
-                    if 'attacker' == r.lower():
+                    if 'attacker' == r.lower() or 'victim' ==r.lower():
                         
                         risk_object['risk_object_type'] = 'system'
                         risk_object['risk_object_field'] = entity['name']

From d2c2cf38f7dbe95e7ad2583c91f71a8336615c3a Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Tue, 31 Aug 2021 11:06:47 -0700
Subject: [PATCH 2/2] add observable and clean up

---
 detections/endpoint/disable_registry_tool.yml         | 11 ++++++++---
 detections/endpoint/disable_show_hidden_files.yml     | 11 ++++++++---
 detections/endpoint/disable_windows_app_hotkeys.yml   | 11 ++++++++---
 .../endpoint/start_up_during_safe_mode_boot.yml       |  9 +++++++--
 4 files changed, 31 insertions(+), 11 deletions(-)

diff --git a/detections/endpoint/disable_registry_tool.yml b/detections/endpoint/disable_registry_tool.yml
index f02aaacce0..b86174c023 100644
--- a/detections/endpoint/disable_registry_tool.yml
+++ b/detections/endpoint/disable_registry_tool.yml
@@ -29,8 +29,8 @@ tags:
   automated_detection_testing: passed
   confidence: 100
   context:
-  - Source: Endpoint
-  - Stage: Defense Evasion
+  - Source:Endpoint
+  - Stage:Defense Evasion
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
@@ -38,9 +38,14 @@ tags:
   impact: 40
   kill_chain_phases:
   - Exploitation
-  message: Disabled Registry Tools
+  message: Disabled Registry Tools on $dest$
   mitre_attack_id:
   - T1562.001
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
diff --git a/detections/endpoint/disable_show_hidden_files.yml b/detections/endpoint/disable_show_hidden_files.yml
index cfb7714f9f..8db415439d 100644
--- a/detections/endpoint/disable_show_hidden_files.yml
+++ b/detections/endpoint/disable_show_hidden_files.yml
@@ -31,8 +31,8 @@ tags:
   automated_detection_testing: passed
   confidence: 100
   context:
-  - Source: Endpoint
-  - Stage: Defense Evasion
+  - Source:Endpoint
+  - Stage:Defense Evasion
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
@@ -40,10 +40,15 @@ tags:
   impact: 40
   kill_chain_phases:
   - Exploitation
-  message: Disabled 'Show Hidden Files'
+  message: Disabled 'Show Hidden Files' on $dest$
   mitre_attack_id:
   - T1564.001
   - T1562.001
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
diff --git a/detections/endpoint/disable_windows_app_hotkeys.yml b/detections/endpoint/disable_windows_app_hotkeys.yml
index 43ddd6ec43..6fee3152df 100644
--- a/detections/endpoint/disable_windows_app_hotkeys.yml
+++ b/detections/endpoint/disable_windows_app_hotkeys.yml
@@ -33,16 +33,21 @@ tags:
   automated_detection_testing: passed
   confidence: 100
   context:
-  - Source: Endpoint
-  - Stage: Defense Evasion
+  - Source:Endpoint
+  - Stage:Defense Evasion
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/hotkey_disabled_hidden_user/windows-sysmon.log
   impact: 40
   kill_chain_phases:
   - Exploitation
-  message: Disabled 'Windows App Hotkeys'
+  message: Disabled 'Windows App Hotkeys' on $dest$
   mitre_attack_id:
   - T1562.001
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
diff --git a/detections/endpoint/start_up_during_safe_mode_boot.yml b/detections/endpoint/start_up_during_safe_mode_boot.yml
index 2624d8c5e6..7830a68142 100644
--- a/detections/endpoint/start_up_during_safe_mode_boot.yml
+++ b/detections/endpoint/start_up_during_safe_mode_boot.yml
@@ -37,10 +37,15 @@ tags:
   impact: 60
   kill_chain_phases:
   - Exploitation
-  message: Safeboot registry $Registry.registry_path$ was added or modified with a
-    new value $Registry.registry_value_name$
+  message: Safeboot registry $registry_path$ was added or modified with a
+    new value $registry_value_name$ on $dest$
   mitre_attack_id:
   - T1547.001
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security