+
+
+
+ATT&CK
+ +
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion |
+
+| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Delivery
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
+#### Search
+
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\shellex\\ContextMenuHandlers\\EPP" Registry.action = deleted by Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.action Registry.dest Registry.user
+| `drop_dm_object_name(Registry)`
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `windows_impair_defense_delete_win_defender_context_menu_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **windows_impair_defense_delete_win_defender_context_menu_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Registry.registry_key_name
+* Registry.registry_value_name
+* Registry.dest
+* Registry.user
+* Registry.registry_path
+* Registry.action
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node.
+
+#### Known False Positives
+It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search.
+
+#### Associated Analytic story
+* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+* [Windows Registry Abuse](/stories/windows_registry_abuse)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 25.0 | 50 | 50 | Windows Defender context menu registry key deleted on $dest$. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/](https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/)
+* [https://app.any.run/tasks/45f5d114-91ea-486c-ab01-41c4093d2861/](https://app.any.run/tasks/45f5d114-91ea-486c-ab01-41c4093d2861/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/delete_win_defender_context_menu/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/delete_win_defender_context_menu/sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-06-07-windows_impair_defense_delete_win_defender_profile_registry.md b/docs/_posts/2022-06-07-windows_impair_defense_delete_win_defender_profile_registry.md
new file mode 100644
index 0000000000..13f5c42b38
--- /dev/null
+++ b/docs/_posts/2022-06-07-windows_impair_defense_delete_win_defender_profile_registry.md
@@ -0,0 +1,170 @@
+---
+title: "Windows Impair Defense Delete Win Defender Profile Registry"
+excerpt: "Disable or Modify Tools
+, Impair Defenses
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-06-07
+toc: true
+toc_label: ""
+tags:
+ - Disable or Modify Tools
+ - Impair Defenses
+ - Defense Evasion
+ - Defense Evasion
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+ - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The search looks for the deletion of Windows Defender main profile within the registry. This was used by RAT malware across a fleet of endpoints. This particular behavior is typically executed when an adversary gains access to an endpoint and beings to perform execution. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications.
+
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Last Updated**: 2022-06-07
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: 65d4b105-ec52-48ec-ac46-289d0fbf7d96
+
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion |
+
+| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Delivery
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
+#### Search
+
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender" Registry.action = deleted by Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.action Registry.user Registry.dest
+| `drop_dm_object_name(Registry)`
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `windows_impair_defense_delete_win_defender_profile_registry_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **windows_impair_defense_delete_win_defender_profile_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Registry.registry_key_name
+* Registry.registry_value_name
+* Registry.dest
+* Registry.user
+* Registry.registry_path
+* Registry.action
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node.
+
+#### Known False Positives
+It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search.
+
+#### Associated Analytic story
+* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+* [Windows Registry Abuse](/stories/windows_registry_abuse)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 64.0 | 80 | 80 | Windows Defender Logger registry key set to 'disabled' on $dest$. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/](https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/)
+* [https://app.any.run/tasks/45f5d114-91ea-486c-ab01-41c4093d2861/](https://app.any.run/tasks/45f5d114-91ea-486c-ab01-41c4093d2861/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/delete_win_defender_context_menu/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/delete_win_defender_context_menu/sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-06-07-windows_impair_defenses_disable_win_defender_auto_logging.md b/docs/_posts/2022-06-07-windows_impair_defenses_disable_win_defender_auto_logging.md
new file mode 100644
index 0000000000..1dc2c0cb10
--- /dev/null
+++ b/docs/_posts/2022-06-07-windows_impair_defenses_disable_win_defender_auto_logging.md
@@ -0,0 +1,170 @@
+---
+title: "Windows Impair Defenses Disable Win Defender Auto Logging"
+excerpt: "Disable or Modify Tools
+, Impair Defenses
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-06-07
+toc: true
+toc_label: ""
+tags:
+ - Disable or Modify Tools
+ - Impair Defenses
+ - Defense Evasion
+ - Defense Evasion
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+ - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The search looks for the Registry Key DefenderApiLogger or DefenderAuditLogger set to disable. This is consistent with RAT malware across a fleet of endpoints. This particular behavior is typically executed when an adversary gains access to an endpoint and beings to perform execution. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications.
+
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Last Updated**: 2022-06-07
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: 76406a0f-f5e0-4167-8e1f-337fdc0f1b0c
+
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion |
+
+| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Delivery
+
+
+
+
+
+
+NIST
+ +
+
+* PR.PT
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 8
+
+
+
+
+
+
+
+#### Search
+
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where (Registry.registry_path = "*WMI\\Autologger\\DefenderApiLogger\\Start" OR Registry.registry_path = "*WMI\\Autologger\\DefenderAuditLogger\\Start") Registry.registry_value_data ="0x00000000" by Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.action Registry.dest Registry.user
+| `drop_dm_object_name(Registry)`
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `windows_impair_defenses_disable_win_defender_auto_logging_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **windows_impair_defenses_disable_win_defender_auto_logging_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Registry.registry_key_name
+* Registry.registry_value_name
+* Registry.dest
+* Registry.user
+* Registry.registry_path
+* Registry.action
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node.
+
+#### Known False Positives
+It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search.
+
+#### Associated Analytic story
+* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+* [Windows Registry Abuse](/stories/windows_registry_abuse)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 24.0 | 30 | 80 | Windows Defender Logger registry key set to 'disabled' on $dest$. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/](https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/)
+* [https://app.any.run/tasks/45f5d114-91ea-486c-ab01-41c4093d2861/](https://app.any.run/tasks/45f5d114-91ea-486c-ab01-41c4093d2861/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable_defender_logging/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable_defender_logging/sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-06-21-aws_ecr_container_scanning_findings_high.md b/docs/_posts/2022-06-21-aws_ecr_container_scanning_findings_high.md
new file mode 100644
index 0000000000..68334536f8
--- /dev/null
+++ b/docs/_posts/2022-06-21-aws_ecr_container_scanning_findings_high.md
@@ -0,0 +1,174 @@
+---
+title: "AWS ECR Container Scanning Findings High"
+excerpt: "Malicious Image
+, User Execution
+"
+categories:
+ - Cloud
+last_modified_at: 2022-06-21
+toc: true
+toc_label: ""
+tags:
+ - Malicious Image
+ - User Execution
+ - Execution
+ - Execution
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-06-21
+- **Author**: Patrick Bareiss, Splunk
+- **ID**: 62721bd2-1d82-4623-b6e6-aac170014423
+
+
+#### Annotations
+
+CVE
+ +
+
+
+
+
+
+
+
+ATT&CK
+ +
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1204.003](https://attack.mitre.org/techniques/T1204/003/) | Malicious Image | Execution |
+
+| [T1204](https://attack.mitre.org/techniques/T1204/) | User Execution | Execution |
+
+
+
+
+
+
+Kill Chain Phase
+ +
+
+* Actions on Objectives
+
+
+
+
+
+
+NIST
+ +
+
+* PR.DS
+* PR.AC
+* DE.CM
+
+
+
+
+
+
+
+CIS20
+ +
+
+* CIS 13
+
+
+
+
+
+
+
+#### Search
+
+```
+`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings
+| spath path=responseElements.imageScanFindings.findings{} output=findings
+| mvexpand findings
+| spath input=findings
+| search severity=HIGH
+| rename name as finding_name, description as finding_description, requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as image
+| eval finding = finding_name.", ".finding_description
+| eval phase="release"
+| eval severity="high"
+| stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName, eventSource, imageDigest, image, userName, src_ip, finding, phase, severity
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `aws_ecr_container_scanning_findings_high_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+
+> :information_source:
+> **aws_ecr_container_scanning_findings_high_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* eventSource
+* eventName
+* responseElements.imageScanFindings.findings{}
+* awsRegion
+* requestParameters.imageId.imageDigest
+* requestParameters.repositoryName
+* user
+* userName
+* src_ip
+
+
+#### How To Implement
+You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
+
+#### Known False Positives
+unknown
+
+#### Associated Analytic story
+* [Dev Sec Ops](/stories/dev_sec_ops)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 70.0 | 70 | 100 | Vulnerabilities with severity high found in image $image$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html](https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_stories/credential_dumping.md b/docs/_stories/credential_dumping.md
index 6c33f6adf1..6061c3fe08 100644
--- a/docs/_stories/credential_dumping.md
+++ b/docs/_stories/credential_dumping.md
@@ -7,10 +7,12 @@ tags:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
+ - Authentication
- Endpoint
- Actions on Objectives
- Exploitation
- Installation
+ - Reconnaissance
---
[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
@@ -20,7 +22,7 @@ tags:
Uncover activity consistent with credential dumping, a technique wherein attackers compromise systems and attempt to obtain and exfiltrate passwords. The threat actors use these pilfered credentials to further escalate privileges and spread throughout a target environment. The included searches in this Analytic Story are designed to identify attempts to credential dumping.
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Datamodel**: [Authentication](https://docs.splunk.com/Documentation/CIM/latest/User/Authentication), [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
- **Last Updated**: 2020-02-04
- **Author**: Rico Valdez, Splunk
- **ID**: 854d78bf-d0e2-4f4e-b05c-640905f86d7a
@@ -54,6 +56,7 @@ The detection searches in this Analytic Story monitor access to the Local Securi
| [Esentutl SAM Copy](/endpoint/esentutl_sam_copy/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping)| Hunting |
| [Extraction of Registry Hives](/endpoint/extraction_of_registry_hives/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping)| TTP |
| [Ntdsutil Export NTDS](/endpoint/ntdsutil_export_ntds/) | [NTDS](/tags/#ntds), [OS Credential Dumping](/tags/#os-credential-dumping)| TTP |
+| [Potential password in username](/endpoint/potential_password_in_username/) | [Local Accounts](/tags/#local-accounts), [Credentials In Files](/tags/#credentials-in-files)| Hunting |
| [SAM Database File Access Attempt](/endpoint/sam_database_file_access_attempt/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping)| Hunting |
| [SecretDumps Offline NTDS Dumping Tool](/endpoint/secretdumps_offline_ntds_dumping_tool/) | [NTDS](/tags/#ntds), [OS Credential Dumping](/tags/#os-credential-dumping)| TTP |
| [Set Default PowerShell Execution Policy To Unrestricted or Bypass](/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell)| TTP |
diff --git a/docs/_stories/insider_threat.md b/docs/_stories/insider_threat.md
index 172fea6b8f..4ee44b4807 100644
--- a/docs/_stories/insider_threat.md
+++ b/docs/_stories/insider_threat.md
@@ -8,8 +8,10 @@ tags:
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Behavioral Analytics
+ - Authentication
- Endpoint
- Exploitation
+ - Reconnaissance
---
[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
@@ -19,7 +21,7 @@ tags:
Monitor for activities and techniques associated with insider threats and specifically focusing on malicious insiders operating with in a corporate environment.
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud, Splunk Behavioral Analytics
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Datamodel**: [Authentication](https://docs.splunk.com/Documentation/CIM/latest/User/Authentication), [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
- **Last Updated**: 2022-05-19
- **Author**: Jose Hernandez, Splunk
- **ID**: c633df29-a950-4c4c-a0f8-02be6730797c
@@ -36,6 +38,7 @@ Insider Threats are best defined by CISA: "Insider threat incidents are possible
| [Gsuite Outbound Email With Attachment To External Domain](/cloud/gsuite_outbound_email_with_attachment_to_external_domain/) | [Exfiltration Over Unencrypted Non-C2 Protocol](/tags/#exfiltration-over-unencrypted-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol)| Anomaly |
| [High Frequency Copy Of Files In Network Share](/endpoint/high_frequency_copy_of_files_in_network_share/) | [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account)| Anomaly |
| [Multiple Users Failing To Authenticate From Process](/endpoint/multiple_users_failing_to_authenticate_from_process/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force)| Anomaly |
+| [Potential password in username](/endpoint/potential_password_in_username/) | [Local Accounts](/tags/#local-accounts), [Credentials In Files](/tags/#credentials-in-files)| Hunting |
| [Windows Users Authenticate Using Explicit Credentials](/endpoint/windows_users_authenticate_using_explicit_credentials/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force)| Anomaly |
#### Reference
diff --git a/docs/_stories/ransomware.md b/docs/_stories/ransomware.md
index 5f9dbd9469..6980ae4bf9 100644
--- a/docs/_stories/ransomware.md
+++ b/docs/_stories/ransomware.md
@@ -78,6 +78,7 @@ Ransomware is an ever-present risk to the enterprise, wherein an infected host e
| [Remote Process Instantiation via WMI](/endpoint/remote_process_instantiation_via_wmi/) | [Windows Management Instrumentation](/tags/#windows-management-instrumentation)| TTP |
| [Revil Common Exec Parameter](/endpoint/revil_common_exec_parameter/) | [User Execution](/tags/#user-execution)| TTP |
| [Revil Registry Entry](/endpoint/revil_registry_entry/) | [Modify Registry](/tags/#modify-registry)| TTP |
+| [Rundll32 LockWorkStation](/endpoint/rundll32_lockworkstation/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32)| Anomaly |
| [Schtasks used for forcing a reboot](/endpoint/schtasks_used_for_forcing_a_reboot/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job)| TTP |
| [Suspicious Event Log Service Behavior](/endpoint/suspicious_event_log_service_behavior/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs)| TTP |
| [Suspicious Scheduled Task from Public Directory](/endpoint/suspicious_scheduled_task_from_public_directory/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job)| Anomaly |
diff --git a/docs/_stories/spearphishing_attachments.md b/docs/_stories/spearphishing_attachments.md
index 0e17c33da9..a3e95a82cb 100644
--- a/docs/_stories/spearphishing_attachments.md
+++ b/docs/_stories/spearphishing_attachments.md
@@ -60,6 +60,7 @@ This Analytic Story focuses on detecting signs that a malicious payload has been
| [Windows Office Product Spawning MSDT](/endpoint/windows_office_product_spawning_msdt/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment)| TTP |
| [Winword Spawning Cmd](/endpoint/winword_spawning_cmd/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment)| TTP |
| [Winword Spawning PowerShell](/endpoint/winword_spawning_powershell/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment)| TTP |
+| [Winword Spawning Windows Script Host](/endpoint/winword_spawning_windows_script_host/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment)| TTP |
| [Gdrive suspicious file sharing](/cloud/gdrive_suspicious_file_sharing/) | [Phishing](/tags/#phishing)| Hunting |
| [Gsuite suspicious calendar invite](/cloud/gsuite_suspicious_calendar_invite/) | [Phishing](/tags/#phishing)| Hunting |
| [Detect Outlook exe writing a zip file](/endpoint/detect_outlook_exe_writing_a_zip_file/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment)| TTP |
diff --git a/docs/_stories/splunk_vulnerabilities.md b/docs/_stories/splunk_vulnerabilities.md
index 062660f7ef..112db56d1a 100644
--- a/docs/_stories/splunk_vulnerabilities.md
+++ b/docs/_stories/splunk_vulnerabilities.md
@@ -7,6 +7,8 @@ tags:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
+ - Splunk_Audit
+ - Actions on Objectives
- Delivery
- Exploitation
- Reconnaissance
@@ -19,7 +21,7 @@ tags:
Keeping your Splunk Enterprise deployment up to date is critical and will help you reduce the risk associated with vulnerabilities in the product.
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**:
+- **Datamodel**: [Splunk_Audit](https://docs.splunk.com/Documentation/CIM/latest/User/SplunkAudit)
- **Last Updated**: 2022-03-28
- **Author**: Lou Stella, Splunk
- **ID**: 5354df00-dce2-48ac-9a64-8adb48006828
@@ -33,11 +35,21 @@ This analytic story includes detections that focus on attacker behavior targeted
| Name | Technique | Type |
| ----------- | ----------- |--------------|
| [Path traversal SPL injection](/application/path_traversal_spl_injection/) | [File and Directory Discovery](/tags/#file-and-directory-discovery)| TTP |
+| [Splunk Command and Scripting Interpreter Delete Usage](/application/splunk_command_and_scripting_interpreter_delete_usage/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter)| Anomaly |
+| [Splunk Command and Scripting Interpreter Risky Commands](/application/splunk_command_and_scripting_interpreter_risky_commands/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter)| Hunting |
+| [Splunk Command and Scripting Interpreter Risky SPL MLTK](/application/splunk_command_and_scripting_interpreter_risky_spl_mltk/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter)| Anomaly |
+| [Splunk Digital Certificates Infrastructure Version](/application/splunk_digital_certificates_infrastructure_version/) | [Digital Certificates](/tags/#digital-certificates)| Hunting |
+| [Splunk Digital Certificates Lack of Encryption](/application/splunk_digital_certificates_lack_of_encryption/) | [Digital Certificates](/tags/#digital-certificates)| Anomaly |
| [Splunk DoS via Malformed S2S Request](/application/splunk_dos_via_malformed_s2s_request/) | [Network Denial of Service](/tags/#network-denial-of-service)| TTP |
+| [Splunk Process Injection Forwarder Bundle Downloads](/application/splunk_process_injection_forwarder_bundle_downloads/) | [Process Injection](/tags/#process-injection)| Hunting |
+| [Splunk Protocol Impersonation Weak Encryption Configuration](/application/splunk_protocol_impersonation_weak_encryption_configuration/) | [Protocol Impersonation](/tags/#protocol-impersonation)| Hunting |
+| [Splunk protocol impersonation weak encryption selfsigned](/application/splunk_protocol_impersonation_weak_encryption_selfsigned/) | [Digital Certificates](/tags/#digital-certificates)| Hunting |
+| [Splunk protocol impersonation weak encryption simplerequest](/application/splunk_protocol_impersonation_weak_encryption_simplerequest/) | [Digital Certificates](/tags/#digital-certificates)| Hunting |
| [Splunk User Enumeration Attempt](/application/splunk_user_enumeration_attempt/) | [Valid Accounts](/tags/#valid-accounts)| TTP |
| [Splunk XSS in Monitoring Console](/application/splunk_xss_in_monitoring_console/) | [Drive-by Compromise](/tags/#drive-by-compromise)| TTP |
| [Open Redirect in Splunk Web](/deprecated/open_redirect_in_splunk_web/) | None| TTP |
| [Splunk Enterprise Information Disclosure](/deprecated/splunk_enterprise_information_disclosure/) | None| TTP |
+| [Splunk Identified SSL TLS Certificates](/network/splunk_identified_ssl_tls_certificates/) | [Network Sniffing](/tags/#network-sniffing)| Hunting |
#### Reference
diff --git a/docs/_stories/windows_defense_evasion_tactics.md b/docs/_stories/windows_defense_evasion_tactics.md
index b396c3b240..c9cdd4b3f0 100644
--- a/docs/_stories/windows_defense_evasion_tactics.md
+++ b/docs/_stories/windows_defense_evasion_tactics.md
@@ -77,6 +77,9 @@ Defense evasion is a tactic--identified in the MITRE ATT&CK framework--that adve
| [Windows Event For Service Disabled](/endpoint/windows_event_for_service_disabled/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| Hunting |
| [Windows Excessive Disabled Services Event](/endpoint/windows_excessive_disabled_services_event/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP |
| [Windows Hide Notification Features Through Registry](/endpoint/windows_hide_notification_features_through_registry/) | [Modify Registry](/tags/#modify-registry)| Anomaly |
+| [Windows Impair Defense Delete Win Defender Context Menu](/endpoint/windows_impair_defense_delete_win_defender_context_menu/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| Hunting |
+| [Windows Impair Defense Delete Win Defender Profile Registry](/endpoint/windows_impair_defense_delete_win_defender_profile_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| Anomaly |
+| [Windows Impair Defenses Disable Win Defender Auto Logging](/endpoint/windows_impair_defenses_disable_win_defender_auto_logging/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| Anomaly |
| [Windows Modify Show Compress Color And Info Tip Registry](/endpoint/windows_modify_show_compress_color_and_info_tip_registry/) | [Modify Registry](/tags/#modify-registry)| TTP |
| [Windows Process With NamedPipe CommandLine](/endpoint/windows_process_with_namedpipe_commandline/) | [Process Injection](/tags/#process-injection)| Anomaly |
| [Windows Rasautou DLL Execution](/endpoint/windows_rasautou_dll_execution/) | [Dynamic-link Library Injection](/tags/#dynamic-link-library-injection), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Process Injection](/tags/#process-injection)| TTP |
diff --git a/docs/_stories/windows_registry_abuse.md b/docs/_stories/windows_registry_abuse.md
index 26ee941b36..ba064f4e83 100644
--- a/docs/_stories/windows_registry_abuse.md
+++ b/docs/_stories/windows_registry_abuse.md
@@ -86,6 +86,9 @@ Windows Registry is one of the powerful and yet still mysterious Windows feature
| [Windows Disable Windows Group Policy Features Through Registry](/endpoint/windows_disable_windows_group_policy_features_through_registry/) | [Modify Registry](/tags/#modify-registry)| Anomaly |
| [Windows DisableAntiSpyware Registry](/endpoint/windows_disableantispyware_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP |
| [Windows Hide Notification Features Through Registry](/endpoint/windows_hide_notification_features_through_registry/) | [Modify Registry](/tags/#modify-registry)| Anomaly |
+| [Windows Impair Defense Delete Win Defender Context Menu](/endpoint/windows_impair_defense_delete_win_defender_context_menu/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| Hunting |
+| [Windows Impair Defense Delete Win Defender Profile Registry](/endpoint/windows_impair_defense_delete_win_defender_profile_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| Anomaly |
+| [Windows Impair Defenses Disable Win Defender Auto Logging](/endpoint/windows_impair_defenses_disable_win_defender_auto_logging/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| Anomaly |
| [Windows Modify Show Compress Color And Info Tip Registry](/endpoint/windows_modify_show_compress_color_and_info_tip_registry/) | [Modify Registry](/tags/#modify-registry)| TTP |
| [Windows Registry Certificate Added](/endpoint/windows_registry_certificate_added/) | [Install Root Certificate](/tags/#install-root-certificate), [Subvert Trust Controls](/tags/#subvert-trust-controls)| TTP |
| [Windows Registry Delete Task SD](/endpoint/windows_registry_delete_task_sd/) | [Scheduled Task](/tags/#scheduled-task), [Impair Defenses](/tags/#impair-defenses)| TTP |
diff --git a/docs/mitre-map/coverage.json b/docs/mitre-map/coverage.json
index cf184a001b..30eb69a7a6 100644
--- a/docs/mitre-map/coverage.json
+++ b/docs/mitre-map/coverage.json
@@ -9,11 +9,36 @@
"score": 1,
"comment": "https://github.com/splunk/security_content/blob/develop/detections/application/path_traversal_spl_injection.yml"
},
+ {
+ "techniqueID": "T1059",
+ "score": 43,
+ "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_carry_out_string_command_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_distinct_processes_from_windows_temp.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/log4shell_cve_2021_44228_exploitation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/macos_lolbin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_writing_dynamicwrapperx.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_with_discord_dns_query.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/vbscript_execution_using_wscript_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/exchange_powershell_module_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/detect_outbound_ldap_traffic.yml"
+ },
+ {
+ "techniqueID": "T1587.003",
+ "score": 2,
+ "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/splunk_digital_certificates_infrastructure_version.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_digital_certificates_lack_of_encryption.yml"
+ },
{
"techniqueID": "T1498",
"score": 7,
"comment": "https://github.com/splunk/security_content/blob/develop/detections/application/splunk_dos_via_malformed_s2s_request.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/detect_arp_poisoning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/detect_traffic_mirroring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/large_volume_of_dns_any_queries.yml"
},
+ {
+ "techniqueID": "T1055",
+ "score": 20,
+ "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_process_with_namedpipe_commandline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml"
+ },
+ {
+ "techniqueID": "T1001.003",
+ "score": 1,
+ "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml"
+ },
+ {
+ "techniqueID": "T1588.004",
+ "score": 2,
+ "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml"
+ },
{
"techniqueID": "T1078",
"score": 36,
@@ -91,8 +116,8 @@
},
{
"techniqueID": "T1562",
- "score": 50,
- "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_iptables_firewall_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_for_service_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_excessive_disabled_services_event.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_registry_delete_task_sd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_terminating_lsass_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_stdout_redirection_to_dev_null_file.yml"
+ "score": 53,
+ "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_iptables_firewall_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_for_service_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_excessive_disabled_services_event.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_registry_delete_task_sd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_terminating_lsass_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_stdout_redirection_to_dev_null_file.yml"
},
{
"techniqueID": "T1554",
@@ -256,8 +281,8 @@
},
{
"techniqueID": "T1218",
- "score": 53,
- "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_diskshadow_proxy_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
+ "score": 54,
+ "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_diskshadow_proxy_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
},
{
"techniqueID": "T1036",
@@ -266,8 +291,8 @@
},
{
"techniqueID": "T1218.011",
- "score": 15,
- "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_no_command_line_arguments.yml"
+ "score": 16,
+ "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_no_command_line_arguments.yml"
},
{
"techniqueID": "T1204.002",
@@ -321,8 +346,8 @@
},
{
"techniqueID": "T1562.001",
- "score": 39,
- "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_for_service_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_excessive_disabled_services_event.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_terminating_lsass_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml"
+ "score": 42,
+ "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_for_service_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_excessive_disabled_services_event.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_terminating_lsass_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml"
},
{
"techniqueID": "T1021.001",
@@ -339,11 +364,6 @@
"score": 23,
"comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_uac_remote_restriction.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_common_process_for_elevation_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_doas_conf_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_doas_tool_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_access_to_sudoers_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_setuid_using_chmod_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_setuid_using_setcap_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_sudo_or_su_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_sudoers_tmp_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_visudo_utility_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
},
- {
- "techniqueID": "T1059",
- "score": 40,
- "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_carry_out_string_command_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_distinct_processes_from_windows_temp.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/log4shell_cve_2021_44228_exploitation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/macos_lolbin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_writing_dynamicwrapperx.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_with_discord_dns_query.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/vbscript_execution_using_wscript_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/exchange_powershell_module_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/detect_outbound_ldap_traffic.yml"
- },
{
"techniqueID": "T1105",
"score": 12,
@@ -429,11 +449,6 @@
"score": 3,
"comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
},
- {
- "techniqueID": "T1055",
- "score": 19,
- "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_process_with_namedpipe_commandline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml"
- },
{
"techniqueID": "T1485",
"score": 17,
@@ -506,8 +521,8 @@
},
{
"techniqueID": "T1078.003",
- "score": 1,
- "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml"
+ "score": 2,
+ "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/potential_password_in_username.yml"
},
{
"techniqueID": "T1505",
@@ -864,6 +879,11 @@
"score": 1,
"comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ping_sleep_batch_command.yml"
},
+ {
+ "techniqueID": "T1552.001",
+ "score": 1,
+ "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/potential_password_in_username.yml"
+ },
{
"techniqueID": "T1027.005",
"score": 2,
@@ -1103,6 +1123,11 @@
"techniqueID": "T1498.002",
"score": 1,
"comment": "https://github.com/splunk/security_content/blob/develop/detections/network/large_volume_of_dns_any_queries.yml"
+ },
+ {
+ "techniqueID": "T1040",
+ "score": 1,
+ "comment": "https://github.com/splunk/security_content/blob/develop/detections/network/splunk_identified_ssl_tls_certificates.yml"
}
],
"gradient": {
@@ -1112,7 +1137,7 @@
"#096ed7"
],
"minValue": 0,
- "maxValue": 53
+ "maxValue": 54
},
"filters": {
"platforms": [
diff --git a/macros/potential_password_in_username_false_positive_reduction.yml b/macros/potential_password_in_username_false_positive_reduction.yml
new file mode 100644
index 0000000000..e8555b4f55
--- /dev/null
+++ b/macros/potential_password_in_username_false_positive_reduction.yml
@@ -0,0 +1,3 @@
+definition: search *
+description: Add customer specific known false positives to the map command used in detection - Potential password in username
+name: potential_password_in_username_false_positive_reduction
\ No newline at end of file
diff --git a/macros/process_msiexec.yml b/macros/process_msiexec.yml
new file mode 100644
index 0000000000..8d7889dbc0
--- /dev/null
+++ b/macros/process_msiexec.yml
@@ -0,0 +1,3 @@
+definition: (Processes.process_name=msiexec.exe OR Processes.original_file_name=msiexec.exe)
+description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/
+name: process_msiexec
\ No newline at end of file
diff --git a/macros/splunk_python.yml b/macros/splunk_python.yml
new file mode 100644
index 0000000000..308c5cb662
--- /dev/null
+++ b/macros/splunk_python.yml
@@ -0,0 +1,4 @@
+definition: index=_internal sourcetype=splunk_python
+description: customer specific splunk configurations(eg- index, source, sourcetype).
+ Replace the macro definition with configurations for your Splunk Environmnent.
+name: splunk_python
diff --git a/notebooks/attempted_credential_dump_from_registry_via_reg_exe.ipynb b/notebooks/attempted_credential_dump_from_registry_via_reg_exe.ipynb
deleted file mode 100644
index 49c3f18b14..0000000000
--- a/notebooks/attempted_credential_dump_from_registry_via_reg_exe.ipynb
+++ /dev/null
@@ -1,141 +0,0 @@
-{
- "cells": [
- {
- "cell_type": "markdown",
- "metadata": {},
- "source": [
- "## Detect Credential Dumping via reg.exe T1003.002"
- ]
- },
- {
- "cell_type": "markdown",
- "metadata": {},
- "source": [
- "Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored. The SAM is a database file that contains local accounts for the host, typically those found with the net user command. Enumerating the SAM database requires SYSTEM level access. MITRE ATT&CK"
- ]
- },
- {
- "cell_type": "code",
- "execution_count": 1,
- "metadata": {
- "execution": {
- "iopub.status.idle": "2020-10-19T19:55:18.824958Z",
- "shell.execute_reply": "2020-10-19T19:55:18.824476Z",
- "shell.execute_reply.started": "2020-10-19T19:55:15.531094Z"
- },
- "scrolled": true
- },
- "outputs": [
- {
- "name": "stdout",
- "output_type": "stream",
- "text": [
- " Finished. "
- ]
- },
- {
- "data": {
- "text/html": [
- "CVE
+ +
+
+
+
+\n",
- "\n",
- "\n",
- " \n",
- "
\n",
- "
"
- ],
- "text/plain": [
- " sysmon ... process_name\n",
- "0 {'EventTime': '2020-06-30 10:47:11', 'Hostname... ... C:\\Windows\\System32\\cmd.exe\n",
- "\n",
- "[1 rows x 4 columns]"
- ]
- },
- "metadata": {},
- "output_type": "display_data"
- },
- {
- "name": "stdout",
- "output_type": "stream",
- "text": [
- "\n"
- ]
- },
- {
- "data": {
- "text/plain": [
- "| \n", - " | sysmon | \n", - "cmd_line | \n", - "value | \n", - "process_name | \n", - "
|---|---|---|---|---|
| 0 | \n", - "{'EventTime': '2020-06-30 10:47:11', 'Hostname... | \n", - "\"C:\\Windows\\system32\\cmd.exe\" /c \"reg save HKL... | \n", - "{\"EventTime\":\"2020-06-30 10:47:11\",\"Hostname\":... | \n", - "C:\\Windows\\System32\\cmd.exe | \n", - "
\n",
- "![](\"https://upload.wikimedia.org/wikipedia/commons/3/37/Autoencoder_schema.png\")
\n",
- "
\n",
- "\n",
- "For our purposes, we will build an autoencoder to identify anomalous groups of processes. We focus on processes with the prefix \\\\\\\\device\\Windows since attackers leverage these executables to [live off the land](https://conf.splunk.com/files/2019/slides/SEC1375.pdf). We use a technique called [feature hashing](https://scikit-learn.org/stable/modules/generated/sklearn.feature_extraction.FeatureHasher.html) to project the input (a map of process -> counts) into a [vector space](https://en.wikipedia.org/wiki/Vector_space) (convenient for machine learning).\n"
- ]
- },
- {
- "cell_type": "code",
- "execution_count": 8,
- "id": "243c11af-0f58-4bb7-9bc6-1a0a88df8abe",
- "metadata": {},
- "outputs": [],
- "source": [
- "import numpy as np\n",
- "from sklearn.feature_extraction import FeatureHasher\n",
- "import tensorflow as tf\n",
- "from sklearn.pipeline import Pipeline\n"
- ]
- },
- {
- "cell_type": "markdown",
- "id": "151ade38-3b59-482c-80f4-688f04cb2cf8",
- "metadata": {},
- "source": [
- "### Training data\n",
- "We will create a toy dataset that will contain which processes launched and how often during some time window (e.g. hour) correllated on one or more entities (e.g. user and machine, machine). For this demonstration, normal data will consist of a sample of four processes, of which, these four processes can occur 0-5 times within a sampling period. We assume independence between the processes. The below code block generates the data."
- ]
- },
- {
- "cell_type": "code",
- "execution_count": 38,
- "id": "c17980df-e29a-4696-8b35-fa440864306f",
- "metadata": {},
- "outputs": [],
- "source": [
- "# Let's create some dummy data using processes\n",
- "# commonly seen with the prefix C:\\Windows\n",
- "num_samples = 10000\n",
- "def create_dataset(num_samples=10000):\n",
- " data = []\n",
- " for i in range(num_samples):\n",
- " datum = {'cmd.exe': np.round(np.random.uniform(high=5)),\n",
- " 'conhost.exe': np.round(np.random.uniform(high=5)),\n",
- " 'svchost.exe': np.round(np.random.uniform(high=5)),\n",
- " 'werfault.exe': np.round(np.random.uniform(high=5))}\n",
- " data.append(datum)\n",
- " return data\n",
- "\n",
- "training_data = create_dataset()\n",
- "test_data = create_dataset()\n"
- ]
- },
- {
- "cell_type": "markdown",
- "id": "2e5a163c-7f91-468f-bdb3-5c14a244945f",
- "metadata": {},
- "source": [
- "### Transforming the data\n",
- "We use a scikit learn pipeline to feature hash the input into a 16 dimensional vector. An example is shown of what the input and output look like."
- ]
- },
- {
- "cell_type": "code",
- "execution_count": 59,
- "id": "63ca8129-0e0c-43c2-9ee6-b25c0a83390f",
- "metadata": {},
- "outputs": [
- {
- "name": "stdout",
- "output_type": "stream",
- "text": [
- "Input data (process -> count map):\n",
- "cmd.exe->3, conhost.exe->3, svchost.exe->5, werfault.exe->0\n",
- "\n",
- "\n",
- "Vectorized input (16 dimensional)\n",
- "[[-3. 2. 0. 0. 0. 0. 0. 0. 0. 0. 0. 0. 0. 0. 0. 0.]]\n"
- ]
- }
- ],
- "source": [
- "pipe = Pipeline([('hasher', FeatureHasher(n_features=16))])\n",
- "X = pipe.fit_transform(data)\n",
- "\n",
- "print(\"Input data (process -> count map):\")\n",
- "print(\", \".join([f\"{k}->{int(v)}\" for (k, v) in data[0].items()]))\n",
- "print(\"\\n\")\n",
- "print(\"Vectorized input (16 dimensional)\")\n",
- "print(X[0].todense())"
- ]
- },
- {
- "cell_type": "markdown",
- "id": "a941fd31-cb58-407d-b8bc-caea2229bb35",
- "metadata": {},
- "source": [
- "## Network\n",
- "We build our model using TensorFlow Keras. Since the input is already vectorized, we will stack vanilla dense layers with leaky ReLU activations to compress the input into a four dimensional vector encoding and than decompress back into the original."
- ]
- },
- {
- "cell_type": "code",
- "execution_count": 55,
- "id": "05f287e6-4f5b-454e-8aa0-2d18f4c07612",
- "metadata": {},
- "outputs": [
- {
- "name": "stdout",
- "output_type": "stream",
- "text": [
- "Model: \"model_2\"\n",
- "_________________________________________________________________\n",
- "Layer (type) Output Shape Param # \n",
- "=================================================================\n",
- "win_processes_hashed (InputL [(None, 16)] 0 \n",
- "_________________________________________________________________\n",
- "enc_1 (Dense) (None, 8) 136 \n",
- "_________________________________________________________________\n",
- "leaky_re_lu_8 (LeakyReLU) (None, 8) 0 \n",
- "_________________________________________________________________\n",
- "enc_2 (Dense) (None, 4) 36 \n",
- "_________________________________________________________________\n",
- "leaky_re_lu_9 (LeakyReLU) (None, 4) 0 \n",
- "_________________________________________________________________\n",
- "dec_1 (Dense) (None, 8) 40 \n",
- "_________________________________________________________________\n",
- "leaky_re_lu_10 (LeakyReLU) (None, 8) 0 \n",
- "_________________________________________________________________\n",
- "reconstruction (Dense) (None, 16) 144 \n",
- "_________________________________________________________________\n",
- "leaky_re_lu_11 (LeakyReLU) (None, 16) 0 \n",
- "=================================================================\n",
- "Total params: 356\n",
- "Trainable params: 356\n",
- "Non-trainable params: 0\n",
- "_________________________________________________________________\n"
- ]
- }
- ],
- "source": [
- "ae_input_layer = tf.keras.layers.Input(shape=(16,), name=\"win_processes_hashed\")\n",
- "ae_net = tf.keras.layers.Dense(8, name=\"enc_1\")(ae_input_layer)\n",
- "ae_net = tf.keras.layers.LeakyReLU()(ae_net)\n",
- "ae_net = tf.keras.layers.Dense(4, name=\"enc_2\")(ae_net)\n",
- "ae_net = tf.keras.layers.LeakyReLU()(ae_net)\n",
- "ae_net = tf.keras.layers.Dense(8, name=\"dec_1\")(ae_net)\n",
- "ae_net = tf.keras.layers.LeakyReLU()(ae_net)\n",
- "ae_net = tf.keras.layers.Dense(16, name=\"reconstruction\")(ae_net)\n",
- "ae_net = tf.keras.layers.LeakyReLU()(ae_net)\n",
- "ae_model = tf.keras.models.Model(ae_input_layer, ae_net)\n",
- "ae_model.compile('adam', 'mse', ['mae'])\n",
- "ae_model.summary()"
- ]
- },
- {
- "cell_type": "code",
- "execution_count": 56,
- "id": "056ebac9-a317-4840-af1b-acfb2126f8be",
- "metadata": {},
- "outputs": [
- {
- "name": "stdout",
- "output_type": "stream",
- "text": [
- "Epoch 1/10\n",
- "1250/1250 [==============================] - 1s 549us/step - loss: 0.7084 - mae: 0.2522\n",
- "Epoch 2/10\n",
- "1250/1250 [==============================] - 1s 587us/step - loss: 0.0053 - mae: 0.0334\n",
- "Epoch 3/10\n",
- "1250/1250 [==============================] - 1s 550us/step - loss: 0.0012 - mae: 0.0171\n",
- "Epoch 4/10\n",
- "1250/1250 [==============================] - 1s 519us/step - loss: 4.5895e-04 - mae: 0.0092\n",
- "Epoch 5/10\n",
- "1250/1250 [==============================] - 1s 554us/step - loss: 1.9394e-04 - mae: 0.0063\n",
- "Epoch 6/10\n",
- "1250/1250 [==============================] - 1s 575us/step - loss: 1.0455e-04 - mae: 0.0047\n",
- "Epoch 7/10\n",
- "1250/1250 [==============================] - 1s 543us/step - loss: 6.1987e-05 - mae: 0.0038\n",
- "Epoch 8/10\n",
- "1250/1250 [==============================] - 1s 556us/step - loss: 3.1945e-05 - mae: 0.0030\n",
- "Epoch 9/10\n",
- "1250/1250 [==============================] - 1s 571us/step - loss: 2.4396e-05 - mae: 0.0028\n",
- "Epoch 10/10\n",
- "1250/1250 [==============================] - 1s 562us/step - loss: 2.3492e-05 - mae: 0.0027\n"
- ]
- },
- {
- "data": {
- "text/plain": [
- "\n",
- " Diagram by Michaela Massi, some rights reserved
\n", - "![Michaela Massi](\"https://en.wikipedia.org/wiki/Autoencoder#/media/File:Autoencoder_schema.png\"){kind=link}
\n",
- "\n",
- "\n",
- " \n",
- "
\n",
- "
"
- ],
- "text/plain": [
- " process ... timestamp\n",
- "0 \"c:\\windows\\system32\\rundll32.exe\" c:\\windows\\... ... 2020-09-21 23:31:20\n",
- "\n",
- "[1 rows x 6 columns]"
- ]
- },
- "metadata": {},
- "output_type": "display_data"
- },
- {
- "name": "stdout",
- "output_type": "stream",
- "text": [
- "\n"
- ]
- },
- {
- "data": {
- "text/plain": [
- "| \n", - " | process | \n", - "machine | \n", - "process_name | \n", - "input_event | \n", - "tenant | \n", - "timestamp | \n", - "
|---|---|---|---|---|---|---|
| 0 | \n", - "\"c:\\windows\\system32\\rundll32.exe\" c:\\windows\\... | \n", - "eyJlbnRpdHlUeXBlIjoiREVWSUNFIiwicHJpbWFyeUFydG... | \n", - "rundll32.exe | \n", - "{'_tenant': 'test', '_time': '1600731080000', ... | \n", - "test | \n", - "2020-09-21 23:31:20 | \n", - "
\n",
- "\n",
- "\n",
- " \n",
- "
\n",
- "
"
- ],
- "text/plain": [
- " end_time start_time body entities\n",
- "0 1119 1119 TBD TBD"
- ]
- },
- "metadata": {},
- "output_type": "display_data"
- },
- {
- "name": "stdout",
- "output_type": "stream",
- "text": [
- "\n"
- ]
- },
- {
- "data": {
- "text/plain": [
- "| \n", - " | end_time | \n", - "start_time | \n", - "body | \n", - "entities | \n", - "
|---|---|---|---|---|
| 0 | \n", - "1119 | \n", - "1119 | \n", - "TBD | \n", - "TBD | \n", - "
\n",
- "\n",
- "\n",
- " \n",
- "
\n",
- "
"
- ],
- "text/plain": [
- " end_time start_time body entities\n",
- "0 6 6 TBD TBD\n",
- "1 8 8 TBD TBD"
- ]
- },
- "metadata": {},
- "output_type": "display_data"
- },
- {
- "name": "stdout",
- "output_type": "stream",
- "text": [
- "\n"
- ]
- },
- {
- "data": {
- "text/plain": [
- "| \n", - " | end_time | \n", - "start_time | \n", - "body | \n", - "entities | \n", - "
|---|---|---|---|---|
| 0 | \n", - "6 | \n", - "6 | \n", - "TBD | \n", - "TBD | \n", - "
| 1 | \n", - "8 | \n", - "8 | \n", - "TBD | \n", - "TBD | \n", - "
\n",
- "\n",
- "\n",
- " \n",
- "
\n",
- "
"
- ],
- "text/plain": [
- " end_time start_time body entities probability\n",
- "0 4 4 TBD TBD 0.999498"
- ]
- },
- "metadata": {},
- "output_type": "display_data"
- },
- {
- "name": "stdout",
- "output_type": "stream",
- "text": [
- "\n"
- ]
- },
- {
- "data": {
- "text/plain": [
- "| \n", - " | end_time | \n", - "start_time | \n", - "body | \n", - "entities | \n", - "probability | \n", - "
|---|---|---|---|---|---|
| 0 | \n", - "4 | \n", - "4 | \n", - "TBD | \n", - "TBD | \n", - "0.999498 | \n", - "
\n",
- "\n",
- "\n",
- " \n",
- "
\n",
- "
"
- ],
- "text/plain": [
- " input ... dest_user_id\n",
- "0 7.666667 ... NaN\n",
- "1 1.164725 ... NaN\n",
- "2 1.164228 ... NaN\n",
- "3 1.161742 ... NaN\n",
- "4 1.158295 ... NaN\n",
- "... ... ... ...\n",
- "1799 6.918486 ... NaN\n",
- "1800 8.567270 ... NaN\n",
- "1801 9.991479 ... NaN\n",
- "1802 5.403934 ... NaN\n",
- "1803 0.035648 ... rXYtTmzIXq56PqQ+iNO/xw==\n",
- "\n",
- "[1804 rows x 12 columns]"
- ]
- },
- "metadata": {},
- "output_type": "display_data"
- },
- {
- "name": "stdout",
- "output_type": "stream",
- "text": [
- "\n"
- ]
- },
- {
- "data": {
- "text/plain": [
- "| \n", - " | input | \n", - "start_time | \n", - "dest_device_id | \n", - "entities | \n", - "process_name | \n", - "quantile | \n", - "end_time | \n", - "label | \n", - "parent_process | \n", - "body | \n", - "timestamp | \n", - "dest_user_id | \n", - "
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 0 | \n", - "7.666667 | \n", - "2020-09-24 17:00:13 | \n", - "5gUXDbXvVfgC/FEpZOFUaA== | \n", - "[5gUXDbXvVfgC/FEpZOFUaA==] | \n", - "powershell.exe | \n", - "0.000000 | \n", - "2020-09-24 17:00:13 | \n", - "True | \n", - "c:\\windows\\system32\\cmd.exe | \n", - "TBD | \n", - "2020-09-24 17:00:13 | \n", - "NaN | \n", - "
| 1 | \n", - "1.164725 | \n", - "2020-09-24 17:15:12 | \n", - "5gUXDbXvVfgC/FEpZOFUaA== | \n", - "[5gUXDbXvVfgC/FEpZOFUaA==] | \n", - "cmd.exe | \n", - "0.082919 | \n", - "2020-09-24 17:15:12 | \n", - "True | \n", - "c:\\program files\\splunkforwarderforsplunkinc\\b... | \n", - "TBD | \n", - "2020-09-24 17:15:12 | \n", - "NaN | \n", - "
| 2 | \n", - "1.164228 | \n", - "2020-09-24 17:17:12 | \n", - "5gUXDbXvVfgC/FEpZOFUaA== | \n", - "[5gUXDbXvVfgC/FEpZOFUaA==] | \n", - "cmd.exe | \n", - "0.081037 | \n", - "2020-09-24 17:17:12 | \n", - "True | \n", - "c:\\program files\\splunkforwarderforsplunkinc\\b... | \n", - "TBD | \n", - "2020-09-24 17:17:12 | \n", - "NaN | \n", - "
| 3 | \n", - "1.161742 | \n", - "2020-09-24 17:18:04 | \n", - "IaNYgFTNQvyVmJNuPr58dQ== | \n", - "[IaNYgFTNQvyVmJNuPr58dQ==] | \n", - "cmd.exe | \n", - "0.083721 | \n", - "2020-09-24 17:18:04 | \n", - "True | \n", - "c:\\program files\\splunkforwarderforsplunkinc\\b... | \n", - "TBD | \n", - "2020-09-24 17:18:04 | \n", - "NaN | \n", - "
| 4 | \n", - "1.158295 | \n", - "2020-09-24 17:18:12 | \n", - "5gUXDbXvVfgC/FEpZOFUaA== | \n", - "[5gUXDbXvVfgC/FEpZOFUaA==] | \n", - "cmd.exe | \n", - "0.057663 | \n", - "2020-09-24 17:18:12 | \n", - "True | \n", - "c:\\program files\\splunkforwarderforsplunkinc\\b... | \n", - "TBD | \n", - "2020-09-24 17:18:12 | \n", - "NaN | \n", - "
| ... | \n", - "... | \n", - "... | \n", - "... | \n", - "... | \n", - "... | \n", - "... | \n", - "... | \n", - "... | \n", - "... | \n", - "... | \n", - "... | \n", - "... | \n", - "
| 1799 | \n", - "6.918486 | \n", - "2020-09-25 19:46:23 | \n", - "ZTQ/ltGlScpA4WGbfRJ0Xg== | \n", - "[ZTQ/ltGlScpA4WGbfRJ0Xg==] | \n", - "sc.exe | \n", - "0.000843 | \n", - "2020-09-25 19:46:23 | \n", - "True | \n", - "c:\\windows\\system32\\svchost.exe | \n", - "TBD | \n", - "2020-09-25 19:46:23 | \n", - "NaN | \n", - "
| 1800 | \n", - "8.567270 | \n", - "2020-09-25 16:49:46 | \n", - "lQ+9FBHxYQK/q8qXcrTE9A== | \n", - "[lQ+9FBHxYQK/q8qXcrTE9A==] | \n", - "sc.exe | \n", - "0.000841 | \n", - "2020-09-25 16:49:46 | \n", - "True | \n", - "c:\\windows\\system32\\svchost.exe | \n", - "TBD | \n", - "2020-09-25 16:49:46 | \n", - "NaN | \n", - "
| 1801 | \n", - "9.991479 | \n", - "2020-09-25 16:50:30 | \n", - "IaNYgFTNQvyVmJNuPr58dQ== | \n", - "[IaNYgFTNQvyVmJNuPr58dQ==] | \n", - "sc.exe | \n", - "0.003361 | \n", - "2020-09-25 16:50:30 | \n", - "True | \n", - "c:\\windows\\system32\\svchost.exe | \n", - "TBD | \n", - "2020-09-25 16:50:30 | \n", - "NaN | \n", - "
| 1802 | \n", - "5.403934 | \n", - "2020-09-26 05:00:40 | \n", - "OWUYaWKrJeuOY71+TXoqiw== | \n", - "[OWUYaWKrJeuOY71+TXoqiw==] | \n", - "cmd.exe | \n", - "0.000000 | \n", - "2020-09-26 05:00:40 | \n", - "True | \n", - "c:\\program files\\splunkuniversalforwarder\\bin\\... | \n", - "TBD | \n", - "2020-09-26 05:00:40 | \n", - "NaN | \n", - "
| 1803 | \n", - "0.035648 | \n", - "2020-09-26 05:06:18 | \n", - "OWUYaWKrJeuOY71+TXoqiw== | \n", - "[OWUYaWKrJeuOY71+TXoqiw==, rXYtTmzIXq56PqQ+iNO... | \n", - "cmd.exe | \n", - "0.000000 | \n", - "2020-09-26 05:06:18 | \n", - "True | \n", - "c:\\windows\\system32\\cmd.exe | \n", - "TBD | \n", - "2020-09-26 05:06:18 | \n", - "rXYtTmzIXq56PqQ+iNO/xw== | \n", - "
1804 rows × 12 columns
\n", - "\n",
- "\n",
- "\n",
- " \n",
- "
\n",
- "
"
- ],
- "text/plain": [
- " start_time ... timestamp\n",
- "0 2020-09-14 20:57:28 ... 2020-09-14 20:57:28\n",
- "\n",
- "[1 rows x 9 columns]"
- ]
- },
- "metadata": {},
- "output_type": "display_data"
- },
- {
- "name": "stdout",
- "output_type": "stream",
- "text": [
- "\n"
- ]
- },
- {
- "data": {
- "text/plain": [
- "| \n", - " | start_time | \n", - "cmd_line | \n", - "entities | \n", - "process_name | \n", - "parent_process_name | \n", - "end_time | \n", - "process_path | \n", - "input_event | \n", - "timestamp | \n", - "
|---|---|---|---|---|---|---|---|---|---|
| 0 | \n", - "2020-09-14 20:57:28 | \n", - "-v | \n", - "[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ... | \n", - "cachedump64.exe | \n", - "C:\\Users\\Administrator\\Downloads\\fgdump-2.1.0-... | \n", - "2020-09-14 20:57:28 | \n", - "c:\\users\\admini~1\\appdata\\local\\temp | \n", - "{'_tenant': 'test', '_time': '1600117048000', ... | \n", - "2020-09-14 20:57:28 | \n", - "
\n",
- "\n",
- "\n",
- " \n",
- "
\n",
- "
"
- ],
- "text/plain": [
- " start_time ... timestamp\n",
- "0 2020-09-14 20:57:28 ... 2020-09-14 20:57:28\n",
- "\n",
- "[1 rows x 9 columns]"
- ]
- },
- "metadata": {},
- "output_type": "display_data"
- },
- {
- "name": "stdout",
- "output_type": "stream",
- "text": [
- "\n"
- ]
- },
- {
- "data": {
- "text/plain": [
- "| \n", - " | start_time | \n", - "cmd_line | \n", - "entities | \n", - "process_name | \n", - "parent_process_name | \n", - "end_time | \n", - "process_path | \n", - "input_event | \n", - "timestamp | \n", - "
|---|---|---|---|---|---|---|---|---|---|
| 0 | \n", - "2020-09-14 20:57:28 | \n", - "\"\"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\cachedu... | \n", - "[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ... | \n", - "cachedump64.exe | \n", - "C:\\Windows\\System32\\services.exe | \n", - "2020-09-14 20:57:28 | \n", - "c:\\users\\admini~1\\appdata\\local\\temp | \n", - "{'_tenant': 'test', '_time': '1600117048000', ... | \n", - "2020-09-14 20:57:28 | \n", - "
\n",
- "\n",
- "\n",
- " \n",
- "
\n",
- "
"
- ],
- "text/plain": [
- " start_time ... timestamp\n",
- "0 2020-09-14 20:57:28 ... 2020-09-14 20:57:28\n",
- "\n",
- "[1 rows x 8 columns]"
- ]
- },
- "metadata": {},
- "output_type": "display_data"
- },
- {
- "name": "stdout",
- "output_type": "stream",
- "text": [
- "\n"
- ]
- },
- {
- "data": {
- "text/plain": [
- "| \n", - " | start_time | \n", - "cmd_line | \n", - "entities | \n", - "process_name | \n", - "end_time | \n", - "process_path | \n", - "input_event | \n", - "timestamp | \n", - "
|---|---|---|---|---|---|---|---|---|
| 0 | \n", - "2020-09-14 20:57:28 | \n", - "-v | \n", - "[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ... | \n", - "cachedump64.exe | \n", - "2020-09-14 20:57:28 | \n", - "c:\\users\\admini~1\\appdata\\local\\temp | \n", - "{'_tenant': 'test', '_time': '1600117048000', ... | \n", - "2020-09-14 20:57:28 | \n", - "
\n",
- "\n",
- "\n",
- " \n",
- "
\n",
- "
"
- ],
- "text/plain": [
- " end_time ... timestamp\n",
- "0 2020-09-12 01:25:41 ... 2020-09-12 01:25:41\n",
- "1 2020-09-12 01:25:41 ... 2020-09-12 01:25:41\n",
- "\n",
- "[2 rows x 6 columns]"
- ]
- },
- "metadata": {},
- "output_type": "display_data"
- },
- {
- "name": "stdout",
- "output_type": "stream",
- "text": [
- "\n"
- ]
- },
- {
- "data": {
- "text/plain": [
- "| \n", - " | end_time | \n", - "start_time | \n", - "entities | \n", - "process_name | \n", - "input_event | \n", - "timestamp | \n", - "
|---|---|---|---|---|---|---|
| 0 | \n", - "2020-09-12 01:25:41 | \n", - "2020-09-12 01:25:41 | \n", - "[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ... | \n", - "lazagne.exe | \n", - "{'_tenant': 'test', '_time': '1599873941000', ... | \n", - "2020-09-12 01:25:41 | \n", - "
| 1 | \n", - "2020-09-12 01:25:41 | \n", - "2020-09-12 01:25:41 | \n", - "[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ... | \n", - "lazagne.exe | \n", - "{'_tenant': 'test', '_time': '1599873941000', ... | \n", - "2020-09-12 01:25:41 | \n", - "
\n",
- "\n",
- "\n",
- " \n",
- "
\n",
- "
"
- ],
- "text/plain": [
- " end_time ... timestamp\n",
- "0 2020-09-12 01:25:41 ... 2020-09-12 01:25:41\n",
- "1 2020-09-12 01:25:41 ... 2020-09-12 01:25:41\n",
- "\n",
- "[2 rows x 6 columns]"
- ]
- },
- "metadata": {},
- "output_type": "display_data"
- },
- {
- "name": "stdout",
- "output_type": "stream",
- "text": [
- "\n"
- ]
- },
- {
- "data": {
- "text/plain": [
- "| \n", - " | end_time | \n", - "start_time | \n", - "cmd_line | \n", - "entities | \n", - "input_event | \n", - "timestamp | \n", - "
|---|---|---|---|---|---|---|
| 0 | \n", - "2020-09-12 01:25:41 | \n", - "2020-09-12 01:25:41 | \n", - "lazagne all -oA -output lazDump.txt | \n", - "[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ... | \n", - "{'_tenant': 'test', '_time': '1599873941000', ... | \n", - "2020-09-12 01:25:41 | \n", - "
| 1 | \n", - "2020-09-12 01:25:41 | \n", - "2020-09-12 01:25:41 | \n", - "lazagne all -oA -output lazDump.txt | \n", - "[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ... | \n", - "{'_tenant': 'test', '_time': '1599873941000', ... | \n", - "2020-09-12 01:25:41 | \n", - "
\n",
- "\n",
- "\n",
- " \n",
- "
\n",
- "
"
- ],
- "text/plain": [
- " end_time ... timestamp\n",
- "0 2020-09-17 18:59:05 ... 2020-09-17 18:59:05\n",
- "\n",
- "[1 rows x 6 columns]"
- ]
- },
- "metadata": {},
- "output_type": "display_data"
- },
- {
- "name": "stdout",
- "output_type": "stream",
- "text": [
- "\n"
- ]
- },
- {
- "data": {
- "text/plain": [
- "| \n", - " | end_time | \n", - "start_time | \n", - "cmd_line | \n", - "entities | \n", - "input_event | \n", - "timestamp | \n", - "
|---|---|---|---|---|---|---|
| 0 | \n", - "2020-09-17 18:59:05 | \n", - "2020-09-17 18:59:05 | \n", - "powershell -command \"\"Get-ADDBAccount -All -D... | \n", - "[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ... | \n", - "{'_tenant': 'test', '_time': '1600369145000', ... | \n", - "2020-09-17 18:59:05 | \n", - "
\n",
- "\n",
- "\n",
- " \n",
- "
\n",
- "
"
- ],
- "text/plain": [
- " start_time ... timestamp\n",
- "0 2020-09-14 17:31:20 ... 2020-09-14 17:31:20\n",
- "\n",
- "[1 rows x 7 columns]"
- ]
- },
- "metadata": {},
- "output_type": "display_data"
- },
- {
- "name": "stdout",
- "output_type": "stream",
- "text": [
- "\n"
- ]
- },
- {
- "data": {
- "text/plain": [
- "| \n", - " | start_time | \n", - "cmd_line | \n", - "entities | \n", - "process_name | \n", - "end_time | \n", - "input_event | \n", - "timestamp | \n", - "
|---|---|---|---|---|---|---|---|
| 0 | \n", - "2020-09-14 17:31:20 | \n", - "\"C:\\Program Files (x86)\\Windows Kits\\10\\Debugg... | \n", - "[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ... | \n", - "ntkd.exe | \n", - "2020-09-14 17:31:20 | \n", - "{'_tenant': 'test', '_time': '1600104680000', ... | \n", - "2020-09-14 17:31:20 | \n", - "
\n",
- "\n",
- "\n",
- " \n",
- "
\n",
- "
"
- ],
- "text/plain": [
- " start_time ... timestamp\n",
- "0 2020-09-12 23:25:47 ... 2020-09-12 23:25:47\n",
- "\n",
- "[1 rows x 7 columns]"
- ]
- },
- "metadata": {},
- "output_type": "display_data"
- },
- {
- "name": "stdout",
- "output_type": "stream",
- "text": [
- "\n"
- ]
- },
- {
- "data": {
- "text/plain": [
- "| \n", - " | start_time | \n", - "cmd_line | \n", - "entities | \n", - "process_name | \n", - "end_time | \n", - "input_event | \n", - "timestamp | \n", - "
|---|---|---|---|---|---|---|---|
| 0 | \n", - "2020-09-12 23:25:47 | \n", - "kd.exe -z C:\\Windows\\livekd.dmp | \n", - "[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ... | \n", - "kd.exe | \n", - "2020-09-12 23:25:47 | \n", - "{'_tenant': 'test', '_time': '1599953147000', ... | \n", - "2020-09-12 23:25:47 | \n", - "
\n",
- "\n",
- "\n",
- " \n",
- "
\n",
- "
"
- ],
- "text/plain": [
- " start_time ... timestamp\n",
- "0 2020-09-12 23:25:44 ... 2020-09-12 23:25:44\n",
- "\n",
- "[1 rows x 8 columns]"
- ]
- },
- "metadata": {},
- "output_type": "display_data"
- },
- {
- "name": "stdout",
- "output_type": "stream",
- "text": [
- "\n"
- ]
- },
- {
- "data": {
- "text/plain": [
- "| \n", - " | start_time | \n", - "cmd_line | \n", - "entities | \n", - "process_name | \n", - "parent_process_name | \n", - "end_time | \n", - "input_event | \n", - "timestamp | \n", - "
|---|---|---|---|---|---|---|---|---|
| 0 | \n", - "2020-09-12 23:25:44 | \n", - "\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff... | \n", - "[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ... | \n", - "conhost.exe | \n", - "C:\\Program Files (x86)\\Windows Kits\\10\\Debugge... | \n", - "2020-09-12 23:25:44 | \n", - "{'_tenant': 'test', '_time': '1599953144000', ... | \n", - "2020-09-12 23:25:44 | \n", - "
\n",
- "\n",
- "\n",
- " \n",
- "
\n",
- "
"
- ],
- "text/plain": [
- " end_time ... timestamp\n",
- "0 2020-09-17 18:59:05 ... 2020-09-17 18:59:05\n",
- "1 2020-09-17 18:59:04 ... 2020-09-17 18:59:04\n",
- "2 2020-09-17 18:59:03 ... 2020-09-17 18:59:03\n",
- "\n",
- "[3 rows x 6 columns]"
- ]
- },
- "metadata": {},
- "output_type": "display_data"
- },
- {
- "name": "stdout",
- "output_type": "stream",
- "text": [
- "\n"
- ]
- },
- {
- "data": {
- "text/plain": [
- "| \n", - " | end_time | \n", - "start_time | \n", - "cmd_line | \n", - "entities | \n", - "input_event | \n", - "timestamp | \n", - "
|---|---|---|---|---|---|---|
| 0 | \n", - "2020-09-17 18:59:05 | \n", - "2020-09-17 18:59:05 | \n", - "powershell -command \"\"Import-Module PowerSplo... | \n", - "[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ... | \n", - "{'_tenant': 'test', '_time': '1600369145000', ... | \n", - "2020-09-17 18:59:05 | \n", - "
| 1 | \n", - "2020-09-17 18:59:04 | \n", - "2020-09-17 18:59:04 | \n", - "powershell -command \"\"Install-SSP; Install-Se... | \n", - "[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ... | \n", - "{'_tenant': 'test', '_time': '1600369144000', ... | \n", - "2020-09-17 18:59:04 | \n", - "
| 2 | \n", - "2020-09-17 18:59:03 | \n", - "2020-09-17 18:59:03 | \n", - "powershell -command \"\"Get-IPAddress; Convert-... | \n", - "[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ... | \n", - "{'_tenant': 'test', '_time': '1600369143000', ... | \n", - "2020-09-17 18:59:03 | \n", - "
\n",
- "\n",
- "\n",
- " \n",
- "
\n",
- "
"
- ],
- "text/plain": [
- " start_time ... timestamp\n",
- "0 2020-09-17 18:59:02 ... 2020-09-17 18:59:02\n",
- "\n",
- "[1 rows x 9 columns]"
- ]
- },
- "metadata": {},
- "output_type": "display_data"
- },
- {
- "name": "stdout",
- "output_type": "stream",
- "text": [
- "\n"
- ]
- },
- {
- "data": {
- "text/plain": [
- "| \n", - " | start_time | \n", - "cmd_line | \n", - "entities | \n", - "process_name | \n", - "parent_process_name | \n", - "end_time | \n", - "process_path | \n", - "input_event | \n", - "timestamp | \n", - "
|---|---|---|---|---|---|---|---|---|---|
| 0 | \n", - "2020-09-17 18:59:02 | \n", - "powershell -command \"\"Install-Module DSIntern... | \n", - "[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ... | \n", - "powershell.exe | \n", - "C:\\Windows\\System32\\cmd.exe | \n", - "2020-09-17 18:59:02 | \n", - "c:\\windows\\system32\\windowspowershell\\v1.0 | \n", - "{'_tenant': 'test', '_time': '1600369142000', ... | \n", - "2020-09-17 18:59:02 | \n", - "
\n",
- "\n",
- "\n",
- " \n",
- "
\n",
- "
"
- ],
- "text/plain": [
- " start_time ... timestamp\n",
- "0 2020-09-17 18:59:02 ... 2020-09-17 18:59:02\n",
- "\n",
- "[1 rows x 9 columns]"
- ]
- },
- "metadata": {},
- "output_type": "display_data"
- },
- {
- "name": "stdout",
- "output_type": "stream",
- "text": [
- "\n"
- ]
- },
- {
- "data": {
- "text/plain": [
- "| \n", - " | start_time | \n", - "cmd_line | \n", - "entities | \n", - "process_name | \n", - "parent_process_name | \n", - "end_time | \n", - "process_path | \n", - "input_event | \n", - "timestamp | \n", - "
|---|---|---|---|---|---|---|---|---|---|
| 0 | \n", - "2020-09-17 18:59:02 | \n", - "powershell -command \"\"Install-Module DSIntern... | \n", - "[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ... | \n", - "powershell.exe | \n", - "C:\\Windows\\System32\\cmd.exe | \n", - "2020-09-17 18:59:02 | \n", - "c:\\windows\\system32\\windowspowershell\\v1.0 | \n", - "{'_tenant': 'test', '_time': '1600369142000', ... | \n", - "2020-09-17 18:59:02 | \n", - "
\n",
- "\n",
- "\n",
- " \n",
- "
\n",
- "
"
- ],
- "text/plain": [
- " end_time ... timestamp\n",
- "0 2020-09-11 23:45:19 ... 2020-09-11 23:45:19\n",
- "1 2020-09-11 23:45:21 ... 2020-09-11 23:45:21\n",
- "2 2020-09-11 23:45:17 ... 2020-09-11 23:45:17\n",
- "\n",
- "[3 rows x 6 columns]"
- ]
- },
- "metadata": {},
- "output_type": "display_data"
- },
- {
- "name": "stdout",
- "output_type": "stream",
- "text": [
- "\n"
- ]
- },
- {
- "data": {
- "text/plain": [
- "| \n", - " | end_time | \n", - "start_time | \n", - "cmd_line | \n", - "entities | \n", - "input_event | \n", - "timestamp | \n", - "
|---|---|---|---|---|---|---|
| 0 | \n", - "2020-09-11 23:45:19 | \n", - "2020-09-11 23:45:19 | \n", - "mimikatz \"\"kerberos::ptt kerberos::golden ker... | \n", - "[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ... | \n", - "{'_tenant': 'test', '_time': '1599867919000', ... | \n", - "2020-09-11 23:45:19 | \n", - "
| 1 | \n", - "2020-09-11 23:45:21 | \n", - "2020-09-11 23:45:21 | \n", - "mimikatz \"\"crypto::capi crypto::cng crypto::c... | \n", - "[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ... | \n", - "{'_tenant': 'test', '_time': '1599867921000', ... | \n", - "2020-09-11 23:45:21 | \n", - "
| 2 | \n", - "2020-09-11 23:45:17 | \n", - "2020-09-11 23:45:17 | \n", - "mimikatz \"\"lsadump::sam lsadump::secrets lsa... | \n", - "[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ... | \n", - "{'_tenant': 'test', '_time': '1599867917000', ... | \n", - "2020-09-11 23:45:17 | \n", - "
\n",
- "\n",
- "\n",
- " \n",
- "
\n",
- "
"
- ],
- "text/plain": [
- " eventLine probability\n",
- "0 karem ahmed | \n", - " | eventLine | \n", - "probability | \n", - "
|---|---|---|
| 0 | \n", - "karem ahmed <karemahmed-18@hotmail.fr> PLEA... | \n", - "[0.9720325] | \n", - "
| 1 | \n", - "nkomo robert <nkomo002@5fm.za.com> FAMILY R... | \n", - "[0.9768889] | \n", - "
| 2 | \n", - "Mrs Mariam Taylor <familyboxjanetfamilybo... | \n", - "[0.9780622999999999] | \n", - "
| 3 | \n", - "Mr.Fred Chima <fredi@fastermail.com> busi... | \n", - "[0.97669697] | \n", - "
| 4 | \n", - "Alexander Afadia <eeaesq@123.com> Please repl... | \n", - "[0.9775347999999999] | \n", - "
| ... | \n", - "... | \n", - "... | \n", - "
| 82 | \n", - "Comfort Somba. <comfort_somba11@yahoo.fr> F... | \n", - "[0.97327405] | \n", - "
| 83 | \n", - "bintu pat <pat_bintu004@hotmail.com> TRUSTI... | \n", - "[0.96824765] | \n", - "
| 84 | \n", - "FR RICHARD DAVID <unofice@katamail.com> FRO... | \n", - "[0.96306074] | \n", - "
| 85 | \n", - "<joseph_m333@micasilla.net> Farmers Greetings... | \n", - "[0.97275084] | \n", - "
| 86 | \n", - "MRS. LARISA SOSNITSKAYA <larisasosnkayapawou... | \n", - "[0.9751048999999999] | \n", - "
87 rows × 2 columns
\n", - "\n",
- "\n",
- "\n",
- " \n",
- "
\n",
- "
"
- ],
- "text/plain": [
- " start_time ... timestamp\n",
- "0 2020-10-06 17:13:29 ... 2020-10-06 17:13:29\n",
- "\n",
- "[1 rows x 12 columns]"
- ]
- },
- "metadata": {},
- "output_type": "display_data"
- },
- {
- "name": "stdout",
- "output_type": "stream",
- "text": [
- "\n"
- ]
- },
- {
- "data": {
- "text/plain": [
- "| \n", - " | start_time | \n", - "dest_device_id | \n", - "field0 | \n", - "entities | \n", - "process_name | \n", - "end_time | \n", - "dest_user_id | \n", - "parent_process | \n", - "body | \n", - "value | \n", - "input_event | \n", - "timestamp | \n", - "
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 0 | \n", - "2020-10-06 17:13:29 | \n", - "eyJlbnRpdHlUeXBlIjoiREVWSUNFIiwicHJpbWFyeUFydG... | \n", - "winword.exe | \n", - "[eyJlbnRpdHlUeXBlIjoiREVWSUNFIiwicHJpbWFyeUFyd... | \n", - "cmd.exe | \n", - "2020-10-06 17:13:29 | \n", - "eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZm... | \n", - "c:\\program files\\microsoft office\\winword.exe | \n", - "TBD | \n", - "{\"process_path\":\"c:\\\\windows\\\\system32\",\"proce... | \n", - "{'process_path': 'c:\\windows\\system32', 'proce... | \n", - "2020-10-06 17:13:29 | \n", - "
\n",
- "\n",
- "\n",
- " \n",
- "
\n",
- "
"
- ],
- "text/plain": [
- " start_time window_trigger ... lolbas_counter timestamp\n",
- "0 2020-09-24 17:10:00 1600967399999 ... 7 2020-09-24 17:10:00\n",
- "1 2020-09-24 17:45:00 1600969499999 ... 9 2020-09-24 17:45:00\n",
- "2 2020-09-24 17:55:00 1600970099999 ... 9 2020-09-24 17:55:00\n",
- "3 2020-09-24 18:00:00 1600970399999 ... 9 2020-09-24 18:00:00\n",
- "4 2020-09-24 22:20:00 1600985999999 ... 5 2020-09-24 22:20:00\n",
- "5 2020-09-24 23:30:00 1600990199999 ... 5 2020-09-24 23:30:00\n",
- "6 2020-09-25 14:25:00 1601043899999 ... 12 2020-09-25 14:25:00\n",
- "7 2020-09-26 05:05:00 1601096699999 ... 38 2020-09-26 05:05:00\n",
- "\n",
- "[8 rows x 11 columns]"
- ]
- },
- "metadata": {},
- "output_type": "display_data"
- },
- {
- "name": "stdout",
- "output_type": "stream",
- "text": [
- "\n"
- ]
- },
- {
- "data": {
- "text/plain": [
- "| \n", - " | start_time | \n", - "window_trigger | \n", - "entities | \n", - "quantile | \n", - "end_time | \n", - "window_start | \n", - "label | \n", - "body | \n", - "device | \n", - "lolbas_counter | \n", - "timestamp | \n", - "
|---|---|---|---|---|---|---|---|---|---|---|---|
| 0 | \n", - "2020-09-24 17:10:00 | \n", - "1600967399999 | \n", - "[5gUXDbXvVfgC/FEpZOFUaA==] | \n", - "1 | \n", - "2020-09-24 17:10:00 | \n", - "1600967100000 | \n", - "True | \n", - "TBD | \n", - "5gUXDbXvVfgC/FEpZOFUaA== | \n", - "7 | \n", - "2020-09-24 17:10:00 | \n", - "
| 1 | \n", - "2020-09-24 17:45:00 | \n", - "1600969499999 | \n", - "[5gUXDbXvVfgC/FEpZOFUaA==] | \n", - "1 | \n", - "2020-09-24 17:45:00 | \n", - "1600969200000 | \n", - "True | \n", - "TBD | \n", - "5gUXDbXvVfgC/FEpZOFUaA== | \n", - "9 | \n", - "2020-09-24 17:45:00 | \n", - "
| 2 | \n", - "2020-09-24 17:55:00 | \n", - "1600970099999 | \n", - "[IaNYgFTNQvyVmJNuPr58dQ==] | \n", - "1 | \n", - "2020-09-24 17:55:00 | \n", - "1600969800000 | \n", - "True | \n", - "TBD | \n", - "IaNYgFTNQvyVmJNuPr58dQ== | \n", - "9 | \n", - "2020-09-24 17:55:00 | \n", - "
| 3 | \n", - "2020-09-24 18:00:00 | \n", - "1600970399999 | \n", - "[lQ+9FBHxYQK/q8qXcrTE9A==] | \n", - "1 | \n", - "2020-09-24 18:00:00 | \n", - "1600970100000 | \n", - "True | \n", - "TBD | \n", - "lQ+9FBHxYQK/q8qXcrTE9A== | \n", - "9 | \n", - "2020-09-24 18:00:00 | \n", - "
| 4 | \n", - "2020-09-24 22:20:00 | \n", - "1600985999999 | \n", - "[zMnUW93edd+Q+ovwebxbRw==] | \n", - "1 | \n", - "2020-09-24 22:20:00 | \n", - "1600985700000 | \n", - "True | \n", - "TBD | \n", - "zMnUW93edd+Q+ovwebxbRw== | \n", - "5 | \n", - "2020-09-24 22:20:00 | \n", - "
| 5 | \n", - "2020-09-24 23:30:00 | \n", - "1600990199999 | \n", - "[ZTQ/ltGlScpA4WGbfRJ0Xg==] | \n", - "1 | \n", - "2020-09-24 23:30:00 | \n", - "1600989900000 | \n", - "True | \n", - "TBD | \n", - "ZTQ/ltGlScpA4WGbfRJ0Xg== | \n", - "5 | \n", - "2020-09-24 23:30:00 | \n", - "
| 6 | \n", - "2020-09-25 14:25:00 | \n", - "1601043899999 | \n", - "[lQ+9FBHxYQK/q8qXcrTE9A==] | \n", - "1 | \n", - "2020-09-25 14:25:00 | \n", - "1601043600000 | \n", - "True | \n", - "TBD | \n", - "lQ+9FBHxYQK/q8qXcrTE9A== | \n", - "12 | \n", - "2020-09-25 14:25:00 | \n", - "
| 7 | \n", - "2020-09-26 05:05:00 | \n", - "1601096699999 | \n", - "[OWUYaWKrJeuOY71+TXoqiw==] | \n", - "1 | \n", - "2020-09-26 05:05:00 | \n", - "1601096400000 | \n", - "True | \n", - "TBD | \n", - "OWUYaWKrJeuOY71+TXoqiw== | \n", - "38 | \n", - "2020-09-26 05:05:00 | \n", - "