mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Branch was auto-updated.
This commit is contained in:
pyth0n1c
+3
-1
@@ -140,14 +140,16 @@ def generate_ssa_yaml(detections, TEMPLATE_PATH, OUTPUT_PATH):
|
||||
del d['savedsearch_annotations']
|
||||
|
||||
# add detection test
|
||||
test_file = 'ssa___' + d['name'].lower().replace(" ", "_") + '.test.yml'
|
||||
test_file = 'ssa___' + d['name'].lower().replace(" ", "_").replace("-", "_") + '.test.yml'
|
||||
for file in glob.glob('tests/*/*'):
|
||||
|
||||
if test_file == file.split("/")[-1]:
|
||||
with open(file, 'r') as file:
|
||||
test_yaml = yaml.safe_load(file)
|
||||
d['test'] = test_yaml
|
||||
|
||||
with open(manifest_file, 'w') as file:
|
||||
|
||||
documents = yaml.dump(d, file, sort_keys=True)
|
||||
|
||||
return OUTPUT_PATH
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
name: More than usual number of LOLBAS applications in short time period
|
||||
name: Unusual LOLBAS in short period of time
|
||||
id: 59c0dd70-169c-4900-9a1f-bfcf13302f93
|
||||
version: 2
|
||||
date: '2020-08-25'
|
||||
@@ -58,8 +58,8 @@ tags:
|
||||
- CIS 8
|
||||
confidence: 50
|
||||
context:
|
||||
- source:endpoint
|
||||
- stage: Defense Evasion
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
impact: 50
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
|
||||
Vendored
-7
@@ -1,7 +0,0 @@
|
||||
# Splunk Security Analytics for AWS Content Update
|
||||
|
||||
This subscription service delivers pre-packaged Security Content for use with Splunk Security Analytics for AWS Content. Subscribers get regular updates to help security practitioners more quickly address ongoing and time-sensitive customer problems and threats.
|
||||
|
||||
Requires Splunk Enterprise Security version 4.5 or greater.
|
||||
|
||||
For more information please visit the [Splunk ES Content Update user documentation](https://docs.splunk.com/Documentation/ESSOC).
|
||||
-15
@@ -1,15 +0,0 @@
|
||||
The Analytic Story Details dashboard renders all the details of the content related to a specific analytic story which
|
||||
can be chose via the drop down
|
||||
|
||||
Each analytic story has attributes associated with it and the following:
|
||||
______________________________________________________________________
|
||||
|
||||
|
||||
Analytic Story: name of the analytic story
|
||||
Description ; description of the analytic story
|
||||
Search Name : The name of the searches belonging to the chosen analytic story
|
||||
Search : The search query which looks for an attack pattern corresponding to the analytic story
|
||||
Search Description: The description of the search query
|
||||
Asset Type: The analytic story specifies what asset in the infrastructure may be compromised
|
||||
Category: The category that the search belongs to (malware, vulnerabilities, best practices, abuse)
|
||||
Kill Chain Phase: The kill chain phase of the attack that the search is after.
|
||||
Vendored
-24
@@ -1,24 +0,0 @@
|
||||
The ES_SOC Summary Dashboard provides you a summarized view of the analytic story contents of the ES-SOC app.
|
||||
The dashboard has the following panels gives you following details
|
||||
|
||||
1) Analytic story Summary
|
||||
- Total Analytic Stories : The total number of Analytic stories in the ES-SOC application
|
||||
- Total Searches: The total number of searches in ES-SOC
|
||||
- Searches added last week: Number of searches added to ES-SOC in the last week.
|
||||
|
||||
2) Analytic story Category: This dashboard panel summarizes the categories of the searches that the ES-SOC app contains. The categories of the analytic stories are as follow
|
||||
-Malware: These searches detect specific malware behavior for a particular phase of the attack kill chain. E.g. a malware’s delivery method via email or a malware’s installation behavior via registry key changes
|
||||
-Vulnerability: These searches detect behavior or a signature of a vulnerable software in use. These searches are not designed to replace vulnerability management or scanning systems. The purpose of these searches is to discover a vulnerability through side effects or behaviors.
|
||||
-Abuse: Some actions can be deemed malicious because they are unexpected, violate corporate policy or are significantly different than the actions of other users. E.g. A USB disk that is seen on multiple systems or a user that uploads excessive files to a cloud service or a database query that dumps an entire table
|
||||
-Best Practices: Searches that correspond to specific guidelines from organizations like SANS or OWASP
|
||||
|
||||
3) Kill Chain phases: Every analytic story has one or more searches which look for a certain kind of attack pattern/behavior. These searches have an attribute which essentially tells you what Kill chain phase does the search correspond to.
|
||||
The numbers on the dashboard represents the number of searches correponding to each kill chain phase
|
||||
|
||||
4) Analytic story table: This table gives the user a comprehensive view of some of the details of the analytic story. Some of the listed attributes are:
|
||||
- Analytic Story : The name of the analytic story
|
||||
- Description: The description of the analyttic story
|
||||
- Search names: The name of the searches in each analytic story
|
||||
- Datamodels: The name of the datamodel that the search is querying against.
|
||||
- Technology Examples: This field represent some examples related to the technologies required to populate the datamodels(Nessues, Cisco Firewall,etc)
|
||||
- Kill chain phase: The name of the kill chain phase that the search belongs to
|
||||
-51
@@ -1,51 +0,0 @@
|
||||
######################
|
||||
ESSOC Usage Dashboard#
|
||||
######################
|
||||
|
||||
The ESSOC Usage dashboard is designed to provide high-level insight into the usage of the ES-SOC app. It is suitable for display when providing feedback to the Splunk team or for identifying how the ES-SOC app is being used. This dashboard has two time selectors that work independently - the top time selector determines the search time range for all the single-value. And the lower time selector, determines the time range for the usage table.
|
||||
|
||||
IMPORTANT: The user loading this dashboard must have permission to search the _audit index
|
||||
|
||||
##################
|
||||
#Dashboard panels#
|
||||
##################
|
||||
|
||||
Searches Ran
|
||||
|
||||
The total number of searches in ES-SOC that were executed. This number includes scheduled searches and ad hoc searches run from the search bar using the '| savedsearch <ESSOC search_name> ‘ syntax
|
||||
|
||||
Unique Searches
|
||||
|
||||
The unique/distinct searches executed on the deployment. This is equivalent to the distinct count of searches run in the ES-SOC app.
|
||||
|
||||
Most Run
|
||||
|
||||
The total number of searches in ES-SOC that were executed. This number includes scheduled searches and ad hoc searches run from the search bar using the '| savedsearch <ESSOC search_name> ‘ syntax.
|
||||
|
||||
Ad hoc Searches
|
||||
|
||||
The total number of searches run from the search bar using the '| savedsearch <ESSOC search_name> ‘ syntax.
|
||||
|
||||
Scheduled
|
||||
|
||||
The total number of ESSOC searches run that were scheduled.
|
||||
|
||||
Most Active User
|
||||
|
||||
The user who executed the highest number/count of searches. This calculation includes scheduled searches and ad hoc searches run from the search bar using the '| savedsearch <ESSOC search_name> ‘ syntax.
|
||||
|
||||
Search Run Time (seconds)
|
||||
|
||||
Total run time of all searches executed in seconds. This calculation includes scheduled searches and ad hoc searches run from the search bar using the '| savedsearch <ESSOC search_name> ‘ syntax.
|
||||
|
||||
Average Run Time (seconds)
|
||||
|
||||
Average run time of all searches executed in seconds. This calculation includes scheduled searches and ad hoc searches run from the search bar using the '| savedsearch <ESSOC search_name> ‘ syntax.
|
||||
|
||||
Max Run Time (seconds)
|
||||
|
||||
The run time of the longest running search. This calculation includes scheduled searches and ad hoc searches run from the search bar using the '| savedsearch <ESSOC search_name> ‘ syntax.
|
||||
|
||||
Search summary
|
||||
|
||||
This table provides details on each search that was executed in the ESSOC app.
|
||||
Vendored
-46
@@ -1,46 +0,0 @@
|
||||
{
|
||||
"schemaVersion": "1.0.0",
|
||||
"info": {
|
||||
"title": "Splunk Security Analytics for AWS Content",
|
||||
"id": {
|
||||
"group": null,
|
||||
"name": "DA-ESS_AmazonWebServices_Content",
|
||||
"version": "3.32.0"
|
||||
},
|
||||
"author": [
|
||||
{
|
||||
"name": "Splunk Security Research Team",
|
||||
"email": "research@splunk.com",
|
||||
"company": "Splunk"
|
||||
}
|
||||
],
|
||||
"releaseDate": null,
|
||||
"description": "Explore the Analytic Stories included with Splunk Security Analytics for AWS Content",
|
||||
"classification": {
|
||||
"intendedAudience": null,
|
||||
"categories": [],
|
||||
"developmentStatus": null
|
||||
},
|
||||
"commonInformationModels": null,
|
||||
"license": {
|
||||
"name": null,
|
||||
"text": null,
|
||||
"uri": null
|
||||
},
|
||||
"privacyPolicy": {
|
||||
"name": null,
|
||||
"text": null,
|
||||
"uri": null
|
||||
},
|
||||
"releaseNotes": {
|
||||
"name": null,
|
||||
"text": "./README.md",
|
||||
"uri": null
|
||||
}
|
||||
},
|
||||
"dependencies": null,
|
||||
"tasks": null,
|
||||
"inputGroups": null,
|
||||
"incompatibleApps": null,
|
||||
"platformRequirements": null
|
||||
}
|
||||
-2
@@ -1,2 +0,0 @@
|
||||
### Deprecated since ESCU UI was deprecated and this conf file is no longer in use
|
||||
### Using one single file analyticstories.conf that will be used both by ES and ESCU
|
||||
-804
@@ -1,804 +0,0 @@
|
||||
#############
|
||||
# Automatically generated by generator.py in splunk/security_content
|
||||
# On Date: 2021-12-15T02:51:23 UTC
|
||||
# Author: Splunk Security Research
|
||||
# Contact: research@splunk.com
|
||||
#############
|
||||
|
||||
### STORIES ###
|
||||
|
||||
[analytic_story://AWS IAM Privilege Escalation]
|
||||
category = Cloud Security
|
||||
last_updated = 2021-03-08
|
||||
version = 1
|
||||
references = ["https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/", "https://www.cyberark.com/resources/threat-research-blog/the-cloud-shadow-admin-threat-10-permissions-to-protect", "https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws"]
|
||||
maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}]
|
||||
spec_version = 3
|
||||
searches = ["ESCU - AWS Create Policy Version to allow all resources - Rule", "ESCU - AWS CreateAccessKey - Rule", "ESCU - AWS CreateLoginProfile - Rule", "ESCU - AWS IAM Assume Role Policy Brute Force - Rule", "ESCU - AWS IAM Delete Policy - Rule", "ESCU - AWS IAM Failure Group Deletion - Rule", "ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - AWS SetDefaultPolicyVersion - Rule", "ESCU - AWS UpdateLoginProfile - Rule"]
|
||||
description = This analytic story contains detections that query your AWS Cloudtrail for activities related to privilege escalation.
|
||||
narrative = Amazon Web Services provides a neat feature called Identity and Access Management (IAM) that enables organizations to manage various AWS services and resources in a secure way. All IAM users have roles, groups and policies associated with them which governs and sets permissions to allow a user to access specific restrictions.\
|
||||
However, if these IAM policies are misconfigured and have specific combinations of weak permissions; it can allow attackers to escalate their privileges and further compromise the organization. Rhino Security Labs have published comprehensive blogs detailing various AWS Escalation methods. By using this as an inspiration, Splunk’s research team wants to highlight how these attack vectors look in AWS Cloudtrail logs and provide you with detection queries to uncover these potentially malicious events via this Analytic Story. \
|
||||
|
||||
[analytic_story://AWS Network ACL Activity]
|
||||
category = Cloud Security
|
||||
last_updated = 2018-05-21
|
||||
version = 2
|
||||
references = ["https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Appendix_NACLs.html", "https://aws.amazon.com/blogs/security/how-to-help-prepare-for-ddos-attacks-by-reducing-your-attack-surface/"]
|
||||
maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}]
|
||||
spec_version = 3
|
||||
searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"]
|
||||
description = Monitor your AWS network infrastructure for bad configurations and malicious activity. Investigative searches help you probe deeper, when the facts warrant it.
|
||||
narrative = AWS CloudTrail is an AWS service that helps you enable governance, compliance, and operational/risk auditing of your AWS account. Actions taken by a user, role, or an AWS service are recorded as events in CloudTrail. It is crucial for a company to monitor events and actions taken in the AWS Management Console, AWS Command Line Interface, and AWS SDKs and APIs to ensure that your servers are not vulnerable to attacks. This analytic story contains detection searches that leverage CloudTrail logs from AWS to check for bad configurations and malicious activity in your AWS network access controls.
|
||||
|
||||
[analytic_story://AWS Security Hub Alerts]
|
||||
category = Cloud Security
|
||||
last_updated = 2020-08-04
|
||||
version = 1
|
||||
references = ["https://aws.amazon.com/security-hub/features/"]
|
||||
maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}]
|
||||
spec_version = 3
|
||||
searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task"]
|
||||
description = This story is focused around detecting Security Hub alerts generated from AWS
|
||||
narrative = AWS Security Hub collects and consolidates findings from AWS security services enabled in your environment, such as intrusion detection findings from Amazon GuardDuty, vulnerability scans from Amazon Inspector, S3 bucket policy findings from Amazon Macie, publicly accessible and cross-account resources from IAM Access Analyzer, and resources lacking WAF coverage from AWS Firewall Manager.
|
||||
|
||||
[analytic_story://Cloud Cryptomining]
|
||||
category = Cloud Security
|
||||
last_updated = 2019-10-02
|
||||
version = 1
|
||||
references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
|
||||
maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}]
|
||||
spec_version = 3
|
||||
searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule", "ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"]
|
||||
description = Monitor your cloud compute instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or compute instances started by previously unseen users are just a few examples of potentially malicious behavior.
|
||||
narrative = Cryptomining is an intentionally difficult, resource-intensive business. Its complexity was designed into the process to ensure that the number of blocks mined each day would remain steady. So, it's par for the course that ambitious, but unscrupulous, miners make amassing the computing power of large enterprises--a practice known as cryptojacking--a top priority. \
|
||||
Cryptojacking has attracted an increasing amount of media attention since its explosion in popularity in the fall of 2017. The attacks have moved from in-browser exploits and mobile phones to enterprise cloud services, such as Amazon Web Services (AWS), Google Cloud Platform (GCP), and Azure. It's difficult to determine exactly how widespread the practice has become, since bad actors continually evolve their ability to escape detection, including employing unlisted endpoints, moderating their CPU usage, and hiding the mining pool's IP address behind a free CDN. \
|
||||
When malicious miners appropriate a cloud instance, often spinning up hundreds of new instances, the costs can become astronomical for the account holder. So it is critically important to monitor your systems for suspicious activities that could indicate that your network has been infiltrated. \
|
||||
This Analytic Story is focused on detecting suspicious new instances in your cloud environment to help prevent cryptominers from gaining a foothold. It contains detection searches that will detect when a previously unused instance type or AMI is used. It also contains support searches to build lookup files to ensure proper execution of the detection searches.
|
||||
|
||||
[analytic_story://Cloud Federated Credential Abuse]
|
||||
category = Cloud Security
|
||||
last_updated = 2021-01-26
|
||||
version = 1
|
||||
references = ["https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps", "https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf", "https://us-cert.cisa.gov/ncas/alerts/aa21-008a"]
|
||||
maintainers = [{"company": "Splunk", "email": "-", "name": "Rod Soto"}]
|
||||
spec_version = 3
|
||||
searches = ["ESCU - AWS SAML Access by Provider User and Principal - Rule", "ESCU - AWS SAML Update identity provider - Rule", "ESCU - O365 Add App Role Assignment Grant User - Rule", "ESCU - O365 Added Service Principal - Rule", "ESCU - O365 Excessive SSO logon errors - Rule", "ESCU - O365 New Federated Domain Added - Rule"]
|
||||
description = This analytical story addresses events that indicate abuse of cloud federated credentials. These credentials are usually extracted from endpoint desktop or servers specially those servers that provide federation services such as Windows Active Directory Federation Services. Identity Federation relies on objects such as Oauth2 tokens, cookies or SAML assertions in order to provide seamless access between cloud and perimeter environments. If these objects are either hijacked or forged then attackers will be able to pivot into victim's cloud environements.
|
||||
narrative = This story is composed of detection searches based on endpoint that addresses the use of Mimikatz, Escalation of Privileges and Abnormal processes that may indicate the extraction of Federated directory objects such as passwords, Oauth2 tokens, certificates and keys. Cloud environment (AWS, Azure) related events are also addressed in specific cloud environment detection searches.
|
||||
|
||||
[analytic_story://Office 365 Detections]
|
||||
category = Cloud Security
|
||||
last_updated = 2020-12-16
|
||||
version = 1
|
||||
references = ["https://i.blackhat.com/USA-20/Thursday/us-20-Bienstock-My-Cloud-Is-APTs-Cloud-Investigating-And-Defending-Office-365.pdf"]
|
||||
maintainers = [{"company": "Splunk", "email": "-", "name": "Patrick Bareiss"}]
|
||||
spec_version = 3
|
||||
searches = ["ESCU - O365 Add App Role Assignment Grant User - Rule", "ESCU - O365 Added Service Principal - Rule", "ESCU - O365 Bypass MFA via Trusted IP - Rule", "ESCU - O365 Disable MFA - Rule", "ESCU - O365 Excessive Authentication Failures Alert - Rule", "ESCU - O365 Excessive SSO logon errors - Rule", "ESCU - O365 New Federated Domain Added - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious Rights Delegation - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule"]
|
||||
description = This story is focused around detecting Office 365 Attacks.
|
||||
narrative = More and more companies are using Microsofts Office 365 cloud offering. Therefore, we see more and more attacks against Office 365. This story provides various detections for Office 365 attacks.
|
||||
|
||||
[analytic_story://Ransomware Cloud]
|
||||
category = Malware
|
||||
last_updated = 2020-10-27
|
||||
version = 1
|
||||
references = ["https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/", "https://github.com/d1vious/git-wild-hunt", "https://www.youtube.com/watch?v=PgzNib37g0M"]
|
||||
maintainers = [{"company": "David Dorsey, Splunk", "email": "-", "name": "Rod Soto"}]
|
||||
spec_version = 3
|
||||
searches = ["ESCU - AWS Detect Users creating keys with encrypt policy without MFA - Rule", "ESCU - AWS Detect Users with KMS keys performing encryption S3 - Rule"]
|
||||
description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware. These searches include cloud related objects that may be targeted by malicious actors via cloud providers own encryption features.
|
||||
narrative = Ransomware is an ever-present risk to the enterprise, wherein an infected host encrypts business-critical data, holding it hostage until the victim pays the attacker a ransom. There are many types and varieties of ransomware that can affect an enterprise.Cloud ransomware can be deployed by obtaining high privilege credentials from targeted users or resources.
|
||||
|
||||
[analytic_story://Suspicious AWS Login Activities]
|
||||
category = Cloud Security
|
||||
last_updated = 2019-05-01
|
||||
version = 1
|
||||
references = ["https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html"]
|
||||
maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}]
|
||||
spec_version = 3
|
||||
searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"]
|
||||
description = Monitor your AWS authentication events using your CloudTrail logs. Searches within this Analytic Story will help you stay aware of and investigate suspicious logins.
|
||||
narrative = It is important to monitor and control who has access to your AWS infrastructure. Detecting suspicious logins to your AWS infrastructure will provide good starting points for investigations. Abusive behaviors caused by compromised credentials can lead to direct monetary costs, as you will be billed for any EC2 instances created by the attacker.
|
||||
|
||||
[analytic_story://Suspicious AWS S3 Activities]
|
||||
category = Cloud Security
|
||||
last_updated = 2018-07-24
|
||||
version = 2
|
||||
references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://www.tripwire.com/state-of-security/security-data-protection/cloud/public-aws-s3-buckets-writable/"]
|
||||
maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}]
|
||||
spec_version = 3
|
||||
searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Detect New Open S3 Buckets over AWS CLI - Rule", "ESCU - Detect New Open S3 buckets - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS S3 Bucket details via bucketName - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"]
|
||||
description = Use the searches in this Analytic Story to monitor your AWS S3 buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open S3 buckets and buckets being accessed from a new IP. The contextual and investigative searches will give you more information, when required.
|
||||
narrative = As cloud computing has exploded, so has the number of creative attacks on virtual environments. And as the number-two cloud-service provider, Amazon Web Services (AWS) has certainly had its share.\
|
||||
Amazon's "shared responsibility" model dictates that the company has responsibility for the environment outside of the VM and the customer is responsible for the security inside of the S3 container. As such, it's important to stay vigilant for activities that may belie suspicious behavior inside of your environment.\
|
||||
Among things to look out for are S3 access from unfamiliar locations and by unfamiliar users. Some of the searches in this Analytic Story help you detect suspicious behavior and others help you investigate more deeply, when the situation warrants.
|
||||
|
||||
[analytic_story://Suspicious Cloud Authentication Activities]
|
||||
category = Cloud Security
|
||||
last_updated = 2020-06-04
|
||||
version = 1
|
||||
references = ["https://aws.amazon.com/blogs/security/aws-cloudtrail-now-tracks-cross-account-activity-to-its-origin/", "https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html"]
|
||||
maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}]
|
||||
spec_version = 3
|
||||
searches = ["ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule", "ESCU - Detect AWS Console Login by New User - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - Investigate AWS User Activities by user field - Response Task"]
|
||||
description = Monitor your cloud authentication events. Searches within this Analytic Story leverage the recent cloud updates to the Authentication data model to help you stay aware of and investigate suspicious login activity.
|
||||
narrative = It is important to monitor and control who has access to your cloud infrastructure. Detecting suspicious logins will provide good starting points for investigations. Abusive behaviors caused by compromised credentials can lead to direct monetary costs, as you will be billed for any compute activity whether legitimate or otherwise.\
|
||||
This Analytic Story has data model versions of cloud searches leveraging Authentication data, including those looking for suspicious login activity, and cross-account activity for AWS.
|
||||
|
||||
[analytic_story://Suspicious Cloud Instance Activities]
|
||||
category = Cloud Security
|
||||
last_updated = 2020-08-25
|
||||
version = 1
|
||||
references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
|
||||
maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}]
|
||||
spec_version = 3
|
||||
searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"]
|
||||
description = Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment.
|
||||
narrative = Monitoring your cloud infrastructure logs allows you enable governance, compliance, and risk auditing. It is crucial for a company to monitor events and actions taken in the their cloud environments to ensure that your instances are not vulnerable to attacks. This Analytic Story identifies suspicious activities in your cloud compute instances and helps you respond and investigate those activities.
|
||||
|
||||
[analytic_story://Suspicious Cloud Provisioning Activities]
|
||||
category = Cloud Security
|
||||
last_updated = 2018-08-20
|
||||
version = 1
|
||||
references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
|
||||
maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}]
|
||||
spec_version = 3
|
||||
searches = ["ESCU - Cloud Provisioning Activity From Previously Unseen City - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Country - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen IP Address - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Region - Rule"]
|
||||
description = Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment.
|
||||
narrative = Because most enterprise cloud infrastructure activities originate from familiar geographic locations, monitoring for activity from unknown or unusual regions is an important security measure. This indicator can be especially useful in environments where it is impossible to add specific IPs to an allow list because they vary.\
|
||||
This Analytic Story was designed to provide you with flexibility in the precision you employ in specifying legitimate geographic regions. It can be as specific as an IP address or a city, or as broad as a region (think state) or an entire country. By determining how precise you want your geographical locations to be and monitoring for new locations that haven't previously accessed your environment, you can detect adversaries as they begin to probe your environment. Since there are legitimate reasons for activities from unfamiliar locations, this is not a standalone indicator. Nevertheless, location can be a relevant piece of information that you may wish to investigate further.
|
||||
|
||||
[analytic_story://Suspicious Cloud User Activities]
|
||||
category = Cloud Security
|
||||
last_updated = 2020-09-04
|
||||
version = 1
|
||||
references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://redlock.io/blog/cryptojacking-tesla"]
|
||||
maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}]
|
||||
spec_version = 3
|
||||
searches = ["ESCU - AWS IAM AccessDenied Discovery Events - Rule", "ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule", "ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule", "ESCU - Cloud API Calls From Previously Unseen User Roles - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"]
|
||||
description = Detect and investigate suspicious activities by users and roles in your cloud environments.
|
||||
narrative = It seems obvious that it is critical to monitor and control the users who have access to your cloud infrastructure. Nevertheless, it's all too common for enterprises to lose track of ad-hoc accounts, leaving their servers vulnerable to attack. In fact, this was the very oversight that led to Tesla's cryptojacking attack in February, 2018.\
|
||||
In addition to compromising the security of your data, when bad actors leverage your compute resources, it can incur monumental costs, since you will be billed for any new instances and increased bandwidth usage.
|
||||
|
||||
### END STORIES ###
|
||||
|
||||
### DETECTIONS ###
|
||||
|
||||
[savedsearch://ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule]
|
||||
type = detection
|
||||
asset_type = AWS Instance
|
||||
confidence = medium
|
||||
explanation = This search will detect a spike in the number of API calls made to your cloud infrastructure environment by a user.
|
||||
how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Infrastructure API Calls Per User` to create the probability density function.
|
||||
annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.CM", "PR.AC"]}
|
||||
known_false_positives =
|
||||
providing_technologies = []
|
||||
|
||||
[savedsearch://ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule]
|
||||
type = detection
|
||||
asset_type = AWS Instance
|
||||
confidence = medium
|
||||
explanation = This search will detect a spike in the number of API calls made to your cloud infrastructure environment about security groups by a user.
|
||||
how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Security Group API Calls Per User` to create the probability density function model.
|
||||
annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.CM", "PR.AC"]}
|
||||
known_false_positives =
|
||||
providing_technologies = []
|
||||
|
||||
[savedsearch://ESCU - AWS Create Policy Version to allow all resources - Rule]
|
||||
type = detection
|
||||
asset_type = AWS Account
|
||||
confidence = medium
|
||||
explanation = This search looks for AWS CloudTrail events where a user created a policy version that allows them to access any resource in their account
|
||||
how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
|
||||
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
|
||||
known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a policy to allow a user to access all resources. That said, AWS strongly advises against granting full control to all AWS resources
|
||||
providing_technologies = []
|
||||
|
||||
[savedsearch://ESCU - AWS CreateAccessKey - Rule]
|
||||
type = detection
|
||||
asset_type = AWS Account
|
||||
confidence = medium
|
||||
explanation = This search looks for AWS CloudTrail events where a user A who has already permission to create access keys, makes an API call to create access keys for another user B. Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B)
|
||||
how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
|
||||
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.003", "T1136"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
|
||||
known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created keys for another user.
|
||||
providing_technologies = []
|
||||
|
||||
[savedsearch://ESCU - AWS CreateLoginProfile - Rule]
|
||||
type = detection
|
||||
asset_type = AWS Account
|
||||
confidence = medium
|
||||
explanation = This search looks for AWS CloudTrail events where a user A(victim A) creates a login profile for user B, followed by a AWS Console login event from user B from the same src_ip as user B. This correlated event can be indicative of privilege escalation since both events happened from the same src_ip
|
||||
how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
|
||||
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.003", "T1136"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
|
||||
known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a login profile for another user.
|
||||
providing_technologies = []
|
||||
|
||||
[savedsearch://ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule]
|
||||
type = detection
|
||||
asset_type = AWS Instance
|
||||
confidence = medium
|
||||
explanation = This search looks for AssumeRole events where an IAM role in a different account is requested for the first time.
|
||||
how_to_implement = You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search `Previously Seen AWS Cross Account Activity - Initial` to build the initial table of source IP address, geographic locations, and times. You must also enable the second baseline search `Previously Seen AWS Cross Account Activity - Update` to keep this table up to date and to age out old data. You can also provide additional filtering for this search by customizing the `aws_cross_account_activity_from_previously_unseen_account_filter` macro.
|
||||
annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.AC", "PR.DS", "DE.AE"]}
|
||||
known_false_positives = Using multiple AWS accounts and roles is perfectly valid behavior. It's suspicious when an account requests privileges of an account it hasn't before. You should validate with the account owner that this is a legitimate request.
|
||||
providing_technologies = []
|
||||
|
||||
[savedsearch://ESCU - AWS Detect Users creating keys with encrypt policy without MFA - Rule]
|
||||
type = detection
|
||||
asset_type = AWS Account
|
||||
confidence = medium
|
||||
explanation = This search provides detection of KMS keys where action kms:Encrypt is accessible for everyone (also outside of your organization). This is an indicator that your account is compromised and the attacker uses the encryption key to compromise another company.
|
||||
how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs
|
||||
annotations = {"mitre_attack": ["T1486"]}
|
||||
known_false_positives = unknown
|
||||
providing_technologies = []
|
||||
|
||||
[savedsearch://ESCU - AWS Detect Users with KMS keys performing encryption S3 - Rule]
|
||||
type = detection
|
||||
asset_type = S3 Bucket
|
||||
confidence = medium
|
||||
explanation = This search provides detection of users with KMS keys performing encryption specifically against S3 buckets.
|
||||
how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs
|
||||
annotations = {"mitre_attack": ["T1486"]}
|
||||
known_false_positives = bucket with S3 encryption
|
||||
providing_technologies = []
|
||||
|
||||
[savedsearch://ESCU - AWS Excessive Security Scanning - Rule]
|
||||
type = detection
|
||||
asset_type = AWS Account
|
||||
confidence = medium
|
||||
explanation = This search looks for AWS CloudTrail events and analyse the amount of eventNames which starts with Describe by a single user. This indicates that this user scans the configuration of your AWS cloud environment.
|
||||
how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
|
||||
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1526"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
|
||||
known_false_positives = While this search has no known false positives.
|
||||
providing_technologies = []
|
||||
|
||||
[savedsearch://ESCU - AWS IAM AccessDenied Discovery Events - Rule]
|
||||
type = detection
|
||||
asset_type =
|
||||
confidence = medium
|
||||
explanation = The following detection identifies excessive AccessDenied events within an hour timeframe. It is possible that an access key to AWS may have been stolen and is being misused to perform discovery events. In these instances, the access is not available with the key stolen therefore these events will be generated.
|
||||
how_to_implement = The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs.
|
||||
annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1580"]}
|
||||
known_false_positives = It is possible to start this detection will need to be tuned by source IP or user. In addition, change the count values to an upper threshold to restrict false positives.
|
||||
providing_technologies = []
|
||||
|
||||
[savedsearch://ESCU - AWS IAM Assume Role Policy Brute Force - Rule]
|
||||
type = detection
|
||||
asset_type =
|
||||
confidence = medium
|
||||
explanation = The following detection identifies any malformed policy document exceptions with a status of `failure`. A malformed policy document exception occurs in instances where roles are attempted to be assumed, or brute forced. In a brute force attempt, using a tool like CloudSploit or Pacu, an attempt will look like `arn:aws:iam::111111111111:role/aws-service-role/rds.amazonaws.com/AWSServiceRoleForRDS`. Meaning, when an adversary is attempting to identify a role name, multiple failures will occur. This detection focuses on the errors of a remote attempt that is failing.
|
||||
how_to_implement = The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs. Set the `where count` greater than a value to identify suspicious activity in your environment.
|
||||
annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1580", "T1110"]}
|
||||
known_false_positives = This detection will require tuning to provide high fidelity detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) or by groups of users.
|
||||
providing_technologies = []
|
||||
|
||||
[savedsearch://ESCU - AWS IAM Delete Policy - Rule]
|
||||
type = detection
|
||||
asset_type =
|
||||
confidence = medium
|
||||
explanation = The following detection identifes when a policy is deleted on AWS. This does not identify whether successful or failed, but the error messages tell a story of suspicious attempts. There is a specific process to follow when deleting a policy. First, detach the policy from all users, groups, and roles that the policy is attached to, using DetachUserPolicy , DetachGroupPolicy , or DetachRolePolicy.
|
||||
how_to_implement = The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs.
|
||||
annotations = {"kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1098"]}
|
||||
known_false_positives = This detection will require tuning to provide high fidelity detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) or by groups of users. Not every user with AWS access should have permission to delete policies (least privilege). In addition, this may be saved seperately and tuned for failed or success attempts only.
|
||||
providing_technologies = []
|
||||
|
||||
[savedsearch://ESCU - AWS IAM Failure Group Deletion - Rule]
|
||||
type = detection
|
||||
asset_type =
|
||||
confidence = medium
|
||||
explanation = This detection identifies failure attempts to delete groups. We want to identify when a group is attempting to be deleted, but either access is denied, there is a conflict or there is no group. This is indicative of administrators performing an action, but also could be suspicious behavior occurring. Review parallel IAM events - recently added users, new groups and so forth.
|
||||
how_to_implement = The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs.
|
||||
annotations = {"kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1098"]}
|
||||
known_false_positives = This detection will require tuning to provide high fidelity detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) or by groups of users. Not every user with AWS access should have permission to delete groups (least privilege).
|
||||
providing_technologies = []
|
||||
|
||||
[savedsearch://ESCU - AWS IAM Successful Group Deletion - Rule]
|
||||
type = detection
|
||||
asset_type =
|
||||
confidence = medium
|
||||
explanation = The following query uses IAM events to track the success of a group being deleted on AWS. This is typically not indicative of malicious behavior, but a precurser to additional events thay may unfold. Review parallel IAM events - recently added users, new groups and so forth. Inversely, review failed attempts in a similar manner.
|
||||
how_to_implement = The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs.
|
||||
annotations = {"kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1069.003", "T1098", "T1069"]}
|
||||
known_false_positives = This detection will require tuning to provide high fidelity detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) or by groups of users. Not every user with AWS access should have permission to delete groups (least privilege).
|
||||
providing_technologies = []
|
||||
|
||||
[savedsearch://ESCU - AWS Network Access Control List Created with All Open Ports - Rule]
|
||||
type = detection
|
||||
asset_type = AWS Instance
|
||||
confidence = medium
|
||||
explanation = The search looks for AWS CloudTrail events to detect if any network ACLs were created with all the ports open to a specified CIDR.
|
||||
how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS, version 4.4.0 or later, and configure your AWS CloudTrail inputs.
|
||||
annotations = {"cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.007", "T1562"], "nist": ["DE.DP", "DE.AE"]}
|
||||
known_false_positives = It's possible that an admin has created this ACL with all ports open for some legitimate purpose however, this should be scoped and not allowed in production environment.
|
||||
providing_technologies = []
|
||||
|
||||
[savedsearch://ESCU - AWS Network Access Control List Deleted - Rule]
|
||||
type = detection
|
||||
asset_type = AWS Instance
|
||||
confidence = medium
|
||||
explanation = Enforcing network-access controls is one of the defensive mechanisms used by cloud administrators to restrict access to a cloud instance. After the attacker has gained control of the AWS console by compromising an admin account, they can delete a network ACL and gain access to the instance from anywhere. This search will query the AWS CloudTrail logs to detect users deleting network ACLs.
|
||||
how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs.
|
||||
annotations = {"cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.007", "T1562"], "nist": ["DE.DP", "DE.AE"]}
|
||||
known_false_positives = It's possible that a user has legitimately deleted a network ACL.
|
||||
providing_technologies = []
|
||||
|
||||
[savedsearch://ESCU - AWS SAML Access by Provider User and Principal - Rule]
|
||||
type = detection
|
||||
asset_type = AWS Federated Account
|
||||
confidence = medium
|
||||
explanation = This search provides specific SAML access from specific Service Provider, user and targeted principal at AWS. This search provides specific information to detect abnormal access or potential credential hijack or forgery, specially in federated environments using SAML protocol inside the perimeter or cloud provider.
|
||||
how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs
|
||||
annotations = {"mitre_attack": ["T1078"]}
|
||||
known_false_positives = Attacks using a Golden SAML or SAML assertion hijacks or forgeries are very difficult to detect as accessing cloud providers with these assertions looks exactly like normal access, however things such as source IP sourceIPAddress user, and principal targeted at receiving cloud provider along with endpoint credential access and abuse detection searches can provide the necessary context to detect these attacks.
|
||||
providing_technologies = []
|
||||
|
||||
[savedsearch://ESCU - AWS SAML Update identity provider - Rule]
|
||||
type = detection
|
||||
asset_type = AWS Federated Account
|
||||
confidence = medium
|
||||
explanation = This search provides detection of updates to SAML provider in AWS. Updates to SAML provider need to be monitored closely as they may indicate possible perimeter compromise of federated credentials, or backdoor access from another cloud provider set by attacker.
|
||||
how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
|
||||
annotations = {"mitre_attack": ["T1078"]}
|
||||
known_false_positives = Updating a SAML provider or creating a new one may not necessarily be malicious however it needs to be closely monitored.
|
||||
providing_technologies = []
|
||||
|
||||
[savedsearch://ESCU - AWS SetDefaultPolicyVersion - Rule]
|
||||
type = detection
|
||||
asset_type = AWS Account
|
||||
confidence = medium
|
||||
explanation = This search looks for AWS CloudTrail events where a user has set a default policy versions. Attackers have been know to use this technique for Privilege Escalation in case the previous versions of the policy had permissions to access more resources than the current version of the policy
|
||||
how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
|
||||
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
|
||||
known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately set a default policy to allow a user to access all resources. That said, AWS strongly advises against granting full control to all AWS resources
|
||||
providing_technologies = []
|
||||
|
||||
[savedsearch://ESCU - AWS UpdateLoginProfile - Rule]
|
||||
type = detection
|
||||
asset_type = AWS Account
|
||||
confidence = medium
|
||||
explanation = This search looks for AWS CloudTrail events where a user A who has already permission to update login profile, makes an API call to update login profile for another user B . Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B)
|
||||
how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
|
||||
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.003", "T1136"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
|
||||
known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created keys for another user.
|
||||
providing_technologies = []
|
||||
|
||||
[savedsearch://ESCU - Cloud API Calls From Previously Unseen User Roles - Rule]
|
||||
type = detection
|
||||
asset_type = AWS Instance
|
||||
confidence = medium
|
||||
explanation = This search looks for new commands from each user role.
|
||||
how_to_implement = You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search `Previously Seen Cloud API Calls Per User Role - Initial` to build the initial table of user roles, commands, and times. You must also enable the second baseline search `Previously Seen Cloud API Calls Per User Role - Update` to keep this table up to date and to age out old data. You can adjust the time window for this search by updating the `cloud_api_calls_from_previously_unseen_user_roles_activity_window` macro. You can also provide additional filtering for this search by customizing the `cloud_api_calls_from_previously_unseen_user_roles_filter`
|
||||
annotations = {"cis20": ["CIS 1"], "mitre_attack": ["T1078"], "nist": ["ID.AM"]}
|
||||
known_false_positives = .
|
||||
providing_technologies = []
|
||||
|
||||
[savedsearch://ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule]
|
||||
type = detection
|
||||
asset_type = Cloud Compute Instance
|
||||
confidence = medium
|
||||
explanation = This search looks for cloud compute instances created by users who have not created them before.
|
||||
how_to_implement = You must be ingesting the appropriate cloud-infrastructure logs Run the "Previously Seen Cloud Compute Creations By User" support search to create of baseline of previously seen users.
|
||||
annotations = {"cis20": ["CIS 1"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["ID.AM"]}
|
||||
known_false_positives = It's possible that a user will start to create compute instances for the first time, for any number of reasons. Verify with the user launching instances that this is the intended behavior.
|
||||
providing_technologies = []
|
||||
|
||||
[savedsearch://ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule]
|
||||
type = detection
|
||||
asset_type = Cloud Compute Instance
|
||||
confidence = medium
|
||||
explanation = This search looks at cloud-infrastructure events where an instance is created in any region within the last hour and then compares it to a lookup file of previously seen regions where instances have been created.
|
||||
how_to_implement = You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search `Previously Seen Cloud Regions - Initial` to build the initial table of images observed and times. You must also enable the second baseline search `Previously Seen Cloud Regions - Update` to keep this table up to date and to age out old data. You can also provide additional filtering for this search by customizing the `cloud_compute_instance_created_in_previously_unused_region_filter` macro.
|
||||
annotations = {"cis20": ["CIS 12"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]}
|
||||
known_false_positives = It's possible that a user has unknowingly started an instance in a new region. Please verify that this activity is legitimate.
|
||||
providing_technologies = []
|
||||
|
||||
[savedsearch://ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule]
|
||||
type = detection
|
||||
asset_type = Cloud Compute Instance
|
||||
confidence = medium
|
||||
explanation = This search looks for cloud compute instances being created with previously unseen image IDs.
|
||||
how_to_implement = You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search `Previously Seen Cloud Compute Images - Initial` to build the initial table of images observed and times. You must also enable the second baseline search `Previously Seen Cloud Compute Images - Update` to keep this table up to date and to age out old data. You can also provide additional filtering for this search by customizing the `cloud_compute_instance_created_with_previously_unseen_image_filter` macro.
|
||||
annotations = {"cis20": ["CIS 1"], "nist": ["ID.AM"]}
|
||||
known_false_positives = After a new image is created, the first systems created with that image will cause this alert to fire. Verify that the image being used was created by a legitimate user.
|
||||
providing_technologies = []
|
||||
|
||||
[savedsearch://ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule]
|
||||
type = detection
|
||||
asset_type = Cloud Compute Instance
|
||||
confidence = medium
|
||||
explanation = Find EC2 instances being created with previously unseen instance types.
|
||||
how_to_implement = You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search `Previously Seen Cloud Compute Instance Types - Initial` to build the initial table of instance types observed and times. You must also enable the second baseline search `Previously Seen Cloud Compute Instance Types - Update` to keep this table up to date and to age out old data. You can also provide additional filtering for this search by customizing the `cloud_compute_instance_created_with_previously_unseen_instance_type_filter` macro.
|
||||
annotations = {"cis20": ["CIS 1"], "nist": ["ID.AM"]}
|
||||
known_false_positives = It is possible that an admin will create a new system using a new instance type that has never been used before. Verify with the creator that they intended to create the system with the new instance type.
|
||||
providing_technologies = []
|
||||
|
||||
[savedsearch://ESCU - Cloud Instance Modified By Previously Unseen User - Rule]
|
||||
type = detection
|
||||
asset_type = AWS Instance
|
||||
confidence = medium
|
||||
explanation = This search looks for cloud instances being modified by users who have not previously modified them.
|
||||
how_to_implement = This search has a dependency on other searches to create and update a baseline of users observed to be associated with this activity. The search "Previously Seen Cloud Instance Modifications By User - Update" should be enabled for this detection to properly work.
|
||||
annotations = {"cis20": ["CIS 1"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["ID.AM"]}
|
||||
known_false_positives = It's possible that a new user will start to modify EC2 instances when they haven't before for any number of reasons. Verify with the user that is modifying instances that this is the intended behavior.
|
||||
providing_technologies = []
|
||||
|
||||
[savedsearch://ESCU - Cloud Provisioning Activity From Previously Unseen City - Rule]
|
||||
type = detection
|
||||
asset_type = AWS Instance
|
||||
confidence = medium
|
||||
explanation = This search looks for cloud provisioning activities from previously unseen cities. Provisioning activities are defined broadly as any event that runs or creates something.
|
||||
how_to_implement = You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search `Previously Seen Cloud Provisioning Activity Sources - Initial` to build the initial table of source IP address, geographic locations, and times. You must also enable the second baseline search `Previously Seen Cloud Provisioning Activity Sources - Update` to keep this table up to date and to age out old data. You can adjust the time window for this search by updating the `previously_unseen_cloud_provisioning_activity_window` macro. You can also provide additional filtering for this search by customizing the `cloud_provisioning_activity_from_previously_unseen_city_filter` macro.
|
||||
annotations = {"cis20": ["CIS 1"], "mitre_attack": ["T1078"], "nist": ["ID.AM"]}
|
||||
known_false_positives = This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching within, plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.\
|
||||
This search will fire any time a new IP address is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you.
|
||||
providing_technologies = []
|
||||
|
||||
[savedsearch://ESCU - Cloud Provisioning Activity From Previously Unseen Country - Rule]
|
||||
type = detection
|
||||
asset_type = AWS Instance
|
||||
confidence = medium
|
||||
explanation = This search looks for cloud provisioning activities from previously unseen countries. Provisioning activities are defined broadly as any event that runs or creates something.
|
||||
how_to_implement = You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search `Previously Seen Cloud Provisioning Activity Sources - Initial` to build the initial table of source IP address, geographic locations, and times. You must also enable the second baseline search `Previously Seen Cloud Provisioning Activity Sources - Update` to keep this table up to date and to age out old data. You can adjust the time window for this search by updating the `previously_unseen_cloud_provisioning_activity_window` macro. You can also provide additional filtering for this search by customizing the `cloud_provisioning_activity_from_previously_unseen_country_filter` macro.
|
||||
annotations = {"cis20": ["CIS 1"], "mitre_attack": ["T1078"], "nist": ["ID.AM"]}
|
||||
known_false_positives = This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching within, plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.\
|
||||
This search will fire any time a new IP address is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you.
|
||||
providing_technologies = []
|
||||
|
||||
[savedsearch://ESCU - Cloud Provisioning Activity From Previously Unseen IP Address - Rule]
|
||||
type = detection
|
||||
asset_type = AWS Instance
|
||||
confidence = medium
|
||||
explanation = This search looks for cloud provisioning activities from previously unseen IP addresses. Provisioning activities are defined broadly as any event that runs or creates something.
|
||||
how_to_implement = You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search `Previously Seen Cloud Provisioning Activity Sources - Initial` to build the initial table of source IP address, geographic locations, and times. You must also enable the second baseline search `Previously Seen Cloud Provisioning Activity Sources - Update` to keep this table up to date and to age out old data. You can adjust the time window for this search by updating the `previously_unseen_cloud_provisioning_activity_window` macro. You can also provide additional filtering for this search by customizing the `cloud_provisioning_activity_from_previously_unseen_ip_address_filter` macro.
|
||||
annotations = {"cis20": ["CIS 1"], "mitre_attack": ["T1078"], "nist": ["ID.AM"]}
|
||||
known_false_positives = This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching within, plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.\
|
||||
This search will fire any time a new IP address is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you.
|
||||
providing_technologies = []
|
||||
|
||||
[savedsearch://ESCU - Cloud Provisioning Activity From Previously Unseen Region - Rule]
|
||||
type = detection
|
||||
asset_type = AWS Instance
|
||||
confidence = medium
|
||||
explanation = This search looks for cloud provisioning activities from previously unseen regions. Provisioning activities are defined broadly as any event that runs or creates something.
|
||||
how_to_implement = You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search `Previously Seen Cloud Provisioning Activity Sources - Initial` to build the initial table of source IP address, geographic locations, and times. You must also enable the second baseline search `Previously Seen Cloud Provisioning Activity Sources - Update` to keep this table up to date and to age out old data. You can adjust the time window for this search by updating the `previously_unseen_cloud_provisioning_activity_window` macro. You can also provide additional filtering for this search by customizing the `cloud_provisioning_activity_from_previously_unseen_region_filter` macro.
|
||||
annotations = {"cis20": ["CIS 1"], "mitre_attack": ["T1078"], "nist": ["ID.AM"]}
|
||||
known_false_positives = This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching within, plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.\
|
||||
This search will fire any time a new IP address is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you.
|
||||
providing_technologies = []
|
||||
|
||||
[savedsearch://ESCU - Detect AWS Console Login by New User - Rule]
|
||||
type = detection
|
||||
asset_type = AWS Instance
|
||||
confidence = medium
|
||||
explanation = This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour
|
||||
how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in AWS CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines.
|
||||
annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.DP", "DE.AE"]}
|
||||
known_false_positives = When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate.
|
||||
providing_technologies = []
|
||||
|
||||
[savedsearch://ESCU - Detect AWS Console Login by User from New City - Rule]
|
||||
type = detection
|
||||
asset_type = AWS Instance
|
||||
confidence = medium
|
||||
explanation = This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour
|
||||
how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in AWS CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_city_filter` macro.
|
||||
annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]}
|
||||
known_false_positives = When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate.
|
||||
providing_technologies = []
|
||||
|
||||
[savedsearch://ESCU - Detect AWS Console Login by User from New Country - Rule]
|
||||
type = detection
|
||||
asset_type = AWS Instance
|
||||
confidence = medium
|
||||
explanation = This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour
|
||||
how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in AWS CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_country_filter` macro.
|
||||
annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]}
|
||||
known_false_positives = When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate.
|
||||
providing_technologies = []
|
||||
|
||||
[savedsearch://ESCU - Detect AWS Console Login by User from New Region - Rule]
|
||||
type = detection
|
||||
asset_type = AWS Instance
|
||||
confidence = medium
|
||||
explanation = This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour
|
||||
how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in AWS CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_region_filter` macro.
|
||||
annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]}
|
||||
known_false_positives = When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate.
|
||||
providing_technologies = []
|
||||
|
||||
[savedsearch://ESCU - Detect New Open S3 buckets - Rule]
|
||||
type = detection
|
||||
asset_type = S3 Bucket
|
||||
confidence = medium
|
||||
explanation = This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket.
|
||||
how_to_implement = You must install the AWS App for Splunk.
|
||||
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
|
||||
known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group.
|
||||
providing_technologies = []
|
||||
|
||||
[savedsearch://ESCU - Detect New Open S3 Buckets over AWS CLI - Rule]
|
||||
type = detection
|
||||
asset_type = S3 Bucket
|
||||
confidence = medium
|
||||
explanation = This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket over the aws cli.
|
||||
how_to_implement =
|
||||
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
|
||||
known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group.
|
||||
providing_technologies = []
|
||||
|
||||
[savedsearch://ESCU - Detect shared ec2 snapshot - Rule]
|
||||
type = detection
|
||||
asset_type = EC2 Snapshot
|
||||
confidence = medium
|
||||
explanation = The following analytic utilizes AWS CloudTrail events to identify when an EC2 snapshot permissions are modified to be shared with a different AWS account. This method is used by adversaries to exfiltrate the EC2 snapshot.
|
||||
how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
|
||||
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1537"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
|
||||
known_false_positives = It is possible that an AWS admin has legitimately shared a snapshot with others for a specific purpose.
|
||||
providing_technologies = []
|
||||
|
||||
[savedsearch://ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule]
|
||||
type = detection
|
||||
asset_type = AWS Instance
|
||||
confidence = medium
|
||||
explanation = This search looks for a spike in number of of AWS security Hub alerts for an EC2 instance in 4 hours intervals
|
||||
how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security Hub inputs. The threshold_value should be tuned to your environment and schedule these searches according to the bucket span interval.
|
||||
annotations = {"cis20": ["CIS 13"], "nist": ["DE.DP"]}
|
||||
known_false_positives = None
|
||||
providing_technologies = []
|
||||
|
||||
[savedsearch://ESCU - O365 Add App Role Assignment Grant User - Rule]
|
||||
type = detection
|
||||
asset_type = Office 365
|
||||
confidence = medium
|
||||
explanation = This search detects the creation of a new Federation setting by alerting about an specific event related to its creation.
|
||||
how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity
|
||||
annotations = {"kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1136.003", "T1136"]}
|
||||
known_false_positives = The creation of a new Federation is not necessarily malicious, however this events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a different cloud provider.
|
||||
providing_technologies = []
|
||||
|
||||
[savedsearch://ESCU - O365 Added Service Principal - Rule]
|
||||
type = detection
|
||||
asset_type = Office 365
|
||||
confidence = medium
|
||||
explanation = This search detects the creation of a new Federation setting by alerting about an specific event related to its creation.
|
||||
how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity
|
||||
annotations = {"kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1136.003", "T1136"]}
|
||||
known_false_positives = The creation of a new Federation is not necessarily malicious, however these events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a different cloud provider.
|
||||
providing_technologies = []
|
||||
|
||||
[savedsearch://ESCU - O365 Bypass MFA via Trusted IP - Rule]
|
||||
type = detection
|
||||
asset_type = Office 365
|
||||
confidence = medium
|
||||
explanation = This search detects newly added IP addresses/CIDR blocks to the list of MFA Trusted IPs to bypass multi factor authentication. Attackers are often known to use this technique so that they can bypass the MFA system.
|
||||
how_to_implement = You must install Splunk Microsoft Office 365 add-on. This search works with o365:management:activity
|
||||
annotations = {"kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1562.007", "T1562"]}
|
||||
known_false_positives = Unless it is a special case, it is uncommon to continually update Trusted IPs to MFA configuration.
|
||||
providing_technologies = []
|
||||
|
||||
[savedsearch://ESCU - O365 Disable MFA - Rule]
|
||||
type = detection
|
||||
asset_type = Office 365
|
||||
confidence = medium
|
||||
explanation = This search detects when multi factor authentication has been disabled, what entitiy performed the action and against what user
|
||||
how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity
|
||||
annotations = {"kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1556"]}
|
||||
known_false_positives = Unless it is a special case, it is uncommon to disable MFA or Strong Authentication
|
||||
providing_technologies = []
|
||||
|
||||
[savedsearch://ESCU - O365 Excessive Authentication Failures Alert - Rule]
|
||||
type = detection
|
||||
asset_type = Office 365
|
||||
confidence = medium
|
||||
explanation = This search detects when an excessive number of authentication failures occur this search also includes attempts against MFA prompt codes
|
||||
how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity
|
||||
annotations = {"kill_chain_phases": ["Not Applicable"], "mitre_attack": ["T1110"]}
|
||||
known_false_positives = The threshold for alert is above 10 attempts and this should reduce the number of false positives.
|
||||
providing_technologies = []
|
||||
|
||||
[savedsearch://ESCU - O365 Excessive SSO logon errors - Rule]
|
||||
type = detection
|
||||
asset_type = Office 365
|
||||
confidence = medium
|
||||
explanation = This search detects accounts with high number of Single Sign ON (SSO) logon errors. Excessive logon errors may indicate attempts to bruteforce of password or single sign on token hijack or reuse.
|
||||
how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity
|
||||
annotations = {"kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1556"]}
|
||||
known_false_positives = Logon errors may not be malicious in nature however it may indicate attempts to reuse a token or password obtained via credential access attack.
|
||||
providing_technologies = []
|
||||
|
||||
[savedsearch://ESCU - O365 New Federated Domain Added - Rule]
|
||||
type = detection
|
||||
asset_type = Office 365
|
||||
confidence = medium
|
||||
explanation = This search detects the addition of a new Federated domain.
|
||||
how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity.
|
||||
annotations = {"kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1136.003", "T1136"]}
|
||||
known_false_positives = The creation of a new Federated domain is not necessarily malicious, however these events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a similar or different cloud provider.
|
||||
providing_technologies = []
|
||||
|
||||
[savedsearch://ESCU - O365 PST export alert - Rule]
|
||||
type = detection
|
||||
asset_type = Office 365
|
||||
confidence = medium
|
||||
explanation = This search detects when a user has performed an Ediscovery search or exported a PST file from the search. This PST file usually has sensitive information including email body content
|
||||
how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity
|
||||
annotations = {"kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1114"]}
|
||||
known_false_positives = PST export can be done for legitimate purposes but due to the sensitive nature of its content it must be monitored.
|
||||
providing_technologies = []
|
||||
|
||||
[savedsearch://ESCU - O365 Suspicious Admin Email Forwarding - Rule]
|
||||
type = detection
|
||||
asset_type = Office 365
|
||||
confidence = medium
|
||||
explanation = This search detects when an admin configured a forwarding rule for multiple mailboxes to the same destination.
|
||||
how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity
|
||||
annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.003", "T1114"], "nist": ["DE.DP", "DE.AE"]}
|
||||
known_false_positives = unknown
|
||||
providing_technologies = []
|
||||
|
||||
[savedsearch://ESCU - O365 Suspicious Rights Delegation - Rule]
|
||||
type = detection
|
||||
asset_type = Office 365
|
||||
confidence = medium
|
||||
explanation = This search detects the assignment of rights to accesss content from another mailbox. This is usually only assigned to a service account.
|
||||
how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity
|
||||
annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.002", "T1114"], "nist": ["DE.DP", "DE.AE"]}
|
||||
known_false_positives = Service Accounts
|
||||
providing_technologies = []
|
||||
|
||||
[savedsearch://ESCU - O365 Suspicious User Email Forwarding - Rule]
|
||||
type = detection
|
||||
asset_type = Office 365
|
||||
confidence = medium
|
||||
explanation = This search detects when multiple user configured a forwarding rule to the same destination.
|
||||
how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity
|
||||
annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.003", "T1114"], "nist": ["DE.DP", "DE.AE"]}
|
||||
known_false_positives = unknown
|
||||
providing_technologies = []
|
||||
|
||||
[savedsearch://ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule]
|
||||
type = detection
|
||||
asset_type = Cloud Instance
|
||||
confidence = medium
|
||||
explanation = This search finds for the number successfully destroyed cloud instances for every 4 hour block. This is split up between weekdays and the weekend. It then applies the probability densitiy model previously created and alerts on any outliers.
|
||||
how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Instances Destroyed` to create the probability density function.
|
||||
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.AE"]}
|
||||
known_false_positives = Many service accounts configured within a cloud infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify if this search alerted on a human user.
|
||||
providing_technologies = []
|
||||
|
||||
[savedsearch://ESCU - Abnormally High Number Of Cloud Instances Launched - Rule]
|
||||
type = detection
|
||||
asset_type = Cloud Instance
|
||||
confidence = medium
|
||||
explanation = This search finds for the number successfully created cloud instances for every 4 hour block. This is split up between weekdays and the weekend. It then applies the probability densitiy model previously created and alerts on any outliers.
|
||||
how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Instances Launched` to create the probability density function.
|
||||
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.AE"]}
|
||||
known_false_positives = Many service accounts configured within an AWS infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify if this search alerted on a human user.
|
||||
providing_technologies = []
|
||||
|
||||
### END DETECTIONS ###
|
||||
|
||||
### RESPONSE TASKS ###
|
||||
|
||||
[savedsearch://ESCU - Amazon EKS Kubernetes activity by src ip - Response Task]
|
||||
type = investigation
|
||||
explanation = none
|
||||
how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Cloud Watch EKS inputs.
|
||||
known_false_positives = not defined
|
||||
earliest_time_offset = 14400
|
||||
latest_time_offset = 0
|
||||
|
||||
[savedsearch://ESCU - AWS Investigate Security Hub alerts by dest - Response Task]
|
||||
type = investigation
|
||||
explanation = none
|
||||
how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.
|
||||
known_false_positives = not defined
|
||||
earliest_time_offset = 14400
|
||||
latest_time_offset = 0
|
||||
|
||||
[savedsearch://ESCU - AWS Investigate User Activities By AccessKeyId - Response Task]
|
||||
type = investigation
|
||||
explanation = none
|
||||
how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.
|
||||
known_false_positives = not defined
|
||||
earliest_time_offset = 14400
|
||||
latest_time_offset = 0
|
||||
|
||||
[savedsearch://ESCU - AWS Investigate User Activities By ARN - Response Task]
|
||||
type = investigation
|
||||
explanation = none
|
||||
how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.
|
||||
known_false_positives = not defined
|
||||
earliest_time_offset = 14400
|
||||
latest_time_offset = 0
|
||||
|
||||
[savedsearch://ESCU - AWS Network ACL Details from ID - Response Task]
|
||||
type = investigation
|
||||
explanation = none
|
||||
how_to_implement = In order to implement this search, you must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS(version 4.4.0 or later) and configure your AWS description inputs.
|
||||
known_false_positives = not defined
|
||||
earliest_time_offset = 14400
|
||||
latest_time_offset = 0
|
||||
|
||||
[savedsearch://ESCU - AWS Network Interface details via resourceId - Response Task]
|
||||
type = investigation
|
||||
explanation = none
|
||||
how_to_implement = In order to implement this search, you must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS(version 4.4.0 or later) and configure your AWS configuration inputs
|
||||
known_false_positives = not defined
|
||||
earliest_time_offset = 14400
|
||||
latest_time_offset = 0
|
||||
|
||||
[savedsearch://ESCU - AWS S3 Bucket details via bucketName - Response Task]
|
||||
type = investigation
|
||||
explanation = none
|
||||
how_to_implement = To implement this search, you must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later) and configure your AWS inputs.
|
||||
known_false_positives = not defined
|
||||
earliest_time_offset = 14400
|
||||
latest_time_offset = 0
|
||||
|
||||
[savedsearch://ESCU - Get All AWS Activity From City - Response Task]
|
||||
type = investigation
|
||||
explanation = none
|
||||
how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.
|
||||
known_false_positives = not defined
|
||||
earliest_time_offset = 14400
|
||||
latest_time_offset = 0
|
||||
|
||||
[savedsearch://ESCU - Get All AWS Activity From Country - Response Task]
|
||||
type = investigation
|
||||
explanation = none
|
||||
how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.
|
||||
known_false_positives = not defined
|
||||
earliest_time_offset = 14400
|
||||
latest_time_offset = 0
|
||||
|
||||
[savedsearch://ESCU - Get All AWS Activity From IP Address - Response Task]
|
||||
type = investigation
|
||||
explanation = none
|
||||
how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.
|
||||
known_false_positives = not defined
|
||||
earliest_time_offset = 14400
|
||||
latest_time_offset = 0
|
||||
|
||||
[savedsearch://ESCU - Get All AWS Activity From Region - Response Task]
|
||||
type = investigation
|
||||
explanation = none
|
||||
how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.
|
||||
known_false_positives = not defined
|
||||
earliest_time_offset = 14400
|
||||
latest_time_offset = 0
|
||||
|
||||
[savedsearch://ESCU - Get EC2 Instance Details by instanceId - Response Task]
|
||||
type = investigation
|
||||
explanation = none
|
||||
how_to_implement = In order to implement this search, you must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS(version 4.4.0 or later) and configure your AWS description inputs.
|
||||
known_false_positives = not defined
|
||||
earliest_time_offset = 14400
|
||||
latest_time_offset = 0
|
||||
|
||||
[savedsearch://ESCU - Get EC2 Launch Details - Response Task]
|
||||
type = investigation
|
||||
explanation = none
|
||||
how_to_implement = In order to implement this search, you must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS(version 4.4.0 or later) and configure your AWS description inputs.
|
||||
known_false_positives = not defined
|
||||
earliest_time_offset = 14400
|
||||
latest_time_offset = 0
|
||||
|
||||
[savedsearch://ESCU - Investigate AWS activities via region name - Response Task]
|
||||
type = investigation
|
||||
explanation = none
|
||||
how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.
|
||||
known_false_positives = not defined
|
||||
earliest_time_offset = 14400
|
||||
latest_time_offset = 0
|
||||
|
||||
[savedsearch://ESCU - Investigate AWS User Activities by user field - Response Task]
|
||||
type = investigation
|
||||
explanation = none
|
||||
how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.
|
||||
known_false_positives = not defined
|
||||
earliest_time_offset = 14400
|
||||
latest_time_offset = 0
|
||||
|
||||
### END RESPONSE TASKS ###
|
||||
Vendored
-30
@@ -1,30 +0,0 @@
|
||||
## Splunk app configuration file
|
||||
|
||||
[install]
|
||||
is_configured = false
|
||||
state = enabled
|
||||
state_change_requires_restart = false
|
||||
build = 3723
|
||||
|
||||
[triggers]
|
||||
reload.analytic_stories = simple
|
||||
reload.use_case_library = simple
|
||||
reload.correlationsearches = simple
|
||||
reload.analyticstories = simple
|
||||
reload.governance = simple
|
||||
reload.managed_configurations = simple
|
||||
reload.postprocess = simple
|
||||
reload.content-version = simple
|
||||
reload.es_investigations = simple
|
||||
|
||||
[launcher]
|
||||
author = Splunk
|
||||
version = 3.32.0
|
||||
description = Explore the Analytic Stories included with Splunk Security Analytics for AWS Content
|
||||
|
||||
[ui]
|
||||
is_visible = false
|
||||
label = Splunk Security Analytics for AWS Content
|
||||
|
||||
[package]
|
||||
id = DA-ESS_AmazonWebServices_Content
|
||||
Vendored
-55
@@ -1,55 +0,0 @@
|
||||
#############
|
||||
# Automatically generated by generator.py in splunk/security_content
|
||||
# On Date: 2021-12-15T02:51:23 UTC
|
||||
# Author: Splunk Security Research
|
||||
# Contact: research@splunk.com
|
||||
#############
|
||||
|
||||
[api_call_by_user_baseline]
|
||||
enforceTypes = false
|
||||
replicate = false
|
||||
|
||||
[cloud_instances_enough_data]
|
||||
enforceTypes = false
|
||||
replicate = false
|
||||
|
||||
[previously_seen_cloud_api_calls_per_user_role]
|
||||
enforceTypes = false
|
||||
replicate = false
|
||||
|
||||
[previously_seen_cloud_compute_creations_by_user]
|
||||
enforceTypes = false
|
||||
replicate = false
|
||||
|
||||
[previously_seen_cloud_compute_images]
|
||||
enforceTypes = false
|
||||
replicate = false
|
||||
|
||||
[previously_seen_cloud_compute_instance_types]
|
||||
enforceTypes = false
|
||||
replicate = false
|
||||
|
||||
[previously_seen_cloud_instance_modifications_by_user]
|
||||
enforceTypes = false
|
||||
replicate = false
|
||||
|
||||
[previously_seen_cloud_provisioning_activity_sources]
|
||||
enforceTypes = false
|
||||
replicate = false
|
||||
|
||||
[previously_seen_cloud_regions]
|
||||
enforceTypes = false
|
||||
replicate = false
|
||||
|
||||
[previously_seen_running_windows_services]
|
||||
enforceTypes = false
|
||||
replicate = false
|
||||
|
||||
[previously_seen_users_console_logins]
|
||||
enforceTypes = false
|
||||
replicate = false
|
||||
|
||||
[zoom_first_time_child_process]
|
||||
enforceTypes = false
|
||||
replicate = false
|
||||
|
||||
-2
@@ -1,2 +0,0 @@
|
||||
[content-version]
|
||||
version = 3.32.0
|
||||
Vendored
-9
@@ -1,9 +0,0 @@
|
||||
<panel>
|
||||
<table>
|
||||
<search>
|
||||
<query>| search sourcetype="netbackup_logs" dest=$dest$</query>
|
||||
</search>
|
||||
<option name="drilldown">cell</option>
|
||||
<option name="wrap">false</option>
|
||||
</table>
|
||||
</panel>
|
||||
-9
@@ -1,9 +0,0 @@
|
||||
<panel>
|
||||
<table>
|
||||
<search>
|
||||
<query>`aws_cloudwatchlogs_eks` |rename sourceIPs{} as src_ip |search src_ip=$src_ip$ | stats count min(_time) as firstTime max(_time) as lastTime values(user.username) values(requestURI) values(verb) values(userAgent) by source annotations.authorization.k8s.io/decision src_ip</query>
|
||||
</search>
|
||||
<option name="drilldown">cell</option>
|
||||
<option name="wrap">false</option>
|
||||
</table>
|
||||
</panel>
|
||||
-9
@@ -1,9 +0,0 @@
|
||||
<panel>
|
||||
<table>
|
||||
<search>
|
||||
<query>`aws_securityhub_firehose` "findings{}.Resources{}.Type"=AWSEC2Instance | rex field=findings{}.Resources{}.Id .*instance/(?<instance>.*)| rename instance as dest| search dest = $dest$ |rename findings{}.* as * | rename Remediation.Recommendation.Text as Remediation | table dest Title ProductArn Description FirstObservedAt RecordState Remediation</query>
|
||||
</search>
|
||||
<option name="drilldown">cell</option>
|
||||
<option name="wrap">false</option>
|
||||
</table>
|
||||
</panel>
|
||||
-9
@@ -1,9 +0,0 @@
|
||||
<panel>
|
||||
<table>
|
||||
<search>
|
||||
<query>`cloudtrail` | rename userIdentity.accessKeyId as accessKeyId| search accessKeyId=$accessKeyId$ | spath output=user path=userIdentity.arn | rename sourceIPAddress as src_ip | table _time, user, src_ip, awsRegion, eventName, errorCode, errorMessage</query>
|
||||
</search>
|
||||
<option name="drilldown">cell</option>
|
||||
<option name="wrap">false</option>
|
||||
</table>
|
||||
</panel>
|
||||
-9
@@ -1,9 +0,0 @@
|
||||
<panel>
|
||||
<table>
|
||||
<search>
|
||||
<query>`cloudtrail` | search user=$user$| table _time userIdentity.type userIdentity.userName userIdentity.arn aws_account_id src awsRegion eventName eventType</query>
|
||||
</search>
|
||||
<option name="drilldown">cell</option>
|
||||
<option name="wrap">false</option>
|
||||
</table>
|
||||
</panel>
|
||||
-9
@@ -1,9 +0,0 @@
|
||||
<panel>
|
||||
<table>
|
||||
<search>
|
||||
<query>`aws_description` | rename id as networkAclId | search networkAclId=$networkAclId$ | table id account_id vpc_id network_acl_entries{}.*</query>
|
||||
</search>
|
||||
<option name="drilldown">cell</option>
|
||||
<option name="wrap">false</option>
|
||||
</table>
|
||||
</panel>
|
||||
-9
@@ -1,9 +0,0 @@
|
||||
<panel>
|
||||
<table>
|
||||
<search>
|
||||
<query>`aws_config` resourceId=$resourceId$ | table _time ARN relationships{}.resourceType relationships{}.name relationships{}.resourceId configuration.privateIpAddresses{}.privateIpAddress configuration.privateIpAddresses{}.association.publicIp</query>
|
||||
</search>
|
||||
<option name="drilldown">cell</option>
|
||||
<option name="wrap">false</option>
|
||||
</table>
|
||||
</panel>
|
||||
-9
@@ -1,9 +0,0 @@
|
||||
<panel>
|
||||
<table>
|
||||
<search>
|
||||
<query>`aws_config` | rename resourceId as bucketName |search bucketName=$bucketName$ | table resourceCreationTime bucketName vendor_region action aws_account_id supplementaryConfiguration.AccessControlList</query>
|
||||
</search>
|
||||
<option name="drilldown">cell</option>
|
||||
<option name="wrap">false</option>
|
||||
</table>
|
||||
</panel>
|
||||
-9
@@ -1,9 +0,0 @@
|
||||
<panel>
|
||||
<table>
|
||||
<search>
|
||||
<query>sourcetype="google:gcp:pubsub:message" | rename data.protoPayload.requestMetadata.callerIp as src_ip | search src_ip =$src_ip$ | stats count min(_time) as firstTime max(_time) as lastTime values(data.protoPayload.methodName) as method_names values(data.protoPayload.resourceName) as resource_name values(data.protoPayload.requestMetadata.callerSuppliedUserAgent) as http_user_agent values(data.protoPayload.authenticationInfo.principalEmail) as user values(data.protoPayload.status.message) by src_ip data.resource.labels.cluster_name data.resource.type</query>
|
||||
</search>
|
||||
<option name="drilldown">cell</option>
|
||||
<option name="wrap">false</option>
|
||||
</table>
|
||||
</panel>
|
||||
dist/saaws/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_city___response_task.xml
Vendored
-9
@@ -1,9 +0,0 @@
|
||||
<panel>
|
||||
<table>
|
||||
<search>
|
||||
<query>`cloudtrail` | iplocation sourceIPAddress | search City=$City$ | spath output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip | table _time, City, user, userName, userType, src_ip, awsRegion, eventName, errorCode</query>
|
||||
</search>
|
||||
<option name="drilldown">cell</option>
|
||||
<option name="wrap">false</option>
|
||||
</table>
|
||||
</panel>
|
||||
-9
@@ -1,9 +0,0 @@
|
||||
<panel>
|
||||
<table>
|
||||
<search>
|
||||
<query>`cloudtrail` | iplocation sourceIPAddress | search Country=$Country$ | spath output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip | table _time, Country, user, userName, userType, src_ip, awsRegion, eventName, errorCode</query>
|
||||
</search>
|
||||
<option name="drilldown">cell</option>
|
||||
<option name="wrap">false</option>
|
||||
</table>
|
||||
</panel>
|
||||
-9
@@ -1,9 +0,0 @@
|
||||
<panel>
|
||||
<table>
|
||||
<search>
|
||||
<query>`cloudtrail` | iplocation sourceIPAddress | search src_ip=$src_ip$ | spath output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip | table _time, user, userName, userType, src_ip, awsRegion, eventName, errorCode</query>
|
||||
</search>
|
||||
<option name="drilldown">cell</option>
|
||||
<option name="wrap">false</option>
|
||||
</table>
|
||||
</panel>
|
||||
-9
@@ -1,9 +0,0 @@
|
||||
<panel>
|
||||
<table>
|
||||
<search>
|
||||
<query>`cloudtrail` | iplocation sourceIPAddress | search Region=$Region$ | spath output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip | table _time, Region, user, userName, userType, src_ip, awsRegion, eventName, errorCode</query>
|
||||
</search>
|
||||
<option name="drilldown">cell</option>
|
||||
<option name="wrap">false</option>
|
||||
</table>
|
||||
</panel>
|
||||
Vendored
-9
@@ -1,9 +0,0 @@
|
||||
<panel>
|
||||
<table>
|
||||
<search>
|
||||
<query>| search sourcetype="netbackup_logs" COMPUTERNAME=$dest$ | rename COMPUTERNAME as dest, MESSAGE as signature | table _time, dest, signature</query>
|
||||
</search>
|
||||
<option name="drilldown">cell</option>
|
||||
<option name="wrap">false</option>
|
||||
</table>
|
||||
</panel>
|
||||
-9
@@ -1,9 +0,0 @@
|
||||
<panel>
|
||||
<table>
|
||||
<search>
|
||||
<query>| tstats `summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Certificates.All_Certificates where All_Certificates.SSL.ssl_subject_common_name=*$domain$ by All_Certificates.dest All_Certificates.src All_Certificates.SSL.ssl_issuer_common_name All_Certificates.SSL.ssl_subject_common_name All_Certificates.SSL.ssl_hash | `drop_dm_object_name(All_Certificates)` | `drop_dm_object_name(SSL)` | rename ssl_subject_common_name as domain | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`</query>
|
||||
</search>
|
||||
<option name="drilldown">cell</option>
|
||||
<option name="wrap">false</option>
|
||||
</table>
|
||||
</panel>
|
||||
-9
@@ -1,9 +0,0 @@
|
||||
<panel>
|
||||
<table>
|
||||
<search>
|
||||
<query>| search tag=dns src_ip=$src_ip$ dest_port=53 | streamstats time_window=1d count values(dest_ip) as dcip by src_ip | table date_mday src_ip dcip count | sort -count</query>
|
||||
</search>
|
||||
<option name="drilldown">cell</option>
|
||||
<option name="wrap">false</option>
|
||||
</table>
|
||||
</panel>
|
||||
Vendored
-9
@@ -1,9 +0,0 @@
|
||||
<panel>
|
||||
<table>
|
||||
<search>
|
||||
<query>| tstats allow_old_summaries=true sum(All_Traffic.bytes_out) as "bytes_out" sum(All_Traffic.bytes_in) as "bytes_in" from datamodel=Network_Traffic where nodename=All_Traffic All_Traffic.dest_port=53 by All_Traffic.src All_Traffic.dest| `drop_dm_object_name(All_Traffic)` | rename src as src_ip | rename dest as dest_ip | search src_ip=$src_ip$ | search dest_ip = $dest_ip | eval ratio = (bytes_out/bytes_in) | table ratio</query>
|
||||
</search>
|
||||
<option name="drilldown">cell</option>
|
||||
<option name="wrap">false</option>
|
||||
</table>
|
||||
</panel>
|
||||
-9
@@ -1,9 +0,0 @@
|
||||
<panel>
|
||||
<table>
|
||||
<search>
|
||||
<query>`aws_description` | dedup id sortby -_time |rename id as instanceId| search instanceId=$instanceId$ | spath output=tags path=tags | eval tags=mvzip(key,value," = "), ip_address=if((ip_address == "null"),private_ip_address,ip_address) | table id, tags.Name, aws_account_id, placement, instance_type, key_name, ip_address, launch_time, state, vpc_id, subnet_id, tags | rename aws_account_id as "Account ID", id as ID, instance_type as Type, ip_address as "IP Address", key_name as "Key Pair", launch_time as "Launch Time", placement as "Availability Zone", state as State, subnet_id as Subnet, "tags.Name" as Name, vpc_id as VPC</query>
|
||||
</search>
|
||||
<option name="drilldown">cell</option>
|
||||
<option name="wrap">false</option>
|
||||
</table>
|
||||
</panel>
|
||||
Vendored
-9
@@ -1,9 +0,0 @@
|
||||
<panel>
|
||||
<table>
|
||||
<search>
|
||||
<query>`cloudtrail` dest=$dest$ |rename userIdentity.arn as arn, responseElements.instancesSet.items{}.instanceId as dest, responseElements.instancesSet.items{}.privateIpAddress as privateIpAddress, responseElements.instancesSet.items{}.imageId as amiID, responseElements.instancesSet.items{}.architecture as architecture, responseElements.instancesSet.items{}.keyName as keyName | table arn, awsRegion, dest, architecture, privateIpAddress, amiID, keyName</query>
|
||||
</search>
|
||||
<option name="drilldown">cell</option>
|
||||
<option name="wrap">false</option>
|
||||
</table>
|
||||
</panel>
|
||||
-9
@@ -1,9 +0,0 @@
|
||||
<panel>
|
||||
<table>
|
||||
<search>
|
||||
<query>| from datamodel Email.All_Email | search message_id=$message_id$</query>
|
||||
</search>
|
||||
<option name="drilldown">cell</option>
|
||||
<option name="wrap">false</option>
|
||||
</table>
|
||||
</panel>
|
||||
-9
@@ -1,9 +0,0 @@
|
||||
<panel>
|
||||
<table>
|
||||
<search>
|
||||
<query>| from datamodel Email.All_Email | search src_user=$src_user$</query>
|
||||
</search>
|
||||
<option name="drilldown">cell</option>
|
||||
<option name="wrap">false</option>
|
||||
</table>
|
||||
</panel>
|
||||
-9
@@ -1,9 +0,0 @@
|
||||
<panel>
|
||||
<table>
|
||||
<search>
|
||||
<query>| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Sessions where nodename=All_Sessions.DHCP All_Sessions.signature=DHCPREQUEST All_Sessions.All_Sessions.src_mac= $src_mac$ by All_Sessions.src_ip All_Sessions.user | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`</query>
|
||||
</search>
|
||||
<option name="drilldown">cell</option>
|
||||
<option name="wrap">false</option>
|
||||
</table>
|
||||
</panel>
|
||||
Vendored
-9
@@ -1,9 +0,0 @@
|
||||
<panel>
|
||||
<table>
|
||||
<search>
|
||||
<query>|tstats `security_content_summariesonly` values(All_Email.dest) as dest values(All_Email.recipient) as recepient min(_time) as firstTime max(_time) as lastTime count from datamodel=Email.All_Email by All_Email.src |`drop_dm_object_name(All_Email)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | search src=$src$</query>
|
||||
</search>
|
||||
<option name="drilldown">cell</option>
|
||||
<option name="wrap">false</option>
|
||||
</table>
|
||||
</panel>
|
||||
-9
@@ -1,9 +0,0 @@
|
||||
<panel>
|
||||
<table>
|
||||
<search>
|
||||
<query>| search eventtype=wineventlog_security (signature_id=4718 OR signature_id=4717) dest=$dest$ | rename user as "Account Modified" | table _time, dest, "Account Modified", Access_Right, signature</query>
|
||||
</search>
|
||||
<option name="drilldown">cell</option>
|
||||
<option name="wrap">false</option>
|
||||
</table>
|
||||
</panel>
|
||||
-9
@@ -1,9 +0,0 @@
|
||||
<panel>
|
||||
<table>
|
||||
<search>
|
||||
<query>| search eventtype=wineventlog_security (signature_id=4718 OR signature_id=4717) user=$user$ | rename user as "Account Modified" | table _time, dest, "Account Modified", Access_Right, signature</query>
|
||||
</search>
|
||||
<option name="drilldown">cell</option>
|
||||
<option name="wrap">false</option>
|
||||
</table>
|
||||
</panel>
|
||||
-9
@@ -1,9 +0,0 @@
|
||||
<panel>
|
||||
<table>
|
||||
<search>
|
||||
<query>| search `notable` | search dest=$dest$ | table _time, dest, rule_name, owner, priority, severity, status_description</query>
|
||||
</search>
|
||||
<option name="drilldown">cell</option>
|
||||
<option name="wrap">false</option>
|
||||
</table>
|
||||
</panel>
|
||||
-9
@@ -1,9 +0,0 @@
|
||||
<panel>
|
||||
<table>
|
||||
<search>
|
||||
<query>| from datamodel Email.All_Email | search recipient=misswang8107@gmail.com OR src_user=redhat@gmail.com | stats count earliest(_time) as firstTime, latest(_time) as lastTime values(dest) values(src) by src_user recipient | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`</query>
|
||||
</search>
|
||||
<option name="drilldown">cell</option>
|
||||
<option name="wrap">false</option>
|
||||
</table>
|
||||
</panel>
|
||||
Vendored
-9
@@ -1,9 +0,0 @@
|
||||
<panel>
|
||||
<table>
|
||||
<search>
|
||||
<query>| tstats `summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.parent_process_name Processes.process_name Processes.dest | `drop_dm_object_name("Processes")` | search parent_process_name= $parent_process_name$ |search dest = $dest$ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`</query>
|
||||
</search>
|
||||
<option name="drilldown">cell</option>
|
||||
<option name="wrap">false</option>
|
||||
</table>
|
||||
</panel>
|
||||
Vendored
-9
@@ -1,9 +0,0 @@
|
||||
<panel>
|
||||
<table>
|
||||
<search>
|
||||
<query>| tstats `security_content_summariesonly` values(Filesystem.file_name) as file_name values(Filesystem.dest) as dest, values(Filesystem.process_name) as process_name from datamodel=Endpoint.Filesystem by Filesystem.dest Filesystem.process_name Filesystem.file_path, Filesystem.action, _time | `drop_dm_object_name(Filesystem)` | search dest=$dest$ | search process_name=$process_name$ | table _time, process_name, dest, action, file_name, file_path</query>
|
||||
</search>
|
||||
<option name="drilldown">cell</option>
|
||||
<option name="wrap">false</option>
|
||||
</table>
|
||||
</panel>
|
||||
-9
@@ -1,9 +0,0 @@
|
||||
<panel>
|
||||
<table>
|
||||
<search>
|
||||
<query>| tstats `summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.parent_process_name Processes.process_name Processes.dest | `drop_dm_object_name("Processes")` | search process_name= $process_name$ | search dest = $dest$ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`</query>
|
||||
</search>
|
||||
<option name="drilldown">cell</option>
|
||||
<option name="wrap">false</option>
|
||||
</table>
|
||||
</panel>
|
||||
-9
@@ -1,9 +0,0 @@
|
||||
<panel>
|
||||
<table>
|
||||
<search>
|
||||
<query>| tstats `security_content_summariesonly` count min(_time) max(_time) as lastTime from datamodel=Endpoint.Processes by Processes.process_name Processes.user Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | search dest=$dest$ | join dest type=inner [| tstats `security_content_summariesonly` count from datamodel=Endpoint.Ports by Ports.process_id Ports.src Ports.dest_port | `drop_dm_object_name(Ports)` | search dest_port=$dest_port$ | rename src as dest]</query>
|
||||
</search>
|
||||
<option name="drilldown">cell</option>
|
||||
<option name="wrap">false</option>
|
||||
</table>
|
||||
</panel>
|
||||
-9
@@ -1,9 +0,0 @@
|
||||
<panel>
|
||||
<table>
|
||||
<search>
|
||||
<query>| tstats `security_content_summariesonly` count min(_time) max(_time) as lastTime from datamodel=Endpoint.Processes by Processes.parent_process Processes.process_name Processes.user Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | search dest = $dest$ | join dest type=inner [| tstats `security_content_summariesonly` count from datamodel=Endpoint.Ports where Ports.dest_port=53 by Ports.process_id Ports.src | `drop_dm_object_name(Ports)` | rename src as dest]</query>
|
||||
</search>
|
||||
<option name="drilldown">cell</option>
|
||||
<option name="wrap">false</option>
|
||||
</table>
|
||||
</panel>
|
||||
-9
@@ -1,9 +0,0 @@
|
||||
<panel>
|
||||
<table>
|
||||
<search>
|
||||
<query>sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode>18 EventCode<22 | rename host as dest | search dest=$dest$| table _time, dest, user, Name, Operation, EventType, Type, Query, Consumer, Filter</query>
|
||||
</search>
|
||||
<option name="drilldown">cell</option>
|
||||
<option name="wrap">false</option>
|
||||
</table>
|
||||
</panel>
|
||||
-9
@@ -1,9 +0,0 @@
|
||||
<panel>
|
||||
<table>
|
||||
<search>
|
||||
<query>| search sourcetype=stream:http session_id = $session_id$ | stats values(url) values(http_user_agent) by src_ip status</query>
|
||||
</search>
|
||||
<option name="drilldown">cell</option>
|
||||
<option name="wrap">false</option>
|
||||
</table>
|
||||
</panel>
|
||||
-9
@@ -1,9 +0,0 @@
|
||||
<panel>
|
||||
<table>
|
||||
<search>
|
||||
<query>`cloudtrail` vendor_region=$vendor_region$| rename requestParameters.instancesSet.items{}.instanceId as instanceId | stats values(eventName) by user instanceId vendor_region</query>
|
||||
</search>
|
||||
<option name="drilldown">cell</option>
|
||||
<option name="wrap">false</option>
|
||||
</table>
|
||||
</panel>
|
||||
-9
@@ -1,9 +0,0 @@
|
||||
<panel>
|
||||
<table>
|
||||
<search>
|
||||
<query>`cloudtrail` user=$user$ | table _time userIdentity.type userIdentity.userName userIdentity.arn aws_account_id src awsRegion eventName eventType </query>
|
||||
</search>
|
||||
<option name="drilldown">cell</option>
|
||||
<option name="wrap">false</option>
|
||||
</table>
|
||||
</panel>
|
||||
-9
@@ -1,9 +0,0 @@
|
||||
<panel>
|
||||
<table>
|
||||
<search>
|
||||
<query>| tstats count `security_content_summariesonly` earliest(_time) as first_login latest(_time) as last_login dc(Authentication.dest) AS distinct_count_dest values(Authentication.dest) AS Authentication.dest values(Authentication.app) AS Authentication.app from datamodel=Authentication where Authentication.action=failure by Authentication.user | where distinct_count_dest > 1 | `security_content_ctime(first_login)` | `security_content_ctime(last_login)` | `drop_dm_object_name("Authentication")` | search user=$user$</query>
|
||||
</search>
|
||||
<option name="drilldown">cell</option>
|
||||
<option name="wrap">false</option>
|
||||
</table>
|
||||
</panel>
|
||||
-9
@@ -1,9 +0,0 @@
|
||||
<panel>
|
||||
<table>
|
||||
<search>
|
||||
<query>| from datamodel Network_Traffic.All_Traffic | search src_ip=$src_ip$</query>
|
||||
</search>
|
||||
<option name="drilldown">cell</option>
|
||||
<option name="wrap">false</option>
|
||||
</table>
|
||||
</panel>
|
||||
-9
@@ -1,9 +0,0 @@
|
||||
<panel>
|
||||
<table>
|
||||
<search>
|
||||
<query>eventtype=okta_log app=$app$ | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city | table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason</query>
|
||||
</search>
|
||||
<option name="drilldown">cell</option>
|
||||
<option name="wrap">false</option>
|
||||
</table>
|
||||
</panel>
|
||||
-9
@@ -1,9 +0,0 @@
|
||||
<panel>
|
||||
<table>
|
||||
<search>
|
||||
<query>eventtype=okta_log src_ip={src_ip} | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city | table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason</query>
|
||||
</search>
|
||||
<option name="drilldown">cell</option>
|
||||
<option name="wrap">false</option>
|
||||
</table>
|
||||
</panel>
|
||||
-9
@@ -1,9 +0,0 @@
|
||||
<panel>
|
||||
<table>
|
||||
<search>
|
||||
<query>`wineventlog_security` EventCode=4624 Logon_Type=9 AuthenticationPackageName=Negotiate | stats count earliest(_time) as first_login latest(_time) as last_login by src_user dest | `security_content_ctime(first_login)` | `security_content_ctime(last_login)` | search dest=$dest$</query>
|
||||
</search>
|
||||
<option name="drilldown">cell</option>
|
||||
<option name="wrap">false</option>
|
||||
</table>
|
||||
</panel>
|
||||
-9
@@ -1,9 +0,0 @@
|
||||
<panel>
|
||||
<table>
|
||||
<search>
|
||||
<query>`wineventlog_security` EventCode=4768 OR EventCode=4769 | rex field=user "(?<new_user>[^\@]+)" | stats count BY new_user, dest, EventCode | stats max(count) AS max_count sum(count) AS sum_count BY new_user, dest| search dest=$dest$ | where sum_count/max_count!=2 | rename new_user AS user </query>
|
||||
</search>
|
||||
<option name="drilldown">cell</option>
|
||||
<option name="wrap">false</option>
|
||||
</table>
|
||||
</panel>
|
||||
-9
@@ -1,9 +0,0 @@
|
||||
<panel>
|
||||
<table>
|
||||
<search>
|
||||
<query>| tstats count `security_content_summariesonly` earliest(_time) as first_login latest(_time) as last_login values(Authentication.dest) AS Authentication.dest values(Authentication.app) AS Authentication.app values(Authentication.action) AS Authentication.action from datamodel=Authentication where Authentication.action=success by _time, Authentication.user | bucket _time span=30d | stats count min(first_login) as first_login max(last_login) as last_login values(Authentication.dest) AS Authentication.dest by Authentication.user | where count=1 | where first_login >= relative_time(now(), "-30d") | `security_content_ctime(first_login)` | `security_content_ctime(last_login)` | `drop_dm_object_name("Authentication")` | search dest=$dest$</query>
|
||||
</search>
|
||||
<option name="drilldown">cell</option>
|
||||
<option name="wrap">false</option>
|
||||
</table>
|
||||
</panel>
|
||||
-9
@@ -1,9 +0,0 @@
|
||||
<panel>
|
||||
<table>
|
||||
<search>
|
||||
<query>| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Authentication where Authentication.signature_id=4624 Authentication.app=win:remote by Authentication.src Authentication.dest Authentication.app Authentication.user Authentication.signature Authentication.src_nt_domain | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name("Authentication")` | search dest=$dest$ | table firstTime lastTime src src_nt_domain dest user app count | sort count</query>
|
||||
</search>
|
||||
<option name="drilldown">cell</option>
|
||||
<option name="wrap">false</option>
|
||||
</table>
|
||||
</panel>
|
||||
-9
@@ -1,9 +0,0 @@
|
||||
<panel>
|
||||
<table>
|
||||
<search>
|
||||
<query>| search sourcetype=stream:http | search src_ip=$src_ip$ | search dest_ip=$dest_ip$ | eval cs_content_type_length = len(cs_content_type) | search cs_content_type_length > 100 | rex field="cs_content_type" (?<suspicious_strings>cmd.exe) | eval suspicious_strings_found=if(match(cs_content_type, "application"), "True", "False") | rename suspicious_strings_found AS "Suspicious Content-Type Found" | fields "Suspicious Content-Type Found", dest_ip, src_ip, suspicious_strings, cs_content_type, cs_content_type_length, url</query>
|
||||
</search>
|
||||
<option name="drilldown">cell</option>
|
||||
<option name="wrap">false</option>
|
||||
</table>
|
||||
</panel>
|
||||
-9
@@ -1,9 +0,0 @@
|
||||
<panel>
|
||||
<table>
|
||||
<search>
|
||||
<query>eventtype=okta_log user=$user$ | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city | table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason</query>
|
||||
</search>
|
||||
<option name="drilldown">cell</option>
|
||||
<option name="wrap">false</option>
|
||||
</table>
|
||||
</panel>
|
||||
dist/saaws/default/data/ui/panels/workbench_panel_investigate_web_posts_from_src___response_task.xml
Vendored
-9
@@ -1,9 +0,0 @@
|
||||
<panel>
|
||||
<table>
|
||||
<search>
|
||||
<query>| tstats `security_content_summariesonly` values(Web.url) as url from datamodel=Web by Web.src,Web.http_user_agent,Web.http_method | `drop_dm_object_name("Web")`| search http_method, "POST" | search src=$src$</query>
|
||||
</search>
|
||||
<option name="drilldown">cell</option>
|
||||
<option name="wrap">false</option>
|
||||
</table>
|
||||
</panel>
|
||||
Vendored
-5
@@ -1,5 +0,0 @@
|
||||
[replicationSettings:refineConf]
|
||||
replicate.analytic_stories = false
|
||||
|
||||
[replicationBlacklist]
|
||||
excludeESCU = apps[/\\]DA-ESS-ContentUpdate[/\\]lookups[/\\]...
|
||||
-94
@@ -1,94 +0,0 @@
|
||||
|
||||
[panel_group://workbench_panel_group_aws_iam_privilege_escalation]
|
||||
label = AWS IAM Privilege Escalation
|
||||
description = This analytic story contains detections that query your AWS Cloudtrail for activities related to privilege escalation.
|
||||
disabled = 0
|
||||
|
||||
panels = ["panel://workbench_panel_get_notable_history___response_task"]
|
||||
|
||||
[panel_group://workbench_panel_group_aws_network_acl_activity]
|
||||
label = AWS Network ACL Activity
|
||||
description = Monitor your AWS network infrastructure for bad configurations and malicious activity. Investigative searches help you probe deeper, when the facts warrant it.
|
||||
disabled = 0
|
||||
|
||||
panels = ["panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_aws_network_acl_details_from_id___response_task", "panel://workbench_panel_aws_network_interface_details_via_resourceid___response_task", "panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task"]
|
||||
|
||||
[panel_group://workbench_panel_group_aws_security_hub_alerts]
|
||||
label = AWS Security Hub Alerts
|
||||
description = This story is focused around detecting Security Hub alerts generated from AWS
|
||||
disabled = 0
|
||||
|
||||
panels = ["panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_ec2_instance_details_by_instanceid___response_task", "panel://workbench_panel_get_ec2_launch_details___response_task"]
|
||||
|
||||
[panel_group://workbench_panel_group_cloud_cryptomining]
|
||||
label = Cloud Cryptomining
|
||||
description = Monitor your cloud compute instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or compute instances started by previously unseen users are just a few examples of potentially malicious behavior.
|
||||
disabled = 0
|
||||
|
||||
panels = ["panel://workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_ec2_instance_details_by_instanceid___response_task", "panel://workbench_panel_get_ec2_launch_details___response_task", "panel://workbench_panel_investigate_aws_activities_via_region_name___response_task"]
|
||||
|
||||
[panel_group://workbench_panel_group_cloud_federated_credential_abuse]
|
||||
label = Cloud Federated Credential Abuse
|
||||
description = This analytical story addresses events that indicate abuse of cloud federated credentials. These credentials are usually extracted from endpoint desktop or servers specially those servers that provide federation services such as Windows Active Directory Federation Services. Identity Federation relies on objects such as Oauth2 tokens, cookies or SAML assertions in order to provide seamless access between cloud and perimeter environments. If these objects are either hijacked or forged then attackers will be able to pivot into victim's cloud environements.
|
||||
disabled = 0
|
||||
|
||||
panels = ["panel://workbench_panel_get_notable_history___response_task"]
|
||||
|
||||
[panel_group://workbench_panel_group_office_365_detections]
|
||||
label = Office 365 Detections
|
||||
description = This story is focused around detecting Office 365 Attacks.
|
||||
disabled = 0
|
||||
|
||||
panels = ["panel://workbench_panel_get_notable_history___response_task"]
|
||||
|
||||
[panel_group://workbench_panel_group_ransomware_cloud]
|
||||
label = Ransomware Cloud
|
||||
description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware. These searches include cloud related objects that may be targeted by malicious actors via cloud providers own encryption features.
|
||||
disabled = 0
|
||||
|
||||
panels = ["panel://workbench_panel_get_notable_history___response_task"]
|
||||
|
||||
[panel_group://workbench_panel_group_suspicious_aws_login_activities]
|
||||
label = Suspicious AWS Login Activities
|
||||
description = Monitor your AWS authentication events using your CloudTrail logs. Searches within this Analytic Story will help you stay aware of and investigate suspicious logins.
|
||||
disabled = 0
|
||||
|
||||
panels = ["panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task"]
|
||||
|
||||
[panel_group://workbench_panel_group_suspicious_aws_s3_activities]
|
||||
label = Suspicious AWS S3 Activities
|
||||
description = Use the searches in this Analytic Story to monitor your AWS S3 buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open S3 buckets and buckets being accessed from a new IP. The contextual and investigative searches will give you more information, when required.
|
||||
disabled = 0
|
||||
|
||||
panels = ["panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_aws_s3_bucket_details_via_bucketname___response_task", "panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task", "panel://workbench_panel_investigate_aws_activities_via_region_name___response_task"]
|
||||
|
||||
[panel_group://workbench_panel_group_suspicious_cloud_authentication_activities]
|
||||
label = Suspicious Cloud Authentication Activities
|
||||
description = Monitor your cloud authentication events. Searches within this Analytic Story leverage the recent cloud updates to the Authentication data model to help you stay aware of and investigate suspicious login activity.
|
||||
disabled = 0
|
||||
|
||||
panels = ["panel://workbench_panel_investigate_aws_user_activities_by_user_field___response_task"]
|
||||
|
||||
[panel_group://workbench_panel_group_suspicious_cloud_instance_activities]
|
||||
label = Suspicious Cloud Instance Activities
|
||||
description = Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment.
|
||||
disabled = 0
|
||||
|
||||
panels = ["panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task"]
|
||||
|
||||
[panel_group://workbench_panel_group_suspicious_cloud_provisioning_activities]
|
||||
label = Suspicious Cloud Provisioning Activities
|
||||
description = Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment.
|
||||
disabled = 0
|
||||
|
||||
panels = ["panel://workbench_panel_get_notable_history___response_task"]
|
||||
|
||||
[panel_group://workbench_panel_group_suspicious_cloud_user_activities]
|
||||
label = Suspicious Cloud User Activities
|
||||
description = Detect and investigate suspicious activities by users and roles in your cloud environments.
|
||||
disabled = 0
|
||||
|
||||
panels = ["panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task"]
|
||||
|
||||
|
||||
|
||||
Vendored
-881
@@ -1,881 +0,0 @@
|
||||
#############
|
||||
# Automatically generated by generator.py in splunk/security_content
|
||||
# On Date: 2021-12-15T02:51:23 UTC
|
||||
# Author: Splunk Security Research
|
||||
# Contact: research@splunk.com
|
||||
#############
|
||||
|
||||
|
||||
[aws_cloudwatchlogs_eks]
|
||||
definition = sourcetype="aws:cloudwatchlogs:eks"
|
||||
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
|
||||
|
||||
[aws_config]
|
||||
definition = sourcetype=aws:config
|
||||
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
|
||||
|
||||
[aws_description]
|
||||
definition = sourcetype="aws:description"
|
||||
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
|
||||
|
||||
[aws_ecr_users]
|
||||
definition = userName IN (user)
|
||||
description = specify the user allowed to push Images to AWS ECR.
|
||||
|
||||
[aws_s3_accesslogs]
|
||||
definition = sourcetype=aws:s3:accesslogs
|
||||
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
|
||||
|
||||
[aws_securityhub_finding]
|
||||
definition = sourcetype="aws:securityhub:finding"
|
||||
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
|
||||
|
||||
[aws_securityhub_firehose]
|
||||
definition = sourcetype="aws:securityhub:firehose"
|
||||
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
|
||||
|
||||
[brand_abuse_dns]
|
||||
definition = lookup update=true brandMonitoring_lookup domain as query OUTPUT domain_abuse | search domain_abuse=true
|
||||
description = This macro limits the output to only domains that are in the brand monitoring lookup file
|
||||
|
||||
[brand_abuse_email]
|
||||
definition = lookup update=true brandMonitoring_lookup domain as src_user OUTPUT domain_abuse | search domain_abuse=true
|
||||
description = This macro limits the output to only domains that are in the brand monitoring lookup file
|
||||
|
||||
[brand_abuse_web]
|
||||
definition = lookup update=true brandMonitoring_lookup domain as urls OUTPUT domain_abuse | search domain_abuse=true
|
||||
description = This macro limits the output to only domains that are in the brand monitoring lookup file
|
||||
|
||||
[circleci]
|
||||
definition = sourcetype=circleci
|
||||
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
|
||||
|
||||
[cisco_networks]
|
||||
definition = eventtype=cisco_ios
|
||||
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
|
||||
|
||||
[cloud_api_calls_from_previously_unseen_user_roles_activity_window]
|
||||
definition = "-70m@m"
|
||||
description = Use this macro to determine how far back you should be checking for new commands from user roles
|
||||
|
||||
[cloudtrail]
|
||||
definition = sourcetype=aws:cloudtrail
|
||||
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
|
||||
|
||||
[cloudwatch_eks]
|
||||
definition = sourcetype="aws:cloudwatchlogs:eks"
|
||||
description = customer specific splunk configurations(eg- index, source, sourcetype) for AWS cloudwatch eks logs. Replace the macro definition with configurations for your Splunk Environmnent.
|
||||
|
||||
[cloudwatch_vpc]
|
||||
definition = sourcetype=aws:cloudwatchlogs:vpcflow
|
||||
description = customer specific splunk configurations(eg- index, source, sourcetype) for AWS cloudwatch vpc logs. Replace the macro definition with configurations for your Splunk Environmnent.
|
||||
|
||||
[cloudwatchlogs_vpcflow]
|
||||
definition = sourcetype=aws:cloudwatchlogs:vpcflow
|
||||
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
|
||||
|
||||
[dynamic_dns_providers]
|
||||
definition = lookup update=true dynamic_dns_providers_default dynamic_dns_domains as query OUTPUTNEW isDynDNS_default | lookup update=true dynamic_dns_providers_local dynamic_dns_domains as query OUTPUTNEW isDynDNS_local| eval isDynDNS = coalesce(isDynDNS_default, isDynDNS_local)|fields - isDynDNS_default, isDynDNS_local| search isDynDNS=True
|
||||
description = This macro limits the output of the query field to dynamic dns domains. It looks up the domains in a file provided by Splunk and one intended to be updated by the end user.
|
||||
|
||||
[dynamic_dns_web_traffic]
|
||||
definition = lookup update=true dynamic_dns_providers_default dynamic_dns_domains as url OUTPUTNEW isDynDNS_default | lookup update=true dynamic_dns_providers_local dynamic_dns_domains as url OUTPUTNEW isDynDNS_local| eval isDynDNS = coalesce(isDynDNS_default, isDynDNS_local)|fields - isDynDNS_default, isDynDNS_local| search isDynDNS=True
|
||||
description = This is a description
|
||||
|
||||
[ec2_modification_api_calls]
|
||||
definition = (eventName=AssociateAddress OR eventName=AssociateIamInstanceProfile OR eventName=AttachClassicLinkVpc OR eventName=AttachNetworkInterface OR eventName=AttachVolume OR eventName=BundleInstance OR eventName=DetachClassicLinkVpc OR eventName=DetachVolume OR eventName=ModifyInstanceAttribute OR eventName=ModifyInstancePlacement OR eventName=MonitorInstances OR eventName=RebootInstances OR eventName=ResetInstanceAttribute OR eventName=StartInstances OR eventName=StopInstances OR eventName=TerminateInstances OR eventName=UnmonitorInstances)
|
||||
description = This is a list of AWS event names that have to do with modifying Amazon EC2 instances
|
||||
|
||||
[evilginx_phishlets_0365]
|
||||
definition = (query=login* AND query=www*)
|
||||
description = This limits the query fields to domains that are associated with evilginx masquerading as Office 365
|
||||
|
||||
[evilginx_phishlets_amazon]
|
||||
definition = (query=fls-na* AND query = www* AND query=images*)
|
||||
description = This limits the query fields to domains that are associated with evilginx masquerading as Amazon
|
||||
|
||||
[evilginx_phishlets_aws]
|
||||
definition = (query=www* AND query=aws* AND query=console.aws* AND query=signin.aws* AND api-northeast-1.console.aws* AND query=fls-na* AND query=images-na*)
|
||||
description = This limits the query fields to domains that are associated with evilginx masquerading as an AWS console
|
||||
|
||||
[evilginx_phishlets_facebook]
|
||||
definition = (query=www* AND query = m* AND query=static*)
|
||||
description = This limits the query fields to domains that are associated with evilginx masquerading as FaceBook
|
||||
|
||||
[evilginx_phishlets_github]
|
||||
definition = (query=api* AND query = github*)
|
||||
description = This limits the query fields to domains that are associated with evilginx masquerading as GitHub
|
||||
|
||||
[evilginx_phishlets_google]
|
||||
definition = (query=accounts* AND query=ssl* AND query=www*)
|
||||
description = This limits the query fields to domains that are associated with evilginx masquerading as Google
|
||||
|
||||
[evilginx_phishlets_outlook]
|
||||
definition = (query=outlook* AND query=login* AND query=account*)
|
||||
description = This limits the query fields to domains that are associated with evilginx masquerading as Outlook
|
||||
|
||||
[exchange]
|
||||
definition = sourcetype="MSWindows:IIS"
|
||||
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
|
||||
|
||||
[f5_bigip_rogue]
|
||||
definition = index=netops sourcetype="f5:bigip:rogue"
|
||||
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
|
||||
|
||||
[filter_rare_process_allow_list]
|
||||
definition = lookup update=true lookup_rare_process_allow_list_default process as process OUTPUTNEW allow_list | where allow_list="false" | lookup update=true lookup_rare_process_allow_list_local process as process OUTPUT allow_list | where allow_list="false"
|
||||
description = This macro is intended to allow_list processes that have been definied as rare
|
||||
|
||||
[github]
|
||||
definition = sourcetype=aws:firehose:json
|
||||
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
|
||||
|
||||
[github_known_users]
|
||||
definition = user IN (user_names_here)
|
||||
description = specify the user allowed to create PRs in Github projects.
|
||||
|
||||
[google_gcp_pubnet_message]
|
||||
definition = sourcetype="google:gcp:pubsub:message"
|
||||
description = customer specific splunk configurations(eg- index, source, sourcetype) for Google GCP. Replace the macro definition with configurations for your Splunk Environmnent.
|
||||
|
||||
[google_gcp_pubsub_message]
|
||||
definition = sourcetype="google:gcp:pubsub:message"
|
||||
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
|
||||
|
||||
[gsuite_calendar]
|
||||
definition = sourcetype=gsuite:calendar:json
|
||||
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
|
||||
|
||||
[gsuite_drive]
|
||||
definition = sourcetype=gsuite:drive:json
|
||||
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
|
||||
|
||||
[gsuite_gmail]
|
||||
definition = sourcetype=gsuite:gmail:bigquery
|
||||
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
|
||||
|
||||
[is_windows_system_file]
|
||||
definition = lookup update=true is_windows_system_file filename as process_name OUTPUT systemFile | search systemFile=true
|
||||
description = This macro limits the output to process names that are in the Windows System directory
|
||||
|
||||
[kube_objects_events]
|
||||
definition = sourcetype=kube:objects:events
|
||||
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
|
||||
|
||||
[kubernetes_azure]
|
||||
definition = sourcetype=mscs:storage:blob:json
|
||||
description = customer specific splunk configurations(eg- index, source, sourcetype) for Kubernetes data from Azure. Replace the macro definition with configurations for your Splunk Environmnent.
|
||||
|
||||
[kubernetes_container_controller]
|
||||
definition = sourcetype=kube:container:controller
|
||||
description = customer specific splunk configurations(eg- index, source, sourcetype) for Kubernetes data. Replace the macro definition with configurations for your Splunk Environmnent.
|
||||
|
||||
[linux_hosts]
|
||||
definition = index=*
|
||||
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
|
||||
|
||||
[linux_shells]
|
||||
definition = (Processes.process_name IN ("sh", "ksh", "zsh", "bash", "dash", "rbash", "fish", "csh', "tcsh', "ion", "eshell"))
|
||||
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
|
||||
|
||||
[netbackup]
|
||||
definition = sourcetype="netbackup_logs"
|
||||
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
|
||||
|
||||
[network_acl_events]
|
||||
definition = (eventName = CreateNetworkAcl OR eventName = CreateNetworkAclEntry OR eventName = DeleteNetworkAcl OR eventName = DeleteNetworkAclEntry OR eventName = ReplaceNetworkAclEntry OR eventName = ReplaceNetworkAclAssociation)
|
||||
description = This is a list of AWS event names that are associated with Network ACLs
|
||||
|
||||
[notable]
|
||||
definition = index=notable
|
||||
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
|
||||
|
||||
[o365_management_activity]
|
||||
definition = sourcetype=o365:management:activity
|
||||
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
|
||||
|
||||
[okta]
|
||||
definition = eventtype=okta_log
|
||||
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
|
||||
|
||||
[osquery_process]
|
||||
definition = eventtype="osquery-process"
|
||||
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
|
||||
|
||||
[powershell]
|
||||
definition = (source=WinEventLog:Microsoft-Windows-PowerShell/Operational OR source="XmlWinEventLog:Microsoft-Windows-PowerShell/Operational")
|
||||
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
|
||||
|
||||
[previously_seen_cloud_api_calls_per_user_role_forget_window]
|
||||
definition = "-90d@d"
|
||||
description = Use this macro to determine how long to keep track of cloud api calls per user role
|
||||
|
||||
[previously_seen_cloud_compute_creations_by_user_search_window_begin_offset]
|
||||
definition = "-70m@m"
|
||||
description = Use this macro to determine how far into the past the window should be to determine if the user is new or not
|
||||
|
||||
[previously_seen_cloud_compute_image_search_window_begin_offset]
|
||||
definition = "-70m@m"
|
||||
description = Use this macro to determine how far into the past the window should be to determine if the image is new or not
|
||||
|
||||
[previously_seen_cloud_compute_images_forget_window]
|
||||
definition = "-90d@d"
|
||||
description = Use this macro to determine how long to keep track of cloud instance images
|
||||
|
||||
[previously_seen_cloud_compute_instance_type_forget_window]
|
||||
definition = "-90d@d"
|
||||
description = Use this macro to determine how long to keep track of cloud instance types
|
||||
|
||||
[previously_seen_cloud_compute_instance_types_search_window_begin_offset]
|
||||
definition = "-70m@m"
|
||||
description = Use this macro to determine how far into the past the window should be to determine if the instance type is new or not
|
||||
|
||||
[previously_seen_cloud_instance_modifications_by_user_search_window_begin_offset]
|
||||
definition = "-70m@m"
|
||||
description = Use this macro to determine how far into the past the window should be to determine if the user is new or not
|
||||
|
||||
[previously_seen_cloud_provisioning_activity_forget_window]
|
||||
definition = "-90d@d"
|
||||
description = Use this macro to determine how long to keep track of cloud provisioning locations
|
||||
|
||||
[previously_seen_cloud_region_forget_window]
|
||||
definition = "-90d@d"
|
||||
description = Use this macro to determine how long to keep track of cloud regions
|
||||
|
||||
[previously_seen_cloud_regions_search_window_begin_offset]
|
||||
definition = "-70m@m"
|
||||
description = Use this macro to determine how far into the past the window should be to determine if the region is new or not
|
||||
|
||||
[previously_seen_windows_services_forget_window]
|
||||
definition = "-90d@d"
|
||||
description = Use this macro to determine how long to keep track of Windows services
|
||||
|
||||
[previously_seen_windows_services_window]
|
||||
definition = "-70m@m"
|
||||
description = Use this macro to determine how far back you should be checking for new Windows services
|
||||
|
||||
[previously_seen_zoom_child_processes_forget_window]
|
||||
definition = "-90d@d"
|
||||
description = Use this macro to determine how long to keep track of zoom child processes
|
||||
|
||||
[previously_seen_zoom_child_processes_window]
|
||||
definition = "-70m@m"
|
||||
description = Use this macro to determine how far back you should be checking for new zoom child processes
|
||||
|
||||
[previously_unseen_cloud_provisioning_activity_window]
|
||||
definition = "-70m@m"
|
||||
description = Use this macro to determine how far back you should be checking for new provisioning activities
|
||||
|
||||
[printservice]
|
||||
definition = source="wineventlog:microsoft-windows-printservice/operational" OR sourcetype="WinEventLog:Microsoft-Windows-PrintService/Admin"
|
||||
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
|
||||
|
||||
[process_bitsadmin]
|
||||
definition = (Processes.process_name=bitsadmin.exe OR Processes.original_file_name=bitsadmin.exe)
|
||||
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
|
||||
|
||||
[process_certutil]
|
||||
definition = (Processes.process_name=certutil.exe OR Processes.original_file_name=CertUtil.exe)
|
||||
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
|
||||
|
||||
[process_cmd]
|
||||
definition = (Processes.process_name=cmd.exe OR Processes.original_file_name=Cmd.Exe)
|
||||
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
|
||||
|
||||
[process_copy]
|
||||
definition = (Processes.process_name=copy.exe OR Processes.original_file_name=copy.exe OR Processes.process_name=xcopy.exe OR Processes.original_file_name=xcopy.exe)
|
||||
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
|
||||
|
||||
[process_csc]
|
||||
definition = (Processes.process_name=csc.exe OR Processes.original_file_name=csc.exe)
|
||||
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
|
||||
|
||||
[process_curl]
|
||||
definition = (Processes.process_name=curl.exe OR Processes.original_file_name=Curl.exe)
|
||||
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
|
||||
|
||||
[process_dllhost]
|
||||
definition = (Processes.process_name=dllhost.exe OR Processes.original_file_name=dllhost.exe)
|
||||
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
|
||||
|
||||
[process_dsquery]
|
||||
definition = (Processes.process_name=dsquery.exe OR Processes.original_file_name=dsquery.exe)
|
||||
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
|
||||
|
||||
[process_dxdiag]
|
||||
definition = (Processes.process_name=dxdiag.exe OR Processes.original_file_name=dxdiag.exe)
|
||||
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
|
||||
|
||||
[process_esentutl]
|
||||
definition = (Processes.process_name=esentutl.exe OR Processes.original_file_name=esentutl.exe)
|
||||
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
|
||||
|
||||
[process_fodhelper]
|
||||
definition = (Processes.process_name=fodhelper.exe OR Processes.original_file_name=FodHelper.EXE)
|
||||
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
|
||||
|
||||
[process_gpupdate]
|
||||
definition = (Processes.process_name=gpupdate.exe OR Processes.original_file_name=GPUpdate.exe)
|
||||
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
|
||||
|
||||
[process_hh]
|
||||
definition = (Processes.process_name=hh.exe OR Processes.original_file_name=HH.EXE)
|
||||
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
|
||||
|
||||
[process_installutil]
|
||||
definition = (Processes.process_name=installutil.exe OR Processes.original_file_name=InstallUtil.exe)
|
||||
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
|
||||
|
||||
[process_microsoftworkflowcompiler]
|
||||
definition = (Processes.process_name=microsoft.workflow.compiler.exe OR Processes.original_file_name=Microsoft.Workflow.Compiler.exe)
|
||||
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
|
||||
|
||||
[process_msbuild]
|
||||
definition = (Processes.process_name=msbuild.exe OR Processes.original_file_name=MSBuild.exe)
|
||||
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
|
||||
|
||||
[process_mshta]
|
||||
definition = (Processes.process_name=mshta.exe OR Processes.original_file_name=MSHTA.EXE)
|
||||
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
|
||||
|
||||
[process_net]
|
||||
definition = (Processes.process_name="net.exe" OR Processes.original_file_name="net.exe" OR Processes.process_name="net1.exe" OR Processes.original_file_name="net1.exe")
|
||||
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
|
||||
|
||||
[process_netsh]
|
||||
definition = (Processes.process_name=netsh.exe OR Processes.original_file_name=netsh.exe)
|
||||
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
|
||||
|
||||
[process_nltest]
|
||||
definition = (Processes.process_name=nltest.exe OR Processes.original_file_name=nltestrk.exe)
|
||||
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
|
||||
|
||||
[process_ntdsutil]
|
||||
definition = (Processes.process_name=ntdsutil.exe OR Processes.original_file_name=ntdsutil.exe)
|
||||
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
|
||||
|
||||
[process_powershell]
|
||||
definition = (Processes.process_name=pwsh.exe OR Processes.process_name=sqlps.exe OR Processes.process_name=sqltoolsps.exe OR Processes.process_name=powershell.exe OR Processes.process_name=powershell_ise.exe OR Processes.original_file_name=pwsh.dll OR Processes.original_file_name=PowerShell.EXE OR Processes.original_file_name=powershell_ise.EXE)
|
||||
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
|
||||
|
||||
[process_procdump]
|
||||
definition = (Processes.process_name=procdump.exe OR Processes.process_name=procdump64.exe OR Processes.original_file_name=procdump)
|
||||
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
|
||||
|
||||
[process_psexec]
|
||||
definition = (Processes.process_name=psexec.exe OR Processes.process_name=psexec64.exe OR Processes.original_file_name=psexec.c)
|
||||
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
|
||||
|
||||
[process_rclone]
|
||||
definition = (Processes.original_file_name=rclone.exe OR Processes.process_name=rclone.exe)
|
||||
description = Matches the process with its original file name.
|
||||
|
||||
[process_reg]
|
||||
definition = (Processes.process_name=reg.exe OR Processes.original_file_name=reg.exe)
|
||||
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
|
||||
|
||||
[process_regasm]
|
||||
definition = (Processes.process_name=regasm.exe OR Processes.original_file_name=RegAsm.exe)
|
||||
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
|
||||
|
||||
[process_regsvcs]
|
||||
definition = (Processes.process_name=regsvcs.exe OR Processes.original_file_name=RegSvcs.exe)
|
||||
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
|
||||
|
||||
[process_regsvr32]
|
||||
definition = (Processes.process_name=regsvr32.exe OR Processes.original_file_name=REGSVR32.EXE)
|
||||
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
|
||||
|
||||
[process_route]
|
||||
definition = (Processes.process_name=route.exe OR Processes.original_file_name=route.exe)
|
||||
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
|
||||
|
||||
[process_runas]
|
||||
definition = (Processes.process_name=runas.exe OR Processes.original_file_name=runas.exe)
|
||||
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
|
||||
|
||||
[process_rundll32]
|
||||
definition = (Processes.process_name=rundll32.exe OR Processes.original_file_name=RUNDLL32.EXE)
|
||||
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
|
||||
|
||||
[process_schtasks]
|
||||
definition = (Processes.process_name=schtasks.exe OR Processes.original_file_name=schtasks.exe)
|
||||
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
|
||||
|
||||
[process_sdelete]
|
||||
definition = (Processes.process_name=sdelete.exe OR Processes.original_file_name=sdelete.exe)
|
||||
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
|
||||
|
||||
[process_setspn]
|
||||
definition = (Processes.process_name=setspn.exe OR Processes.original_file_name=setspn.exe)
|
||||
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
|
||||
|
||||
[process_verclsid]
|
||||
definition = (Processes.process_name=verclsid.exe OR Processes.original_file_name=verclsid.exe)
|
||||
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
|
||||
|
||||
[process_vssadmin]
|
||||
definition = (Processes.process_name=vssadmin.exe OR Processes.original_file_name=VSSADMIN.EXE)
|
||||
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
|
||||
|
||||
[process_wbadmin]
|
||||
definition = (Processes.process_name=wbadmin.exe OR Processes.original_file_name=WBADMIN.EXE)
|
||||
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
|
||||
|
||||
[process_wmic]
|
||||
definition = (Processes.process_name=wmic.exe OR Processes.original_file_name=wmic.exe)
|
||||
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
|
||||
|
||||
[prohibited_apps_launching_cmd]
|
||||
definition = | inputlookup prohibited_apps_launching_cmd | rename prohibited_applications as parent_process_name | eval parent_process_name="*" . parent_process_name | table parent_process_name
|
||||
description = This macro outputs a list of process that should not be the parent process of cmd.exe
|
||||
|
||||
[prohibited_softwares]
|
||||
definition = lookup prohibited_softwares app as process_name OUTPUT is_prohibited | search is_prohibited=True
|
||||
description = This macro limits the output to process_names that have been marked as prohibited
|
||||
|
||||
[ransomware_extensions]
|
||||
definition = lookup update=true ransomware_extensions_lookup Extensions AS file_extension OUTPUT Name | search Name !=False
|
||||
description = This macro limits the output to files that have extensions associated with ransomware
|
||||
|
||||
[ransomware_notes]
|
||||
definition = lookup ransomware_notes_lookup ransomware_notes as file_name OUTPUT status as "Known Ransomware Notes" | search "Known Ransomware Notes"=True
|
||||
description = This macro limits the output to files that have been identified as a ransomware note
|
||||
|
||||
[remove_valid_domains]
|
||||
definition = eval domain=trim(domain,"*") | search NOT[| inputlookup domains] NOT[ |inputlookup cim_corporate_email_domain_lookup] NOT[inputlookup cim_corporate_web_domain_lookup] | eval domain="*"+domain+"*"
|
||||
description = This macro removes valid domains from the output
|
||||
|
||||
[s3_accesslogs]
|
||||
definition = sourcetype=aws:s3:accesslogs
|
||||
description = customer specific splunk configurations(eg- index, source, sourcetype) for AWS cloudwatch vpc logs. Replace the macro definition with configurations for your Splunk Environmnent.
|
||||
|
||||
[security_content_ctime(1)]
|
||||
args = field
|
||||
definition = convert timeformat="%Y-%m-%dT%H:%M:%S" ctime($field$)
|
||||
description = convert epoch time to string
|
||||
|
||||
[security_content_summariesonly]
|
||||
definition = summariesonly=false allow_old_summaries=true
|
||||
description = search data model's summaries only
|
||||
|
||||
[security_group_api_calls]
|
||||
definition = (eventName=AuthorizeSecurityGroupIngress OR eventName=CreateSecurityGroup OR eventName=DeleteSecurityGroup OR eventName=DescribeClusterSecurityGroups OR eventName=DescribeDBSecurityGroups OR eventName=DescribeSecurityGroupReferences OR eventName=DescribeSecurityGroups OR eventName=DescribeStaleSecurityGroups OR eventName=RevokeSecurityGroupIngress OR eventName=UpdateSecurityGroupRuleDescriptionsIngress)
|
||||
description = This macro is a list of AWS event names associated with security groups
|
||||
|
||||
[signals]
|
||||
definition = index=signals
|
||||
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
|
||||
|
||||
[stream_dns]
|
||||
definition = sourcetype=stream:dns
|
||||
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
|
||||
|
||||
[stream_http]
|
||||
definition = sourcetype=stream:http
|
||||
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
|
||||
|
||||
[stream_tcp]
|
||||
definition = sourcetype=stream:tcp
|
||||
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
|
||||
|
||||
[suspicious_email_attachments]
|
||||
definition = lookup update=true is_suspicious_file_extension_lookup file_name OUTPUT suspicious | search suspicious=true
|
||||
description = This macro limits the output to email attachments that have suspicious extensions
|
||||
|
||||
[suspicious_writes]
|
||||
definition = lookup suspicious_writes_lookup file as file_name OUTPUT note as "Reference" | search "Reference" != False
|
||||
description = This macro limites the output to file names that have been marked as suspicious
|
||||
|
||||
[sysmon]
|
||||
definition = sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational OR source=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational OR source=Syslog:Linux-Sysmon/Operational
|
||||
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
|
||||
|
||||
[system_network_configuration_discovery_tools]
|
||||
definition = (process_name= "arp.exe" OR process_name= "at.exe" OR process_name= "attrib.exe" OR process_name= "cscript.exe" OR process_name= "dsquery.exe" OR process_name= "hostname.exe" OR process_name= "ipconfig.exe" OR process_name= "mimikatz.exe" OR process_name= "nbstat.exe" OR process_name= "net.exe" OR process_name= "netsh.exe" OR process_name= "nslookup.exe" OR process_name= "ping.exe" OR process_name= "quser.exe" OR process_name= "qwinsta.exe" OR process_name= "reg.exe" OR process_name= "runas.exe" OR process_name= "sc.exe" OR process_name= "schtasks.exe" OR process_name= "ssh.exe" OR process_name= "systeminfo.exe" OR process_name= "taskkill.exe" OR process_name= "telnet.exe" OR process_name= "tracert.exe" OR process_name="wscript.exe" OR process_name= "xcopy.exe")
|
||||
description = This macro is a list of process that can be used to discover the network configuration
|
||||
|
||||
[uncommon_processes]
|
||||
definition = lookup update=true lookup_uncommon_processes_default process_name as process_name outputnew uncommon_default,category_default,analytic_story_default,kill_chain_phase_default,mitre_attack_default | lookup update=true lookup_uncommon_processes_local process_name as process_name outputnew uncommon_local,category_local,analytic_story_local,kill_chain_phase_local,mitre_attack_local | eval uncommon = coalesce(uncommon_default, uncommon_local), analytic_story = coalesce(analytic_story_default, analytic_story_local), category=coalesce(category_default, category_local), kill_chain_phase=coalesce(kill_chain_phase_default, kill_chain_phase_local), mitre_attack=coalesce(mitre_attack_default, mitre_attack_local) | fields - analytic_story_default, analytic_story_local, category_default, category_local, kill_chain_phase_default, kill_chain_phase_local, mitre_attack_default, mitre_attack_local, uncommon_default, uncommon_local | search uncommon=true
|
||||
description = This macro limits the output to processes that have been marked as uncommon
|
||||
|
||||
[windows_shells]
|
||||
definition = (Processes.process_name=cmd.exe OR Processes.process_name=powershell.exe)
|
||||
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
|
||||
|
||||
[wineventlog_security]
|
||||
definition = eventtype=wineventlog_security
|
||||
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
|
||||
|
||||
[wineventlog_system]
|
||||
definition = eventtype=wineventlog_system
|
||||
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
|
||||
|
||||
[wineventlog_task_scheduler]
|
||||
definition = source="WinEventLog:Microsoft-Windows-TaskScheduler/Operational"
|
||||
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
|
||||
|
||||
[wmi]
|
||||
definition = sourcetype="wineventlog:microsoft-windows-wmi-activity/operational"
|
||||
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
|
||||
|
||||
[zeek_rpc]
|
||||
definition = index=zeek sourcetype="zeek:rpc:json"
|
||||
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
|
||||
|
||||
[zeek_ssl]
|
||||
definition = index=zeek sourcetype="zeek:ssl:json"
|
||||
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
|
||||
|
||||
[abnormally_high_number_of_cloud_infrastructure_api_calls_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[abnormally_high_number_of_cloud_security_group_api_calls_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[amazon_eks_kubernetes_activity_by_src_ip_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[aws_create_policy_version_to_allow_all_resources_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[aws_createaccesskey_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[aws_createloginprofile_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[aws_cross_account_activity_from_previously_unseen_account_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[aws_detect_users_creating_keys_with_encrypt_policy_without_mfa_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[aws_detect_users_with_kms_keys_performing_encryption_s3_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[aws_excessive_security_scanning_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[aws_iam_accessdenied_discovery_events_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[aws_iam_assume_role_policy_brute_force_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[aws_iam_delete_policy_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[aws_iam_failure_group_deletion_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[aws_iam_successful_group_deletion_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[aws_investigate_security_hub_alerts_by_dest_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[aws_investigate_user_activities_by_accesskeyid_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[aws_investigate_user_activities_by_arn_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[aws_network_access_control_list_created_with_all_open_ports_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[aws_network_access_control_list_deleted_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[aws_network_acl_details_from_id_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[aws_network_interface_details_via_resourceid_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[aws_s3_bucket_details_via_bucketname_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[aws_saml_access_by_provider_user_and_principal_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[aws_saml_update_identity_provider_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[aws_setdefaultpolicyversion_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[aws_updateloginprofile_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[baseline_of_cloud_infrastructure_api_calls_per_user_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[baseline_of_cloud_instances_destroyed_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[baseline_of_cloud_instances_launched_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[baseline_of_cloud_security_group_api_calls_per_user_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[cloud_api_calls_from_previously_unseen_user_roles_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[cloud_compute_instance_created_by_previously_unseen_user_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[cloud_compute_instance_created_in_previously_unused_region_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[cloud_compute_instance_created_with_previously_unseen_image_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[cloud_compute_instance_created_with_previously_unseen_instance_type_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[cloud_instance_modified_by_previously_unseen_user_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[cloud_provisioning_activity_from_previously_unseen_city_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[cloud_provisioning_activity_from_previously_unseen_country_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[cloud_provisioning_activity_from_previously_unseen_ip_address_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[cloud_provisioning_activity_from_previously_unseen_region_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[detect_aws_console_login_by_new_user_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[detect_aws_console_login_by_user_from_new_city_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[detect_aws_console_login_by_user_from_new_country_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[detect_aws_console_login_by_user_from_new_region_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[detect_new_open_s3_buckets_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[detect_new_open_s3_buckets_over_aws_cli_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[detect_shared_ec2_snapshot_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[detect_spike_in_aws_security_hub_alerts_for_ec2_instance_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[get_all_aws_activity_from_city_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[get_all_aws_activity_from_country_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[get_all_aws_activity_from_ip_address_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[get_all_aws_activity_from_region_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[get_ec2_instance_details_by_instanceid_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[get_ec2_launch_details_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[investigate_aws_activities_via_region_name_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[investigate_aws_user_activities_by_user_field_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[o365_add_app_role_assignment_grant_user_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[o365_added_service_principal_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[o365_bypass_mfa_via_trusted_ip_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[o365_disable_mfa_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[o365_excessive_authentication_failures_alert_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[o365_excessive_sso_logon_errors_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[o365_new_federated_domain_added_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[o365_pst_export_alert_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[o365_suspicious_admin_email_forwarding_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[o365_suspicious_rights_delegation_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[o365_suspicious_user_email_forwarding_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[previously_seen_aws_cross_account_activity___initial_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[previously_seen_aws_cross_account_activity___update_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[previously_seen_cloud_api_calls_per_user_role___initial_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[previously_seen_cloud_api_calls_per_user_role___update_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[previously_seen_cloud_compute_creations_by_user___initial_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[previously_seen_cloud_compute_creations_by_user___update_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[previously_seen_cloud_compute_images___initial_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[previously_seen_cloud_compute_images___update_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[previously_seen_cloud_compute_instance_types___initial_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[previously_seen_cloud_compute_instance_types___update_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[previously_seen_cloud_instance_modifications_by_user___initial_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[previously_seen_cloud_instance_modifications_by_user___update_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[previously_seen_cloud_provisioning_activity_sources___initial_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[previously_seen_cloud_provisioning_activity_sources___update_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[previously_seen_cloud_regions___initial_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[previously_seen_cloud_regions___update_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[previously_seen_users_in_cloudtrail___initial_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[previously_seen_users_in_cloudtrail___update_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[abnormally_high_number_of_cloud_instances_destroyed_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[abnormally_high_number_of_cloud_instances_launched_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
Vendored
-6
@@ -1,6 +0,0 @@
|
||||
[eai:conf-analytic_stories]
|
||||
capability.write = admin_all_objects
|
||||
|
||||
[admin:content-version]
|
||||
match = /content-version
|
||||
members = conf
|
||||
-2815
File diff suppressed because it is too large
Load Diff
Vendored
-283
@@ -1,283 +0,0 @@
|
||||
#############
|
||||
# Automatically generated by generator.py in splunk/security_content
|
||||
# On Date: 2021-12-15T02:51:23 UTC
|
||||
# Author: Splunk Security Research
|
||||
# Contact: research@splunk.com
|
||||
#############
|
||||
|
||||
[api_call_by_user_baseline]
|
||||
collection = api_call_by_user_baseline
|
||||
external_type = kvstore
|
||||
# description = A collection that will contain the baseline information for number of AWS API calls per user
|
||||
fields_list = arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls
|
||||
|
||||
[attacker_tools]
|
||||
filename = attacker_tools.csv
|
||||
default_match = false
|
||||
case_sensitive_match = false
|
||||
# description = A list of tools used by attackers
|
||||
match_type = WILDCARD(attacker_tool_names)
|
||||
min_matches = 1
|
||||
|
||||
[aws_service_accounts]
|
||||
filename = aws_service_accounts.csv
|
||||
# description = A lookup file that will contain AWS Service accounts
|
||||
|
||||
[baseline_blocked_outbound_connections]
|
||||
filename = baseline_blocked_outbound_connections.csv
|
||||
# description = A lookup file that will contain the baseline information for number of blocked outbound connections
|
||||
|
||||
[brandMonitoring_lookup]
|
||||
filename = brand_monitoring.csv
|
||||
default_match = false
|
||||
# description = A file that contains look-a-like domains for brands that you want to monitor
|
||||
match_type = WILDCARD(domain)
|
||||
min_matches = 1
|
||||
|
||||
[cloud_instances_enough_data]
|
||||
collection = cloud_instances_enough_data
|
||||
external_type = kvstore
|
||||
default_match = false
|
||||
# description = A lookup to determine if you have a sufficient amount of time has passed to collect cloud instance data for behavioral searches
|
||||
match_type = WILDCARD(filter)
|
||||
fields_list = _key, filter, enough_data
|
||||
|
||||
[csc_lookup]
|
||||
filename = csc_lookup.csv
|
||||
# description = The CSC control numbers and names
|
||||
min_matches = 1
|
||||
|
||||
[discovered_dns_records]
|
||||
filename = discovered_dns_records.csv
|
||||
default_match = false
|
||||
# description = A placeholder for a list of discovered DNS records generated by the baseline discover_dns_records
|
||||
min_matches = 1
|
||||
|
||||
[domains]
|
||||
filename = domains.csv
|
||||
# description = A list of domains that can be ignored
|
||||
|
||||
[dynamic_dns_providers_default]
|
||||
filename = dynamic_dns_providers_default.csv
|
||||
case_sensitive_match = false
|
||||
# description = A list of dynammic dns providers that should not be modified
|
||||
match_type = WILDCARD(dynamic_dns_domains)
|
||||
|
||||
[dynamic_dns_providers_local]
|
||||
filename = dynamic_dns_providers_local.csv
|
||||
case_sensitive_match = false
|
||||
# description = A list of dynammic dns providers that can be modified
|
||||
match_type = WILDCARD(dynamic_dns_domains)
|
||||
|
||||
[escu_search_id_lookup]
|
||||
filename = escu_search_id.csv
|
||||
# description = A placeholder lookup file to hold information for ESCU Usage dashboard
|
||||
|
||||
[images_to_repository]
|
||||
filename = images_to_repository.csv
|
||||
# description = Mapping images to repositories
|
||||
|
||||
[is_suspicious_file_extension_lookup]
|
||||
filename = is_suspicious_file_extension_lookup.csv
|
||||
# description = A list of suspicious extensions for email attachments
|
||||
match_type = WILDCARD(file_name)
|
||||
|
||||
[is_windows_system_file]
|
||||
filename = is_windows_system_file.csv
|
||||
default_match = false
|
||||
# description = A full baseline of executable files in Windows\System32 and Windows\Syswow64, including sub-directories from Server 2016 and Windows 10.
|
||||
min_matches = 1
|
||||
|
||||
[legit_domains]
|
||||
filename = legit_domains.csv
|
||||
# description = A list of legit domains to be used as an ignore list for possible phishing sites
|
||||
|
||||
[local_file_inclusion_paths]
|
||||
filename = local_file_inclusion_paths.csv
|
||||
default_match = false
|
||||
case_sensitive_match = false
|
||||
# description = A list of interesting files in a local file inclusion attack
|
||||
match_type = WILDCARD(local_file_inclusion_paths)
|
||||
min_matches = 1
|
||||
|
||||
[lookup_rare_process_allow_list_default]
|
||||
filename = rare_process_allow_list_default.csv
|
||||
default_match = false
|
||||
case_sensitive_match = false
|
||||
# description = A list of rare processes that are legitimate that is provided by Splunk
|
||||
match_type = WILDCARD(process)
|
||||
min_matches = 1
|
||||
|
||||
[lookup_rare_process_allow_list_local]
|
||||
filename = rare_process_allow_list_local.csv
|
||||
default_match = false
|
||||
case_sensitive_match = false
|
||||
# description = A list of rare processes that are legitimate provided by the end user
|
||||
match_type = WILDCARD(process)
|
||||
min_matches = 1
|
||||
|
||||
[lookup_uncommon_processes_default]
|
||||
filename = uncommon_processes_default.csv
|
||||
case_sensitive_match = false
|
||||
# description = A list of processes that are not common
|
||||
match_type = WILDCARD(process)
|
||||
|
||||
[lookup_uncommon_processes_local]
|
||||
filename = uncommon_processes_local.csv
|
||||
case_sensitive_match = false
|
||||
# description = A list of processes that are not common
|
||||
match_type = WILDCARD(process)
|
||||
|
||||
[mandatory_job_for_workflow]
|
||||
filename = mandatory_job_for_workflow.csv
|
||||
# description = A lookup file that will be used to define the mandatory job for workflow
|
||||
|
||||
[mandatory_step_for_job]
|
||||
filename = mandatory_step_for_job.csv
|
||||
# description = A lookup file that will be used to define the mandatory step for job
|
||||
|
||||
[network_acl_activity_baseline]
|
||||
filename = network_acl_activity_baseline.csv
|
||||
# description = A lookup file that will contain the baseline information for number of AWS Network ACL Activity
|
||||
|
||||
[previously_seen_S3_access_from_remote_ip]
|
||||
filename = previously_seen_S3_access_from_remote_ip.csv
|
||||
# description = A placeholder for a list of IPs that have access S3
|
||||
|
||||
[previously_seen_api_calls_from_user_roles]
|
||||
filename = previously_seen_api_calls_from_user_roles.csv
|
||||
# description = A placeholder for a list of AWS API calls for each user role
|
||||
|
||||
[previously_seen_aws_cross_account_activity]
|
||||
filename = previously_seen_aws_cross_account_activity.csv
|
||||
# description = A placeholder for a list of AWS accounts and assumed roles
|
||||
|
||||
[previously_seen_aws_regions]
|
||||
filename = previously_seen_aws_regions.csv
|
||||
default_match = false
|
||||
# description = A place holder for a list of used AWS regions
|
||||
min_matches = 1
|
||||
|
||||
[previously_seen_cloud_api_calls_per_user_role]
|
||||
collection = previously_seen_cloud_api_calls_per_user_role
|
||||
external_type = kvstore
|
||||
# description = A table of users, commands, and the first and last time that they have been seen
|
||||
fields_list = _key, user, command, firstTimeSeen, lastTimeSeen, enough_data
|
||||
|
||||
[previously_seen_cloud_compute_creations_by_user]
|
||||
collection = previously_seen_cloud_compute_creations_by_user
|
||||
external_type = kvstore
|
||||
# description = A table of previously seen users creating cloud instances
|
||||
fields_list = _key, firstTimeSeen, lastTimeSeen, user, enough_data
|
||||
|
||||
[previously_seen_cloud_compute_images]
|
||||
collection = previously_seen_cloud_compute_images
|
||||
external_type = kvstore
|
||||
# description = A table of previously seen Cloud image IDs
|
||||
fields_list = _key, firstTimeSeen, lastTimeSeen, image_id, enough_data
|
||||
|
||||
[previously_seen_cloud_compute_instance_types]
|
||||
collection = previously_seen_cloud_compute_instance_types
|
||||
external_type = kvstore
|
||||
# description = A place holder for a list of used cloud compute instance types
|
||||
fields_list = _key, firstTimeSeen, lastTimeSeen, instance_type, enough_data
|
||||
|
||||
[previously_seen_cloud_instance_modifications_by_user]
|
||||
collection = previously_seen_cloud_instance_modifications_by_user
|
||||
external_type = kvstore
|
||||
# description = A table of users seen making instance modifications, and the first and last time that the activity was observed
|
||||
fields_list = _key, firstTimeSeen, lastTimeSeen, user, enough_data
|
||||
|
||||
[previously_seen_cloud_provisioning_activity_sources]
|
||||
collection = previously_seen_cloud_provisioning_activity_sources
|
||||
external_type = kvstore
|
||||
# description = A table of source IPs, geographic locations, and the first and last time that they have that done cloud provisioning activities
|
||||
fields_list = _key, src, City, Country, Region, firstTimeSeen, lastTimeSeen, enough_data
|
||||
|
||||
[previously_seen_cloud_regions]
|
||||
collection = previously_seen_cloud_regions
|
||||
external_type = kvstore
|
||||
# description = A table of vendor_region values and the first and last time that they have been observed in cloud provisioning activities
|
||||
fields_list = _key, firstTimeSeen, lastTimeSeen, vendor_region, enough_data
|
||||
|
||||
[previously_seen_cmd_line_arguments]
|
||||
filename = previously_seen_cmd_line_arguments.csv
|
||||
# description = A placeholder for a list of cmd line arugments that been seen before
|
||||
|
||||
[previously_seen_ec2_modifications_by_user]
|
||||
filename = previously_seen_ec2_modifications_by_user.csv
|
||||
# description = A place holder for a list of AWS EC2 modifications done by each user
|
||||
|
||||
[previously_seen_running_windows_services]
|
||||
collection = previously_seen_running_windows_services
|
||||
external_type = kvstore
|
||||
# description = A placeholder for the list of Windows Services running
|
||||
fields_list = _key, service, firstTimeSeen, lastTimeSeen
|
||||
|
||||
[previously_seen_users_console_logins]
|
||||
collection = previously_seen_users_console_logins
|
||||
external_type = kvstore
|
||||
# description = A table of users seen doing console logins, and the first and last time that the activity was observed
|
||||
fields_list = _key, firstTime, lastTime, user, src, City, Region, Country
|
||||
|
||||
[prohibited_apps_launching_cmd]
|
||||
filename = prohibited_apps_launching_cmd.csv
|
||||
# description = A list of processes that should not be launching cmd.exe
|
||||
match_type = WILDCARD(prohibited_applications)
|
||||
|
||||
[prohibited_processes]
|
||||
filename = prohibited_processes.csv
|
||||
# description = A list of processes that have been marked as prohibited
|
||||
|
||||
[prohibited_softwares]
|
||||
filename = prohibited_softwares.csv
|
||||
# description = A list of processes that have been marked as prohibited
|
||||
|
||||
[ransomware_extensions_lookup]
|
||||
filename = ransomware_extensions.csv
|
||||
default_match = false
|
||||
case_sensitive_match = false
|
||||
# description = A list of file extensions that are associated with ransomware
|
||||
match_type = WILDCARD(Extensions)
|
||||
min_matches = 1
|
||||
|
||||
[ransomware_notes_lookup]
|
||||
filename = ransomware_notes.csv
|
||||
default_match = false
|
||||
# description = A list of file names that are ransomware note files
|
||||
match_type = WILDCARD(ransomware_notes)
|
||||
min_matches = 1
|
||||
|
||||
[s3_deletion_baseline]
|
||||
filename = s3_deletion_baseline.csv
|
||||
# description = A placeholder for the baseline information for AWS S3 deletions
|
||||
|
||||
[security_group_activity_baseline]
|
||||
filename = security_group_activity_baseline.csv
|
||||
# description = A placeholder for the baseline information for AWS security groups
|
||||
|
||||
[security_services_lookup]
|
||||
filename = security_services.csv
|
||||
default_match = false
|
||||
# description = A list of services that deal with security
|
||||
match_type = WILDCARD(service)
|
||||
min_matches = 1
|
||||
|
||||
[suspicious_writes_lookup]
|
||||
filename = suspicious_files.csv
|
||||
default_match = false
|
||||
# description = A list of suspicious file names
|
||||
match_type = WILDCARD(file)
|
||||
min_matches = 1
|
||||
|
||||
[zoom_first_time_child_process]
|
||||
collection = zoom_first_time_child_process
|
||||
external_type = kvstore
|
||||
# description = A list of suspicious file names
|
||||
fields_list = _key, dest, process_name, firstTimeSeen, lastTimeSeen
|
||||
|
||||
|
||||
### Default transforms definitions for the lookup files we ship ###
|
||||
[mitre_enrichment]
|
||||
filename = mitre_enrichment.csv
|
||||
# description = A lookup file that is created by generate.py
|
||||
-2
@@ -1,2 +0,0 @@
|
||||
### Deprecated since ESCU UI was deprecated and this conf file is no longer in use
|
||||
### Using one single file analyticstories.conf that will be used both by ES and ESCU
|
||||
-1
@@ -1 +0,0 @@
|
||||
|
||||
-27
@@ -1,27 +0,0 @@
|
||||
attacker_tool_names,description
|
||||
remcom.exe,This process is an open source replacement to psexec and is not typically seen in an enterprise environment.
|
||||
pwdump.exe,This process is associated with a tool used to dump password hashes on a Windows system.
|
||||
pwdump2.exe,This process is associated with a tool used to dump password hashes on a Windows system.
|
||||
nc.exe,This process is an open source tool used for network communications.
|
||||
wce.exe,This process is associated with a tool used to dump hashes and execute pass-the-hash and pass-the-ticket attacks.
|
||||
cain.exe,This process is associated with a tool used to collect user credentials and execute attacks.
|
||||
nmap.exe,This process is an open source network mapping tool used to identify hosts and listening services on a network.
|
||||
kidlogger.exe,This process is associated with a tool used to collect keyboard input on a host.
|
||||
isass.exe,This process name is used by attackers to hide in plain sight and look like a legitimate Windows system process.
|
||||
svch0st.exe,This process name is used by attackers to hide in plain sight and look like a legitimate Windows system process.
|
||||
at.exe,This process is used to schedule other processes to run. schtasks.exe should be used instead as it provides more flexibility.
|
||||
getmail.exe,This process is seen to be used by attackers to extract email files from host machines.
|
||||
ntdll.exe,This process was identified as malicious by DHS Alert TA18-074A.
|
||||
netpass.exe,This process was identified as malicious by DHS Alert TA18-201A and attackers use this tool to recover all network passwords stored on your system for the current logged-on user.
|
||||
WebBrowserPassView.exe,This process was identified as malicious by DHS Alert TA18-201A and is used by attackers as a password recovery tool that reveals the passwords stored in Web Browsers.
|
||||
OutlookAddressBookView.exe,This process was identified as malicious by DHS Alert TA18-201A and is used by attackers to steal the details of all recipients stored in the address books of Microsoft Outlook.
|
||||
mailpv.exe,This process was identified by DHS Alert TA18-201A and attackers use this tool is a password-recovery tool that reveals the passwords and other account details from various email clients.
|
||||
NLBrute.exe,A RDP brute force tool found in botnets for further expansion and and acquisition of targets. This process was identified in the SamSam Ransomware Campaign and attackers use this tool to brute force RDP instances with a range of commonly used passwords.
|
||||
selfdel.exe,This executable was delivered in the SamSam Ransomware Campain and the attackers levereged this binary to delete its malicilous activities.
|
||||
masscan.exe,This executable was delivered in the XMRig Crypto Miner
|
||||
Massscan_GUI.exe,This executable was delivered in the XMRig Crypto Miner
|
||||
KPortScan3.exe,This executable was delivered in the XMRig Crypto Miner and is commonly used by attackers to scan the internet
|
||||
NLAChecker.exe,A scanner tool that checks for Windows hosts for Network Level Authentication. This tool allows attackers to detect Windows Servers with RDP without NLA enabled which facilitates the use of brute force non microsoft rdp tools or exploits
|
||||
ns.exe,A commonly used tool used by attackers to scan and map file shares
|
||||
SilverBullet.exe,Malware was discovered in our monitoring of honey pots that abuses this open source software for scanning and connecting to hosts.
|
||||
kportscan3.exe, KPortScan 3.0 is a widely used port scanning tool on Hacking Forums, to perform network scanning on the internal networks.
|
||||
|
-1
@@ -1 +0,0 @@
|
||||
identity
|
||||
|
@@ -1 +0,0 @@
|
||||
src_ip,numDataPoints,latestCount,avgBlockedConnections,stdevBlockedConnections
|
||||
|
-1
@@ -1 +0,0 @@
|
||||
domain,domain_abuse
|
||||
|
Vendored
-21
@@ -1,21 +0,0 @@
|
||||
number, name
|
||||
1, Inventory of Authorized and Unauthorized Devices
|
||||
2, Inventory of Authorized and Unauthorized Software
|
||||
3, Secure Configuration of End-User Devices
|
||||
4, Continuous Vulnerability Assessment & Remediation
|
||||
5, Controlled Use of Administrative Privileges
|
||||
6, Maintenance Monitoring and Analysis of Audit Logs
|
||||
7, Email & Web Browser Protections
|
||||
8, Malware Defense
|
||||
9, Limitation & Control of Network Ports-Protocols & Services
|
||||
10, Data Recovery Capability
|
||||
11, Secure Configuration of Network Devices
|
||||
12, Boundary Defense
|
||||
13, Data Protection
|
||||
14, Controlled Access Based on Need to Know
|
||||
15, Wireless Access Control
|
||||
16, Account Monitoring and Control
|
||||
17, Security Skills Assessment and Appropriate Training
|
||||
18, Application Software Security
|
||||
19, Incident Response and Management
|
||||
20, Penetration Tests and Red Team Exercises
|
||||
|
@@ -1 +0,0 @@
|
||||
count,domain,type,query,answer
|
||||
|
Vendored
-1
@@ -1 +0,0 @@
|
||||
domain,isValidDomain
|
||||
|
-91976
File diff suppressed because it is too large
Load Diff
@@ -1 +0,0 @@
|
||||
dynamic_dns_domains, isDynDNS_local
|
||||
|
-1
@@ -1 +0,0 @@
|
||||
savedsearch_name, search_id, user, _time, usage
|
||||
|
-3
@@ -1,3 +0,0 @@
|
||||
image, repository
|
||||
devsecops/cat_dog_client, splunk/devsecops_poc
|
||||
devsecops/cat_dog_server, splunk/devsecops_poc
|
||||
|
@@ -1,52 +0,0 @@
|
||||
file_name,suspicious
|
||||
*.avi.com,true
|
||||
*.avi.exe,true
|
||||
*.doc.com,true
|
||||
*.doc.exe,true
|
||||
*.docx.com,true
|
||||
*.docx.exe,true
|
||||
*.jpg.com,true
|
||||
*.jpg.exe,true
|
||||
*.jpeg.com,true
|
||||
*.jpeg.exe,true
|
||||
*.mpg.com,true
|
||||
*.mpg.exe,true
|
||||
*.mpg2.com,true
|
||||
*.mpg2.exe,true
|
||||
*.mpeg.com,true
|
||||
*.mpeg.exe,true
|
||||
*.pdf.com,true
|
||||
*.pdf.exe,true
|
||||
*.png.com,true
|
||||
*.png.exe,true
|
||||
*.ppt.com,true
|
||||
*.ppt.exe,true
|
||||
*.pptx.com,true
|
||||
*.pptx.exe,true
|
||||
*.swf.com,true
|
||||
*.swf.exe,true
|
||||
*.xls.com,true
|
||||
*.xls.exe,true
|
||||
*.xlsx.com,true
|
||||
*.xlsx.exe,true
|
||||
*.zip.com,true
|
||||
*.zip.exe,true
|
||||
*.bat,true
|
||||
*.chm,true
|
||||
*.com,true
|
||||
*.cmd,true
|
||||
*.cpl,true
|
||||
*.exe,true
|
||||
*.hlp,true
|
||||
*.hta,true
|
||||
*.jar,true
|
||||
*.js,true
|
||||
*.msi,true
|
||||
*.pif,true
|
||||
*.ps1,true
|
||||
*.rar,true
|
||||
*.reg,true
|
||||
*.scr,true
|
||||
*.vbe,true
|
||||
*.vbs,true
|
||||
*.wsf,true
|
||||
|
-753
@@ -1,753 +0,0 @@
|
||||
filename,systemFile
|
||||
acu.exe,true
|
||||
AgentService.exe,true
|
||||
aitstatic.exe,true
|
||||
alg.exe,true
|
||||
AppHostRegistrationVerifier.exe,true
|
||||
appidcertstorecheck.exe,true
|
||||
appidpolicyconverter.exe,true
|
||||
appidtel.exe,true
|
||||
ApplicationFrameHost.exe,true
|
||||
ApplySettingsTemplateCatalog.exe,true
|
||||
AppVClient.exe,true
|
||||
AppVDllSurrogate.exe,true
|
||||
AppVNice.exe,true
|
||||
AppVStreamingUX.exe,true
|
||||
ARP.EXE,true
|
||||
at.exe,true
|
||||
AtBroker.exe,true
|
||||
attrib.exe,true
|
||||
audiodg.exe,true
|
||||
auditpol.exe,true
|
||||
AuthHost.exe,true
|
||||
autochk.exe,true
|
||||
autoconv.exe,true
|
||||
autofmt.exe,true
|
||||
AxInstUI.exe,true
|
||||
backgroundTaskHost.exe,true
|
||||
BackgroundTransferHost.exe,true
|
||||
bcastdvr.exe,true
|
||||
bcdboot.exe,true
|
||||
bcdedit.exe,true
|
||||
BioIso.exe,true
|
||||
bitsadmin.exe,true
|
||||
bootcfg.exe,true
|
||||
bootim.exe,true
|
||||
bridgeunattend.exe,true
|
||||
browser_broker.exe,true
|
||||
bthudtask.exe,true
|
||||
ByteCodeGenerator.exe,true
|
||||
cacls.exe,true
|
||||
calc.exe,true
|
||||
CameraSettingsUIHost.exe,true
|
||||
CastSrv.exe,true
|
||||
CertEnrollCtrl.exe,true
|
||||
certreq.exe,true
|
||||
certutil.exe,true
|
||||
change.exe,true
|
||||
changepk.exe,true
|
||||
charmap.exe,true
|
||||
CheckNetIsolation.exe,true
|
||||
chglogon.exe,true
|
||||
chgport.exe,true
|
||||
chgusr.exe,true
|
||||
chkdsk.exe,true
|
||||
chkntfs.exe,true
|
||||
choice.exe,true
|
||||
cipher.exe,true
|
||||
cleanmgr.exe,true
|
||||
cliconfg.exe,true
|
||||
clip.exe,true
|
||||
ClipUp.exe,true
|
||||
CloudExperienceHostBroker.exe,true
|
||||
CloudNotifications.exe,true
|
||||
CloudStorageWizard.exe,true
|
||||
cmd.exe,true
|
||||
cmdkey.exe,true
|
||||
cmdl32.exe,true
|
||||
cmmon32.exe,true
|
||||
cmstp.exe,true
|
||||
cofire.exe,true
|
||||
colorcpl.exe,true
|
||||
comp.exe,true
|
||||
compact.exe,true
|
||||
CompatTelRunner.exe,true
|
||||
CompMgmtLauncher.exe,true
|
||||
ComputerDefaults.exe,true
|
||||
Configure-SMRemoting.exe,true
|
||||
conhost.exe,true
|
||||
consent.exe,true
|
||||
control.exe,true
|
||||
convert.exe,true
|
||||
CredentialUIBroker.exe,true
|
||||
credwiz.exe,true
|
||||
cscript.exe,true
|
||||
csrss.exe,true
|
||||
ctfmon.exe,true
|
||||
cttune.exe,true
|
||||
cttunesvr.exe,true
|
||||
dasHost.exe,true
|
||||
DataExchangeHost.exe,true
|
||||
DataSenseLiveTileTask.exe,true
|
||||
dccw.exe,true
|
||||
dcgpofix.exe,true
|
||||
dcomcnfg.exe,true
|
||||
dcpromo.exe,true
|
||||
ddodiag.exe,true
|
||||
Defrag.exe,true
|
||||
DeviceCensus.exe,true
|
||||
DeviceEject.exe,true
|
||||
DeviceEnroller.exe,true
|
||||
DevicePairingWizard.exe,true
|
||||
DeviceProperties.exe,true
|
||||
DFDWiz.exe,true
|
||||
dfrgui.exe,true
|
||||
dfsrdiag.exe,true
|
||||
dialer.exe,true
|
||||
DIMC.exe,true
|
||||
diskpart.exe,true
|
||||
diskperf.exe,true
|
||||
diskraid.exe,true
|
||||
diskshadow.exe,true
|
||||
DiskSnapshot.exe,true
|
||||
Dism.exe,true
|
||||
dispdiag.exe,true
|
||||
DisplaySwitch.exe,true
|
||||
djoin.exe,true
|
||||
dllhost.exe,true
|
||||
dllhst3g.exe,true
|
||||
dmcertinst.exe,true
|
||||
dmcfghost.exe,true
|
||||
DmNotificationBroker.exe,true
|
||||
DmOmaCpMo.exe,true
|
||||
dnscacheugc.exe,true
|
||||
doskey.exe,true
|
||||
dpapimig.exe,true
|
||||
DpiScaling.exe,true
|
||||
dpnsvr.exe,true
|
||||
driverquery.exe,true
|
||||
drvcfg.exe,true
|
||||
drvinst.exe,true
|
||||
DsmUserTask.exe,true
|
||||
dsregcmd.exe,true
|
||||
dstokenclean.exe,true
|
||||
dvdplay.exe,true
|
||||
dwm.exe,true
|
||||
DWWIN.EXE,true
|
||||
dxdiag.exe,true
|
||||
Dxpserver.exe,true
|
||||
Eap3Host.exe,true
|
||||
EaseOfAccessDialog.exe,true
|
||||
easinvoker.exe,true
|
||||
EasPoliciesBrokerHost.exe,true
|
||||
EDPCleanup.exe,true
|
||||
edpnotify.exe,true
|
||||
efsui.exe,true
|
||||
EhStorAuthn.exe,true
|
||||
embeddedapplauncher.exe,true
|
||||
EmbeddedAppLauncherConfig.exe,true
|
||||
escUnattend.exe,true
|
||||
esentutl.exe,true
|
||||
eudcedit.exe,true
|
||||
eventcreate.exe,true
|
||||
eventvwr.exe,true
|
||||
expand.exe,true
|
||||
extrac32.exe,true
|
||||
fc.exe,true
|
||||
find.exe,true
|
||||
findstr.exe,true
|
||||
finger.exe,true
|
||||
fixmapi.exe,true
|
||||
fltMC.exe,true
|
||||
fodhelper.exe,true
|
||||
Fondue.exe,true
|
||||
fontdrvhost.exe,true
|
||||
fontview.exe,true
|
||||
forfiles.exe,true
|
||||
fsavailux.exe,true
|
||||
fsquirt.exe,true
|
||||
fsutil.exe,true
|
||||
ftp.exe,true
|
||||
GameBarPresenceWriter.exe,true
|
||||
GamePanel.exe,true
|
||||
GenValObj.exe,true
|
||||
getmac.exe,true
|
||||
gpresult.exe,true
|
||||
gpscript.exe,true
|
||||
gpupdate.exe,true
|
||||
grpconv.exe,true
|
||||
hdwwiz.exe,true
|
||||
help.exe,true
|
||||
HOSTNAME.EXE,true
|
||||
hvax64.exe,true
|
||||
hvix64.exe,true
|
||||
hvloader.exe,true
|
||||
hwrcomp.exe,true
|
||||
hwrreg.exe,true
|
||||
iashost.exe,true
|
||||
icacls.exe,true
|
||||
IcsEntitlementHost.exe,true
|
||||
icsunattend.exe,true
|
||||
ie4uinit.exe,true
|
||||
ieUnatt.exe,true
|
||||
iexpress.exe,true
|
||||
immersivetpmvscmgrsvr.exe,true
|
||||
InfDefaultInstall.exe,true
|
||||
InstallAgent.exe,true
|
||||
InstallAgentUserBroker.exe,true
|
||||
ipconfig.exe,true
|
||||
iscsicli.exe,true
|
||||
iscsicpl.exe,true
|
||||
isoburn.exe,true
|
||||
klist.exe,true
|
||||
ksetup.exe,true
|
||||
ktmutil.exe,true
|
||||
ktpass.exe,true
|
||||
label.exe,true
|
||||
LanguageComponentsInstallerComHandler.exe,true
|
||||
LaunchTM.exe,true
|
||||
LaunchWinApp.exe,true
|
||||
LbfoAdmin.exe,true
|
||||
LegacyNetUXHost.exe,true
|
||||
LicenseManagerShellext.exe,true
|
||||
licensingdiag.exe,true
|
||||
LicensingUI.exe,true
|
||||
LocationNotificationWindows.exe,true
|
||||
Locator.exe,true
|
||||
LockAppHost.exe,true
|
||||
LockScreenContentServer.exe,true
|
||||
lodctr.exe,true
|
||||
logagent.exe,true
|
||||
logman.exe,true
|
||||
logoff.exe,true
|
||||
LogonUI.exe,true
|
||||
lpkinstall.exe,true
|
||||
lpksetup.exe,true
|
||||
lpremove.exe,true
|
||||
LsaIso.exe,true
|
||||
lsass.exe,true
|
||||
Magnify.exe,true
|
||||
makecab.exe,true
|
||||
mavinject.exe,true
|
||||
MbaeParserTask.exe,true
|
||||
mblctr.exe,true
|
||||
mcbuilder.exe,true
|
||||
MDEServer.exe,true
|
||||
MDMAgent.exe,true
|
||||
MDMAppInstaller.exe,true
|
||||
MdmDiagnosticsTool.exe,true
|
||||
MdRes.exe,true
|
||||
MdSched.exe,true
|
||||
mfpmp.exe,true
|
||||
Microsoft.Uev.CscUnpinTool.exe,true
|
||||
Microsoft.Uev.SyncController.exe,true
|
||||
mmc.exe,true
|
||||
mobsync.exe,true
|
||||
mountvol.exe,true
|
||||
mpnotify.exe,true
|
||||
MpSigStub.exe,true
|
||||
MRINFO.EXE,true
|
||||
MRT-KB890830.exe,true
|
||||
MRT.exe,true
|
||||
MSchedExe.exe,true
|
||||
msconfig.exe,true
|
||||
msdt.exe,true
|
||||
msdtc.exe,true
|
||||
msfeedssync.exe,true
|
||||
msg.exe,true
|
||||
mshta.exe,true
|
||||
msiexec.exe,true
|
||||
msinfo32.exe,true
|
||||
mspaint.exe,true
|
||||
MsSpellCheckingHost.exe,true
|
||||
mstsc.exe,true
|
||||
mtstocom.exe,true
|
||||
MuiUnattend.exe,true
|
||||
MultiDigiMon.exe,true
|
||||
MusNotification.exe,true
|
||||
MusNotificationUx.exe,true
|
||||
Narrator.exe,true
|
||||
nbtstat.exe,true
|
||||
ndadmin.exe,true
|
||||
net.exe,true
|
||||
net1.exe,true
|
||||
netbtugc.exe,true
|
||||
netcfg.exe,true
|
||||
NetCfgNotifyObjectHost.exe,true
|
||||
netdom.exe,true
|
||||
NetEvtFwdr.exe,true
|
||||
NetHost.exe,true
|
||||
netiougc.exe,true
|
||||
Netplwiz.exe,true
|
||||
netsh.exe,true
|
||||
NETSTAT.EXE,true
|
||||
newdev.exe,true
|
||||
nltest.exe,true
|
||||
notepad.exe,true
|
||||
nslookup.exe,true
|
||||
ntoskrnl.exe,true
|
||||
ntprint.exe,true
|
||||
odbcad32.exe,true
|
||||
odbcconf.exe,true
|
||||
omadmclient.exe,true
|
||||
omadmprc.exe,true
|
||||
openfiles.exe,true
|
||||
OpenWith.exe,true
|
||||
OptionalFeatures.exe,true
|
||||
osk.exe,true
|
||||
PackagedCWALauncher.exe,true
|
||||
PackageInspector.exe,true
|
||||
PasswordOnWakeSettingFlyout.exe,true
|
||||
PATHPING.EXE,true
|
||||
pcalua.exe,true
|
||||
pcaui.exe,true
|
||||
pcwrun.exe,true
|
||||
perfmon.exe,true
|
||||
phoneactivate.exe,true
|
||||
PickerHost.exe,true
|
||||
PING.EXE,true
|
||||
PkgMgr.exe,true
|
||||
plasrv.exe,true
|
||||
PnPUnattend.exe,true
|
||||
pnputil.exe,true
|
||||
poqexec.exe,true
|
||||
powercfg.exe,true
|
||||
PresentationHost.exe,true
|
||||
PresentationSettings.exe,true
|
||||
prevhost.exe,true
|
||||
print.exe,true
|
||||
PrintBrmUi.exe,true
|
||||
PrintDialogHost.exe,true
|
||||
PrintDialogHost3D.exe,true
|
||||
printfilterpipelinesvc.exe,true
|
||||
PrintIsolationHost.exe,true
|
||||
printui.exe,true
|
||||
proquota.exe,true
|
||||
psr.exe,true
|
||||
pwlauncher.exe,true
|
||||
qappsrv.exe,true
|
||||
qprocess.exe,true
|
||||
query.exe,true
|
||||
quser.exe,true
|
||||
qwinsta.exe,true
|
||||
rasdial.exe,true
|
||||
rdpclip.exe,true
|
||||
rdpinit.exe,true
|
||||
rdpinput.exe,true
|
||||
RdpSa.exe,true
|
||||
RdpSaProxy.exe,true
|
||||
RdpSaUacHelper.exe,true
|
||||
rdpshell.exe,true
|
||||
rdpsign.exe,true
|
||||
rdrleakdiag.exe,true
|
||||
RDSPnf.exe,true
|
||||
ReAgentc.exe,true
|
||||
recover.exe,true
|
||||
RecoveryDrive.exe,true
|
||||
reg.exe,true
|
||||
regedt32.exe,true
|
||||
regini.exe,true
|
||||
Register-CimProvider.exe,true
|
||||
regsvr32.exe,true
|
||||
rekeywiz.exe,true
|
||||
relog.exe,true
|
||||
RelPost.exe,true
|
||||
RemotePosWorker.exe,true
|
||||
replace.exe,true
|
||||
reset.exe,true
|
||||
ResetEngine.exe,true
|
||||
resmon.exe,true
|
||||
RMActivate.exe,true
|
||||
RMActivate_isv.exe,true
|
||||
RMActivate_ssp.exe,true
|
||||
RMActivate_ssp_isv.exe,true
|
||||
RmClient.exe,true
|
||||
rmttpmvscmgrsvr.exe,true
|
||||
Robocopy.exe,true
|
||||
ROUTE.EXE,true
|
||||
RpcPing.exe,true
|
||||
rrinstaller.exe,true
|
||||
rsopprov.exe,true
|
||||
runas.exe,true
|
||||
rundll32.exe,true
|
||||
RunLegacyCPLElevated.exe,true
|
||||
runonce.exe,true
|
||||
RuntimeBroker.exe,true
|
||||
rwinsta.exe,true
|
||||
sacsess.exe,true
|
||||
sc.exe,true
|
||||
schtasks.exe,true
|
||||
ScriptRunner.exe,true
|
||||
sdbinst.exe,true
|
||||
sdiagnhost.exe,true
|
||||
SearchFilterHost.exe,true
|
||||
SearchIndexer.exe,true
|
||||
SearchProtocolHost.exe,true
|
||||
SecEdit.exe,true
|
||||
secinit.exe,true
|
||||
securekernel.exe,true
|
||||
SensorDataService.exe,true
|
||||
ServerManager.exe,true
|
||||
ServerManagerLauncher.exe,true
|
||||
services.exe,true
|
||||
sessionmsg.exe,true
|
||||
sethc.exe,true
|
||||
setres.exe,true
|
||||
setspn.exe,true
|
||||
SettingSyncHost.exe,true
|
||||
setupcl.exe,true
|
||||
setupugc.exe,true
|
||||
setx.exe,true
|
||||
sfc.exe,true
|
||||
shrpubw.exe,true
|
||||
shutdown.exe,true
|
||||
sigverif.exe,true
|
||||
SIHClient.exe,true
|
||||
sihost.exe,true
|
||||
SlideToShutDown.exe,true
|
||||
slui.exe,true
|
||||
smartscreen.exe,true
|
||||
SmartScreenSettings.exe,true
|
||||
smss.exe,true
|
||||
SndVol.exe,true
|
||||
SnippingTool.exe,true
|
||||
snmptrap.exe,true
|
||||
sort.exe,true
|
||||
SpaceAgent.exe,true
|
||||
spaceman.exe,true
|
||||
spoolsv.exe,true
|
||||
SppExtComObj.Exe,true
|
||||
sppsvc.exe,true
|
||||
stordiag.exe,true
|
||||
subst.exe,true
|
||||
svchost.exe,true
|
||||
sxstrace.exe,true
|
||||
SyncAppvPublishingServer.exe,true
|
||||
SyncHost.exe,true
|
||||
syskey.exe,true
|
||||
SysResetErr.exe,true
|
||||
systeminfo.exe,true
|
||||
SystemPropertiesAdvanced.exe,true
|
||||
SystemPropertiesComputerName.exe,true
|
||||
SystemPropertiesDataExecutionPrevention.exe,true
|
||||
SystemPropertiesHardware.exe,true
|
||||
SystemPropertiesPerformance.exe,true
|
||||
SystemPropertiesProtection.exe,true
|
||||
SystemPropertiesRemote.exe,true
|
||||
systemreset.exe,true
|
||||
SystemSettingsAdminFlows.exe,true
|
||||
SystemSettingsBroker.exe,true
|
||||
SystemSettingsRemoveDevice.exe,true
|
||||
systray.exe,true
|
||||
tabcal.exe,true
|
||||
takeown.exe,true
|
||||
TapiUnattend.exe,true
|
||||
taskhostw.exe,true
|
||||
taskkill.exe,true
|
||||
tasklist.exe,true
|
||||
Taskmgr.exe,true
|
||||
tcmsetup.exe,true
|
||||
TCPSVCS.EXE,true
|
||||
tdlrecover.exe,true
|
||||
ThumbnailExtractionHost.exe,true
|
||||
TieringEngineService.exe,true
|
||||
timeout.exe,true
|
||||
TokenBrokerCookies.exe,true
|
||||
TpmInit.exe,true
|
||||
tpmvscmgr.exe,true
|
||||
tpmvscmgrsvr.exe,true
|
||||
tracerpt.exe,true
|
||||
TRACERT.EXE,true
|
||||
tscon.exe,true
|
||||
tsdiscon.exe,true
|
||||
tsecimp.exe,true
|
||||
tskill.exe,true
|
||||
TSTheme.exe,true
|
||||
TSWbPrxy.exe,true
|
||||
typeperf.exe,true
|
||||
tzsync.exe,true
|
||||
tzutil.exe,true
|
||||
ucsvc.exe,true
|
||||
UevAgentPolicyGenerator.exe,true
|
||||
UevAppMonitor.exe,true
|
||||
UevTemplateBaselineGenerator.exe,true
|
||||
UevTemplateConfigItemGenerator.exe,true
|
||||
UI0Detect.exe,true
|
||||
unlodctr.exe,true
|
||||
unregmp2.exe,true
|
||||
UpgradeResultsUI.exe,true
|
||||
upnpcont.exe,true
|
||||
UserAccountBroker.exe,true
|
||||
UserAccountControlSettings.exe,true
|
||||
userinit.exe,true
|
||||
UsoClient.exe,true
|
||||
Utilman.exe,true
|
||||
VaultCmd.exe,true
|
||||
vds.exe,true
|
||||
vdsldr.exe,true
|
||||
verclsid.exe,true
|
||||
verifier.exe,true
|
||||
verifiergui.exe,true
|
||||
vssadmin.exe,true
|
||||
VSSUIRUN.exe,true
|
||||
VSSVC.exe,true
|
||||
w32tm.exe,true
|
||||
waitfor.exe,true
|
||||
WallpaperHost.exe,true
|
||||
WebCache.exe,true
|
||||
wecutil.exe,true
|
||||
WerFault.exe,true
|
||||
WerFaultSecure.exe,true
|
||||
wermgr.exe,true
|
||||
wevtutil.exe,true
|
||||
wextract.exe,true
|
||||
where.exe,true
|
||||
whoami.exe,true
|
||||
wiaacmgr.exe,true
|
||||
wiawow64.exe,true
|
||||
wimserv.exe,true
|
||||
win32calc.exe,true
|
||||
WinBioDataModelOOBE.exe,true
|
||||
Windows.Media.BackgroundPlayback.exe,true
|
||||
WindowsActionDialog.exe,true
|
||||
WindowsUpdateElevatedInstaller.exe,true
|
||||
wininit.exe,true
|
||||
winload.exe,true
|
||||
winlogon.exe,true
|
||||
winresume.exe,true
|
||||
winrs.exe,true
|
||||
winrshost.exe,true
|
||||
WinSAT.exe,true
|
||||
winver.exe,true
|
||||
wkspbroker.exe,true
|
||||
wksprt.exe,true
|
||||
wlrmdr.exe,true
|
||||
WMPDMC.exe,true
|
||||
wowreg32.exe,true
|
||||
WPDShextAutoplay.exe,true
|
||||
wpr.exe,true
|
||||
write.exe,true
|
||||
WSCollect.exe,true
|
||||
wscript.exe,true
|
||||
WSManHTTPConfig.exe,true
|
||||
wsmprovhost.exe,true
|
||||
wsqmcons.exe,true
|
||||
WSReset.exe,true
|
||||
wuapihost.exe,true
|
||||
wuauclt.exe,true
|
||||
WUDFHost.exe,true
|
||||
wusa.exe,true
|
||||
WWAHost.exe,true
|
||||
XblGameSaveTask.exe,true
|
||||
xcopy.exe,true
|
||||
xwizard.exe,true
|
||||
comrepl.exe,true
|
||||
MigRegDB.exe,true
|
||||
DiagnosticsHub.StandardCollector.Service.exe,true
|
||||
DismHost.exe,true
|
||||
F12Chooser.exe,true
|
||||
IMJPDCT.EXE,true
|
||||
IMJPSET.EXE,true
|
||||
IMJPUEX.EXE,true
|
||||
imjpuexc.exe,true
|
||||
IMTCLNWZ.EXE,true
|
||||
IMTCPROP.exe,true
|
||||
IMCCPHR.exe,true
|
||||
ImeBroker.exe,true
|
||||
imecfmui.exe,true
|
||||
IMEDICTUPDATEUI.EXE,true
|
||||
IMEPADSV.EXE,true
|
||||
IMESEARCH.EXE,true
|
||||
IMEWDBLD.EXE,true
|
||||
ChsIME.exe,true
|
||||
ChtIME.exe,true
|
||||
mighost.exe,true
|
||||
audit.exe,true
|
||||
AuditShD.exe,true
|
||||
FirstLogonAnim.exe,true
|
||||
msoobe.exe,true
|
||||
oobeldr.exe,true
|
||||
Setup.exe,true
|
||||
UserOOBEBroker.exe,true
|
||||
windeploy.exe,true
|
||||
SpeechUXWiz.exe,true
|
||||
SpeechModelDownload.exe,true
|
||||
SpeechRuntime.exe,true
|
||||
PrintBrm.exe,true
|
||||
PrintBrmEngine.exe,true
|
||||
sysprep.exe,true
|
||||
SystemResetPlatform.exe,true
|
||||
mofcomp.exe,true
|
||||
scrcons.exe,true
|
||||
unsecapp.exe,true
|
||||
wbemtest.exe,true
|
||||
WinMgmt.exe,true
|
||||
WMIADAP.exe,true
|
||||
WmiApSrv.exe,true
|
||||
WMIC.exe,true
|
||||
WmiPrvSE.exe,true
|
||||
powershell.exe,true
|
||||
powershell_ise.exe,true
|
||||
dplaysvr.exe,true
|
||||
dtdump.exe,true
|
||||
hh.exe,true
|
||||
instnm.exe,true
|
||||
perfhost.exe,true
|
||||
rasautou.exe,true
|
||||
rasphone.exe,true
|
||||
regedit.exe,true
|
||||
setup16.exe,true
|
||||
user.exe,true
|
||||
_isdel.exe,true
|
||||
agentactivationruntimestarter.exe,true
|
||||
ApplyTrustOffline.exe,true
|
||||
ApproveChildRequest.exe,true
|
||||
appverif.exe,true
|
||||
baaupdate.exe,true
|
||||
bash.exe,true
|
||||
bdechangepin.exe,true
|
||||
BdeHdCfg.exe,true
|
||||
BdeUISrv.exe,true
|
||||
bdeunlock.exe,true
|
||||
BitLockerDeviceEncryption.exe,true
|
||||
BitLockerWizard.exe,true
|
||||
BitLockerWizardElev.exe,true
|
||||
bootsect.exe,true
|
||||
browserexport.exe,true
|
||||
CIDiag.exe,true
|
||||
CompPkgSrv.exe,true
|
||||
convertvhd.exe,true
|
||||
coredpussvr.exe,true
|
||||
CredentialEnrollmentManager.exe,true
|
||||
curl.exe,true
|
||||
CustomInstallExec.exe,true
|
||||
d3dconfig.exe,true
|
||||
DataStoreCacheDumpTool.exe,true
|
||||
DataUsageLiveTileTask.exe,true
|
||||
deploymentcsphelper.exe,true
|
||||
desktopimgdownldr.exe,true
|
||||
DeviceCredentialDeployment.exe,true
|
||||
directxdatabaseupdater.exe,true
|
||||
dmclient.exe,true
|
||||
DTUHandler.exe,true
|
||||
dusmtask.exe,true
|
||||
DXCap.exe,true
|
||||
DXCpl.exe,true
|
||||
dxgiadaptercache.exe,true
|
||||
EASPolicyManagerBrokerHost.exe,true
|
||||
EduPrintProv.exe,true
|
||||
EoAExperiences.exe,true
|
||||
fhmanagew.exe,true
|
||||
FileHistory.exe,true
|
||||
FsIso.exe,true
|
||||
fvenotify.exe,true
|
||||
fveprompt.exe,true
|
||||
FXSCOVER.exe,true
|
||||
FXSSVC.exe,true
|
||||
FXSUNATD.exe,true
|
||||
hcsdiag.exe,true
|
||||
hnsdiag.exe,true
|
||||
hvsievaluator.exe,true
|
||||
ie4ushowIE.exe,true
|
||||
IESettingSync.exe,true
|
||||
InputSwitchToastHandler.exe,true
|
||||
iotstartup.exe,true
|
||||
manage-bde.exe,true
|
||||
MBR2GPT.EXE,true
|
||||
microsoft.windows.softwarelogo.showdesktop.exe,true
|
||||
MicrosoftEdgeBCHost.exe,true
|
||||
MicrosoftEdgeCP.exe,true
|
||||
MicrosoftEdgeDevTools.exe,true
|
||||
MicrosoftEdgeSH.exe,true
|
||||
mmgaserver.exe,true
|
||||
MoUsoCoreWorker.exe,true
|
||||
msra.exe,true
|
||||
MusNotifyIcon.exe,true
|
||||
NDKPing.exe,true
|
||||
NgcIso.exe,true
|
||||
nmbind.exe,true
|
||||
nmscrub.exe,true
|
||||
nvspinfo.exe,true
|
||||
ofdeploy.exe,true
|
||||
pacjsworker.exe,true
|
||||
PinEnrollmentBroker.exe,true
|
||||
PktMon.exe,true
|
||||
pospaymentsworker.exe,true
|
||||
provlaunch.exe,true
|
||||
provtool.exe,true
|
||||
ProximityUxHost.exe,true
|
||||
prproc.exe,true
|
||||
quickassist.exe,true
|
||||
raserver.exe,true
|
||||
RDVGHelper.exe,true
|
||||
recdisc.exe,true
|
||||
refsutil.exe,true
|
||||
RemoteAppLifetimeManager.exe,true
|
||||
RemoteFXvGPUDisablement.exe,true
|
||||
repair-bde.exe,true
|
||||
rstrui.exe,true
|
||||
runexehelper.exe,true
|
||||
sdchange.exe,true
|
||||
sdclt.exe,true
|
||||
SecurityHealthHost.exe,true
|
||||
SecurityHealthService.exe,true
|
||||
SecurityHealthSystray.exe,true
|
||||
SgrmBroker.exe,true
|
||||
SgrmLpac.exe,true
|
||||
SpatialAudioLicenseSrv.exe,true
|
||||
Spectrum.exe,true
|
||||
srdelayed.exe,true
|
||||
SrTasks.exe,true
|
||||
SystemUWPLauncher.exe,true
|
||||
tar.exe,true
|
||||
tcblaunch.exe,true
|
||||
TpmTool.exe,true
|
||||
ttdinject.exe,true
|
||||
tttracer.exe,true
|
||||
UIMgrBroker.exe,true
|
||||
upfc.exe,true
|
||||
usocoreworker.exe,true
|
||||
UtcDecoderHost.exe,true
|
||||
VBoxControl.exe,true
|
||||
VBoxService.exe,true
|
||||
VBoxTray.exe,true
|
||||
vfpctrl.exe,true
|
||||
vmcompute.exe,true
|
||||
vmwp.exe,true
|
||||
VsGraphicsDesktopEngine.exe,true
|
||||
VsGraphicsRemoteEngine.exe,true
|
||||
vsjitdebugger.exe,true
|
||||
WaaSMedicAgent.exe,true
|
||||
wbadmin.exe,true
|
||||
wbengine.exe,true
|
||||
WFS.exe,true
|
||||
wifitask.exe,true
|
||||
Windows.WARP.JITService.exe,true
|
||||
WinRTNetMUAHostServer.exe,true
|
||||
wlanext.exe,true
|
||||
WorkFolders.exe,true
|
||||
WpcMon.exe,true
|
||||
WpcTok.exe,true
|
||||
wpnpinst.exe,true
|
||||
wscadminui.exe,true
|
||||
wsl.exe,true
|
||||
wslconfig.exe,true
|
||||
WUDFCompanionHost.exe,true
|
||||
IEChooser.exe,true
|
||||
wslhost.exe,true
|
||||
scp.exe,true
|
||||
sftp.exe,true
|
||||
ssh-add.exe,true
|
||||
ssh-agent.exe,true
|
||||
ssh-keygen.exe,true
|
||||
ssh-keyscan.exe,true
|
||||
ssh.exe,true
|
||||
PerceptionSimulationInput.exe,true
|
||||
PerceptionSimulationService.exe,true
|
||||
UNPUXHost.exe,true
|
||||
UNPUXLauncher.exe,true
|
||||
UpdateNotificationMgr.exe,true
|
||||
FaceFodUninstaller.exe,true
|
||||
wlms.exe,true
|
||||
OneDriveSetup.exe,true
|
||||
OposHost.exe,true
|
||||
|
Vendored
-20
@@ -1,20 +0,0 @@
|
||||
domain, isLegit
|
||||
amazon.com, True
|
||||
ssl-images-amazon.com, True
|
||||
facebook.com, True
|
||||
xx.fbcdn.net, True
|
||||
github.com, True
|
||||
githubassets.com, True
|
||||
instagram.com, True
|
||||
linkedin.com, True
|
||||
microsoftonline.com, True
|
||||
office.com, True
|
||||
okta.com, True
|
||||
live.com, True
|
||||
protonmail.com, True
|
||||
reddit.com, True
|
||||
redditstatic.com, True
|
||||
twitter.com, True
|
||||
twimg.com, True
|
||||
google.com, True
|
||||
|
||||
|
-1009
File diff suppressed because it is too large
Load Diff
@@ -1,2 +0,0 @@
|
||||
workflow_name, job_name
|
||||
deployment, k8s-security
|
||||
|
@@ -1,2 +0,0 @@
|
||||
job_name, step_name
|
||||
k8s-security, Run Kube Hunter
|
||||
|
-440
@@ -1,440 +0,0 @@
|
||||
mitre_id,technique,tactics,groups
|
||||
T1205.001,Port Knocking,Defense Evasion|Persistence|Command And Control,no
|
||||
T1564.006,Run Virtual Instance,Defense Evasion,no
|
||||
T1564.005,Hidden File System,Defense Evasion,Strider|Equation
|
||||
T1556.003,Pluggable Authentication Modules,Credential Access|Defense Evasion,no
|
||||
T1574.012,COR_PROFILER,Persistence|Privilege Escalation|Defense Evasion,Blue Mockingbird
|
||||
T1562.007,Disable or Modify Cloud Firewall,Defense Evasion,no
|
||||
T1098.004,SSH Authorized Keys,Persistence,no
|
||||
T1480.001,Environmental Keying,Defense Evasion,APT41|Equation
|
||||
T1059.007,JavaScript/JScript,Execution,APT32|FIN7|Cobalt Group|Molerats|TA505|Silence|Leafminer
|
||||
T1578.004,Revert Cloud Instance,Defense Evasion,no
|
||||
T1578.003,Delete Cloud Instance,Defense Evasion,no
|
||||
T1578.001,Create Snapshot,Defense Evasion,no
|
||||
T1578.002,Create Cloud Instance,Defense Evasion,no
|
||||
T1127.001,MSBuild,Defense Evasion,Frankenstein
|
||||
T1027.005,Indicator Removal from Tools,Defense Evasion,Soft Cell|TEMP.Veles|Patchwork|APT3|Turla|OilRig|Deep Panda
|
||||
T1562.006,Indicator Blocking,Defense Evasion,no
|
||||
T1573.002,Asymmetric Cryptography,Command And Control,Tropic Trooper|Cobalt Group|OilRig|FIN8|FIN6
|
||||
T1573.001,Symmetric Cryptography,Command And Control,Frankenstein|Inception|APT28|APT33|BRONZE BUTLER|Stealth Falcon|Lazarus Group
|
||||
T1573,Encrypted Channel,Command And Control,Tropic Trooper
|
||||
T1027.004,Compile After Delivery,Defense Evasion,Gamaredon Group|Rocke|MuddyWater
|
||||
T1574.004,Dylib Hijacking,Persistence|Privilege Escalation|Defense Evasion,no
|
||||
T1546.015,Component Object Model Hijacking,Privilege Escalation|Persistence,APT28
|
||||
T1071.004,DNS,Command And Control,APT39|Tropic Trooper|OilRig|Ke3chang|Cobalt Group|APT18|APT41|FIN7
|
||||
T1071.003,Mail Protocols,Command And Control,APT32|SilverTerrier|APT28
|
||||
T1071.002,File Transfer Protocols,Command And Control,APT41|SilverTerrier|Machete|Honeybee
|
||||
T1071.001,Web Protocols,Command And Control,Sandworm Team|TA505|Rocke|APT39|Tropic Trooper|MuddyWater|Wizard Spider|Inception|APT41|SilverTerrier|Machete|APT28|WIRTE|APT33|FIN4|Night Dragon|APT18|APT38|Cobalt Group|APT19|Threat Group-3390|Rancor|Orangeworm|APT37|Ke3chang|Dark Caracal|Turla|Lazarus Group|BRONZE BUTLER|APT32|OilRig|Magic Hound|Gamaredon Group|Stealth Falcon
|
||||
T1572,Protocol Tunneling,Command And Control,OilRig|Cobalt Group|FIN6
|
||||
T1048.003,Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol,Exfiltration,APT32|APT33|Thrip|FIN8|OilRig|Lazarus Group
|
||||
T1048.002,Exfiltration Over Asymmetric Encrypted Non-C2 Protocol,Exfiltration,no
|
||||
T1048.001,Exfiltration Over Symmetric Encrypted Non-C2 Protocol,Exfiltration,no
|
||||
T1001.003,Protocol Impersonation,Command And Control,Lazarus Group
|
||||
T1001.002,Steganography,Command And Control,Axiom
|
||||
T1001.001,Junk Data,Command And Control,APT28
|
||||
T1132.002,Non-Standard Encoding,Command And Control,no
|
||||
T1132.001,Standard Encoding,Command And Control,Sandworm Team|Tropic Trooper|MuddyWater|APT33|APT19|Lazarus Group|BRONZE BUTLER|Patchwork
|
||||
T1090.004,Domain Fronting,Command And Control,APT29
|
||||
T1090.003,Multi-hop Proxy,Command And Control,Inception|FIN4|APT29
|
||||
T1090.002,External Proxy,Command And Control,APT39|Silence|Soft Cell|MuddyWater|APT3|FIN5|Lazarus Group|menuPass|APT28
|
||||
T1090.001,Internal Proxy,Command And Control,APT39|Strider
|
||||
T1102.003,One-Way Communication,Command And Control,Leviathan
|
||||
T1102.002,Bidirectional Communication,Command And Control,Sandworm Team|APT39|APT12|Turla|FIN7|APT37|Magic Hound|Carbanak
|
||||
T1102.001,Dead Drop Resolver,Command And Control,Rocke|APT41|BRONZE BUTLER|RTM|Patchwork
|
||||
T1571,Non-Standard Port,Command And Control,Sandworm Team|Rocke|DarkVishnya|Silence|APT-C-36|Magic Hound|APT33|APT32|TEMP.Veles|Lazarus Group|FIN7
|
||||
T1074.002,Remote Data Staging,Collection,Threat Group-3390|menuPass|FIN6|Night Dragon|FIN8
|
||||
T1074.001,Local Data Staging,Collection,Machete|Soft Cell|TEMP.Veles|Patchwork|Dragonfly 2.0|Honeybee|Leviathan|APT3|FIN5|menuPass|FIN6|Lazarus Group|Threat Group-3390|APT28
|
||||
T1078.004,Cloud Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,APT33
|
||||
T1564.004,NTFS File Attributes,Defense Evasion,APT32
|
||||
T1564.003,Hidden Window,Defense Evasion,Gorgon Group|Deep Panda|DarkHydrus|CopyKittens|APT19|APT32|APT28|APT3|Magic Hound
|
||||
T1078.003,Local Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,Tropic Trooper|FIN10|Stolen Pencil|APT32
|
||||
T1078.002,Domain Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,TA505|APT3|Threat Group-1314
|
||||
T1078.001,Default Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,no
|
||||
T1564.002,Hidden Users,Defense Evasion,no
|
||||
T1574.006,LD_PRELOAD,Persistence|Privilege Escalation|Defense Evasion,Rocke
|
||||
T1574.002,DLL Side-Loading,Persistence|Privilege Escalation|Defense Evasion,BRONZE BUTLER|Naikon|APT41|Soft Cell|Tropic Trooper|Patchwork|APT19|APT32|APT3|menuPass|Threat Group-3390
|
||||
T1574.001,DLL Search Order Hijacking,Persistence|Privilege Escalation|Defense Evasion,Whitefly|RTM|Threat Group-3390|menuPass
|
||||
T1574.008,Path Interception by Search Order Hijacking,Persistence|Privilege Escalation|Defense Evasion,no
|
||||
T1574.007,Path Interception by PATH Environment Variable,Persistence|Privilege Escalation|Defense Evasion,no
|
||||
T1574.009,Path Interception by Unquoted Path,Persistence|Privilege Escalation|Defense Evasion,no
|
||||
T1574.011,Services Registry Permissions Weakness,Persistence|Privilege Escalation|Defense Evasion,no
|
||||
T1574.005,Executable Installer File Permissions Weakness,Persistence|Privilege Escalation|Defense Evasion,no
|
||||
T1574.010,Services File Permissions Weakness,Persistence|Privilege Escalation|Defense Evasion,no
|
||||
T1574,Hijack Execution Flow,Persistence|Privilege Escalation|Defense Evasion,no
|
||||
T1069.001,Local Groups,Discovery,Turla|OilRig|admin@338
|
||||
T1570,Lateral Tool Transfer,Lateral Movement,APT32|Wizard Spider|Turla|FIN10
|
||||
T1568.003,DNS Calculation,Command And Control,APT12
|
||||
T1204.002,Malicious File,Execution,Magic Hound|Windshift|APT33|Sandworm Team|Naikon|Whitefly|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Wizard Spider|Mofang|Frankenstein|RTM|Inception|BlackTech|APT-C-36|Machete|admin@338|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|APT19|Dragonfly 2.0|BRONZE BUTLER|Cobalt Group|DarkHydrus|Gorgon Group|Patchwork|OilRig|Dark Caracal|MuddyWater|Lazarus Group|FIN7|APT32|Rancor|APT37|FIN8|APT28|Elderwood|TA459|APT29|Leviathan|menuPass|PLATINUM
|
||||
T1204.001,Malicious Link,Execution,Patchwork|Windshift|APT32|Molerats|Mofang|BlackTech|TA505|OilRig|Machete|Leviathan|FIN8|FIN4|Elderwood|Dragonfly 2.0|Cobalt Group|APT39|Night Dragon|APT33|Turla
|
||||
T1195.003,Compromise Hardware Supply Chain,Initial Access,no
|
||||
T1195.002,Compromise Software Supply Chain,Initial Access,Sandworm Team|APT41
|
||||
T1195.001,Compromise Software Dependencies and Development Tools,Initial Access,no
|
||||
T1568.001,Fast Flux DNS,Command And Control,TA505
|
||||
T1052.001,Exfiltration over USB,Exfiltration,Tropic Trooper
|
||||
T1569.002,Service Execution,Execution,Blue Mockingbird|APT39|APT41|Silence|FIN6|APT32|Honeybee|Ke3chang
|
||||
T1569.001,Launchctl,Execution,no
|
||||
T1569,System Services,Execution,no
|
||||
T1568.002,Domain Generation Algorithms,Command And Control,APT41
|
||||
T1568,Dynamic Resolution,Command And Control,no
|
||||
T1011.001,Exfiltration Over Bluetooth,Exfiltration,no
|
||||
T1567.002,Exfiltration to Cloud Storage,Exfiltration,Leviathan|Turla
|
||||
T1567.001,Exfiltration to Code Repository,Exfiltration,no
|
||||
T1059.006,Python,Execution,Rocke|BRONZE BUTLER|APT39|Dragonfly 2.0|Machete
|
||||
T1059.005,Visual Basic,Execution,APT33|Sandworm Team|Gamaredon Group|Sharpshooter|Molerats|Frankenstein|Inception|APT-C-36|Rancor|Patchwork|MuddyWater|Honeybee|FIN7|APT37|BRONZE BUTLER|APT32|Turla|TA505|Silence|WIRTE|FIN4|Cobalt Group|Gorgon Group|Leviathan|TA459|Magic Hound
|
||||
T1059.004,Unix Shell,Execution,Rocke|APT41
|
||||
T1059.003,Windows Command Shell,Execution,TA505|Blue Mockingbird|Tropic Trooper|Frankenstein|OilRig|Lazarus Group|Honeybee|Cobalt Group|FIN7|APT41|Soft Cell|Turla|Silence|APT32|APT39|Darkhotel|MuddyWater|APT18|APT38|Dark Caracal|Gorgon Group|Dragonfly 2.0|Rancor|Ke3chang|APT37|Leviathan|FIN8|APT28|Magic Hound|Sowbug|BRONZE BUTLER|FIN10|Threat Group-3390|menuPass|Gamaredon Group|Suckfly|Patchwork|Threat Group-1314|APT3|admin@338|APT1
|
||||
T1059.002,AppleScript,Execution,no
|
||||
T1059.001,PowerShell,Execution,Blue Mockingbird|APT39|DarkVishnya|Molerats|Wizard Spider|Frankenstein|Inception|Silence|APT41|Kimsuky|Soft Cell|TA505|WIRTE|TEMP.Veles|APT33|Gallmaker|Turla|APT19|DarkHydrus|APT28|Thrip|Gorgon Group|Cobalt Group|Dragonfly 2.0|Leviathan|TA459|FIN8|MuddyWater|Magic Hound|OilRig|BRONZE BUTLER|CopyKittens|APT32|FIN7|FIN10|Threat Group-3390|menuPass|Patchwork|Stealth Falcon|FIN6|Poseidon Group|APT3|APT29|Deep Panda
|
||||
T1567,Exfiltration Over Web Service,Exfiltration,no
|
||||
T1497.003,Time Based Evasion,Defense Evasion|Discovery,no
|
||||
T1497.002,User Activity Based Checks,Defense Evasion|Discovery,FIN7
|
||||
T1497.001,System Checks,Defense Evasion|Discovery,Frankenstein
|
||||
T1498.002,Reflection Amplification,Impact,no
|
||||
T1498.001,Direct Network Flood,Impact,no
|
||||
T1566.003,Spearphishing via Service,Initial Access,Magic Hound|Windshift|FIN6|OilRig|Dark Caracal
|
||||
T1566.002,Spearphishing Link,Initial Access,Windshift|Molerats|Mofang|BlackTech|Machete|Kimsuky|TA505|Stolen Pencil|APT39|FIN4|APT32|Night Dragon|Turla|APT28|Cobalt Group|Dragonfly 2.0|OilRig|APT33|Elderwood|Leviathan|Magic Hound|Patchwork|APT29|FIN8
|
||||
T1566.001,Spearphishing Attachment,Initial Access,Magic Hound|Windshift|APT33|Sandworm Team|Naikon|Gamaredon Group|Sharpshooter|Molerats|Mofang|Wizard Spider|RTM|Frankenstein|Inception|BlackTech|APT-C-36|APT41|Machete|admin@338|Kimsuky|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|Tropic Trooper|Turla|Gorgon Group|Rancor|DarkHydrus|Cobalt Group|FIN7|OilRig|Lazarus Group|APT19|Dragonfly 2.0|BRONZE BUTLER|APT32|FIN8|MuddyWater|APT28|TA459|Leviathan|Patchwork|PLATINUM|Elderwood|APT29|APT37|menuPass
|
||||
T1566,Phishing,Initial Access,no
|
||||
T1565.003,Runtime Data Manipulation,Impact,APT38
|
||||
T1565.002,Transmitted Data Manipulation,Impact,APT38
|
||||
T1565.001,Stored Data Manipulation,Impact,FIN4|APT38
|
||||
T1565,Data Manipulation,Impact,no
|
||||
T1564.001,Hidden Files and Directories,Defense Evasion,Rocke|APT32|Tropic Trooper|APT28|Lazarus Group
|
||||
T1564,Hide Artifacts,Defense Evasion,no
|
||||
T1563.002,RDP Hijacking,Lateral Movement,no
|
||||
T1563.001,SSH Hijacking,Lateral Movement,no
|
||||
T1563,Remote Service Session Hijacking,Lateral Movement,no
|
||||
T1518.001,Security Software Discovery,Discovery,Turla|Rocke|Frankenstein|The White Company|Cobalt Group|Darkhotel|MuddyWater|Tropic Trooper|FIN8|Patchwork|Naikon
|
||||
T1069.003,Cloud Groups,Discovery,no
|
||||
T1069.002,Domain Groups,Discovery,Turla|Wizard Spider|Inception|OilRig|FIN6|Dragonfly 2.0|Ke3chang
|
||||
T1087.004,Cloud Account,Discovery,no
|
||||
T1087.003,Email Account,Discovery,Sandworm Team|TA505
|
||||
T1087.002,Domain Account,Discovery,Turla|Sandworm Team|Dragonfly 2.0|OilRig|BRONZE BUTLER|menuPass|FIN6|Poseidon Group|Ke3chang
|
||||
T1087.001,Local Account,Discovery,Turla|Poseidon Group|OilRig|Ke3chang|APT32|APT1|Threat Group-3390|APT3|admin@338
|
||||
T1553.004,Install Root Certificate,Defense Evasion,no
|
||||
T1562.004,Disable or Modify System Firewall,Defense Evasion,Rocke|Lazarus Group|Kimsuky|Dragonfly 2.0|Carbanak
|
||||
T1562.003,HISTCONTROL,Defense Evasion,no
|
||||
T1562.002,Disable Windows Event Logging,Defense Evasion,Threat Group-3390
|
||||
T1562.001,Disable or Modify Tools,Defense Evasion,Gamaredon Group|BRONZE BUTLER|Rocke|Kimsuky|Turla|Night Dragon|Gorgon Group|Lazarus Group|Putter Panda
|
||||
T1562,Impair Defenses,Defense Evasion,no
|
||||
T1003.004,LSA Secrets,Credential Access,OilRig|MuddyWater|menuPass|Leafminer|Ke3chang|Dragonfly 2.0|APT33|Threat Group-3390
|
||||
T1003.005,Cached Domain Credentials,Credential Access,OilRig|MuddyWater|Leafminer|APT33
|
||||
T1561.002,Disk Structure Wipe,Impact,Sandworm Team|Lazarus Group|APT38|APT37
|
||||
T1561.001,Disk Content Wipe,Impact,Lazarus Group
|
||||
T1561,Disk Wipe,Impact,no
|
||||
T1560.003,Archive via Custom Method,Collection,Lazarus Group|Kimsuky|CopyKittens|FIN6
|
||||
T1560.002,Archive via Library,Collection,Lazarus Group|Threat Group-3390
|
||||
T1560.001,Archive via Utility,Collection,APT41|Soft Cell|Turla|Gallmaker|APT33|APT39|MuddyWater|Magic Hound|FIN8|BRONZE BUTLER|CopyKittens|APT3|Sowbug|menuPass|APT1|Ke3chang
|
||||
T1560,Archive Collected Data,Collection,menuPass|APT32|Honeybee|Patchwork|APT28|Dragonfly 2.0|FIN6|Lazarus Group|Ke3chang
|
||||
T1499.004,Application or System Exploitation,Impact,no
|
||||
T1499.003,Application Exhaustion Flood,Impact,no
|
||||
T1499.002,Service Exhaustion Flood,Impact,no
|
||||
T1499.001,OS Exhaustion Flood,Impact,no
|
||||
T1491.002,External Defacement,Impact,no
|
||||
T1491.001,Internal Defacement,Impact,Lazarus Group
|
||||
T1114.003,Email Forwarding Rule,Collection,no
|
||||
T1114.002,Remote Email Collection,Collection,APT1|FIN4|APT28|Dragonfly 2.0|Ke3chang|Leafminer
|
||||
T1114.001,Local Email Collection,Collection,Magic Hound|APT1
|
||||
T1134.005,SID-History Injection,Defense Evasion|Privilege Escalation,no
|
||||
T1134.004,Parent PID Spoofing,Defense Evasion|Privilege Escalation,no
|
||||
T1134.003,Make and Impersonate Token,Defense Evasion|Privilege Escalation,no
|
||||
T1134.002,Create Process with Token,Defense Evasion|Privilege Escalation,Turla|Lazarus Group
|
||||
T1134.001,Token Impersonation/Theft,Defense Evasion|Privilege Escalation,APT28
|
||||
T1213.002,Sharepoint,Collection,Ke3chang|APT28
|
||||
T1213.001,Confluence,Collection,no
|
||||
T1555.003,Credentials from Web Browsers,Credential Access,Magic Hound|Sandworm Team|Inception|Stealth Falcon|OilRig|Leafminer|APT33|APT3|Kimsuky|TA505|Stolen Pencil|MuddyWater|APT37|Patchwork|Molerats
|
||||
T1555.002,Securityd Memory,Credential Access,no
|
||||
T1555.001,Keychain,Credential Access,no
|
||||
T1559.002,Dynamic Data Exchange,Execution,Sharpshooter|TA505|MuddyWater|Gallmaker|Patchwork|Cobalt Group|APT37|APT28|FIN7
|
||||
T1559.001,Component Object Model,Execution,Gamaredon Group|MuddyWater
|
||||
T1559,Inter-Process Communication,Execution,no
|
||||
T1558.002,Silver Ticket,Credential Access,no
|
||||
T1558.001,Golden Ticket,Credential Access,Ke3chang
|
||||
T1558,Steal or Forge Kerberos Tickets,Credential Access,no
|
||||
T1557.001,LLMNR/NBT-NS Poisoning and SMB Relay,Credential Access|Collection,no
|
||||
T1557,Man-in-the-Middle,Credential Access|Collection,no
|
||||
T1556.002,Password Filter DLL,Credential Access|Defense Evasion,Strider
|
||||
T1556.001,Domain Controller Authentication,Credential Access|Defense Evasion,no
|
||||
T1556,Modify Authentication Process,Credential Access|Defense Evasion,no
|
||||
T1056.004,Credential API Hooking,Collection|Credential Access,PLATINUM
|
||||
T1056.003,Web Portal Capture,Collection|Credential Access,no
|
||||
T1056.002,GUI Input Capture,Collection|Credential Access,FIN4
|
||||
T1056.001,Keylogging,Collection|Credential Access,APT32|Sandworm Team|APT39|APT41|Kimsuky|menuPass|Stolen Pencil|FIN4|APT38|Ke3chang|OilRig|PLATINUM|Sowbug|Magic Hound|Group5|Lazarus Group|Threat Group-3390|APT3|Darkhotel|APT28
|
||||
T1555,Credentials from Password Stores,Credential Access,APT39|OilRig|MuddyWater|Leafminer|APT33|Turla|Stealth Falcon
|
||||
T1552.005,Cloud Instance Metadata API,Credential Access,no
|
||||
T1003.008,/etc/passwd and /etc/shadow,Credential Access,no
|
||||
T1003.007,Proc Filesystem,Credential Access,no
|
||||
T1003.006,DCSync,Credential Access,no
|
||||
T1558.003,Kerberoasting,Credential Access,no
|
||||
T1552.006,Group Policy Preferences,Credential Access,APT33
|
||||
T1003.003,NTDS,Credential Access,FIN6|Dragonfly 2.0
|
||||
T1003.002,Security Account Manager,Credential Access,Threat Group-3390|Ke3chang|Soft Cell|Night Dragon|Dragonfly 2.0|menuPass
|
||||
T1003.001,LSASS Memory,Credential Access,Sandworm Team|Whitefly|Blue Mockingbird|Silence|Threat Group-3390|Leviathan|APT41|Soft Cell|TEMP.Veles|APT33|APT39|Stolen Pencil|APT32|Lazarus Group|Leafminer|Magic Hound|MuddyWater|PLATINUM|FIN8|BRONZE BUTLER|OilRig|FIN6|APT3|APT28|APT1|Ke3chang|Cleaver
|
||||
T1110.004,Credential Stuffing,Credential Access,no
|
||||
T1110.003,Password Spraying,Credential Access,APT33|Leafminer|Lazarus Group
|
||||
T1110.002,Password Cracking,Credential Access,APT41|Dragonfly 2.0|APT3
|
||||
T1110.001,Password Guessing,Credential Access,no
|
||||
T1021.006,Windows Remote Management,Lateral Movement,Threat Group-3390
|
||||
T1021.005,VNC,Lateral Movement,GCMAN
|
||||
T1021.004,SSH,Lateral Movement,Rocke|TEMP.Veles|Leviathan|APT39|OilRig|menuPass|GCMAN
|
||||
T1021.003,Distributed Component Object Model,Lateral Movement,no
|
||||
T1021.002,SMB/Windows Admin Shares,Lateral Movement,Blue Mockingbird|APT39|APT32|Orangeworm|FIN8|APT3|Lazarus Group|Threat Group-1314|Turla|Deep Panda|Ke3chang
|
||||
T1021.001,Remote Desktop Protocol,Lateral Movement,Blue Mockingbird|Wizard Spider|Silence|APT41|TEMP.Veles|Leviathan|APT39|Stolen Pencil|Cobalt Group|Dragonfly 2.0|FIN8|APT3|OilRig|menuPass|FIN10|Patchwork|FIN6|Lazarus Group|APT1|Axiom
|
||||
T1554,Compromise Client Software Binary,Persistence,no
|
||||
T1036.006,Space after Filename,Defense Evasion,no
|
||||
T1036.005,Match Legitimate Name or Location,Defense Evasion,Rocke|Sandworm Team|APT39|Blue Mockingbird|Whitefly|Tropic Trooper|Silence|APT41|menuPass|TEMP.Veles|MuddyWater|BRONZE BUTLER|Sowbug|APT32|Patchwork|Poseidon Group|admin@338|Carbanak|APT1
|
||||
T1036.004,Masquerade Task or Service,Defense Evasion,Wizard Spider|APT-C-36|Carbanak|APT32|FIN6|FIN7
|
||||
T1036.003,Rename System Utilities,Defense Evasion,menuPass|APT32|Soft Cell|PLATINUM
|
||||
T1036.002,Right-to-Left Override,Defense Evasion,BRONZE BUTLER|BlackTech|Ke3chang|Scarlet Mimic
|
||||
T1036.001,Invalid Code Signature,Defense Evasion,Windshift
|
||||
T1553.003,SIP and Trust Provider Hijacking,Defense Evasion,no
|
||||
T1553.002,Code Signing,Defense Evasion,Patchwork|Silence|APT41|FIN6|TA505|FIN7|Honeybee|Leviathan|APT37|CopyKittens|Winnti Group|Suckfly|Molerats|Darkhotel
|
||||
T1553.001,Gatekeeper Bypass,Defense Evasion,no
|
||||
T1553,Subvert Trust Controls,Defense Evasion,no
|
||||
T1027.003,Steganography,Defense Evasion,BRONZE BUTLER|Tropic Trooper|MuddyWater|APT37
|
||||
T1027.002,Software Packing,Defense Evasion,TA505|Rocke|Soft Cell|The White Company|APT39|APT38|Dark Caracal|Elderwood|APT3|Patchwork|APT29|Night Dragon
|
||||
T1027.001,Binary Padding,Defense Evasion,Gamaredon Group|Patchwork|APT32|Leviathan|BRONZE BUTLER|Moafee
|
||||
T1222.002,Linux and Mac File and Directory Permissions Modification,Defense Evasion,Rocke|APT32
|
||||
T1222.001,Windows File and Directory Permissions Modification,Defense Evasion,no
|
||||
T1552.004,Private Keys,Credential Access,Rocke
|
||||
T1552.003,Bash History,Credential Access,no
|
||||
T1552.002,Credentials in Registry,Credential Access,APT32
|
||||
T1552.001,Credentials In Files,Credential Access,Leafminer|APT33|OilRig|TA505|Stolen Pencil|MuddyWater|APT3
|
||||
T1552,Unsecured Credentials,Credential Access,no
|
||||
T1216.001,PubPrn,Defense Evasion,APT32
|
||||
T1070.006,Timestomp,Defense Evasion,Rocke|TEMP.Veles|APT32|Lazarus Group|APT28
|
||||
T1070.005,Network Share Connection Removal,Defense Evasion,Threat Group-3390
|
||||
T1070.004,File Deletion,Defense Evasion,Sandworm Team|Rocke|Tropic Trooper|Gamaredon Group|Wizard Spider|APT41|Kimsuky|Silence|The White Company|TEMP.Veles|APT32|APT38|Patchwork|Honeybee|Cobalt Group|Dragonfly 2.0|menuPass|FIN8|OilRig|FIN5|BRONZE BUTLER|Magic Hound|APT3|FIN10|APT28|Threat Group-3390|Group5|Lazarus Group|APT18|APT29
|
||||
T1070.003,Clear Command History,Defense Evasion,APT41
|
||||
T1550.004,Web Session Cookie,Defense Evasion|Lateral Movement,no
|
||||
T1550.001,Application Access Token,Defense Evasion|Lateral Movement,APT28
|
||||
T1550.003,Pass the Ticket,Defense Evasion|Lateral Movement,APT32|BRONZE BUTLER|APT29
|
||||
T1550.002,Pass the Hash,Defense Evasion|Lateral Movement,Soft Cell|APT32|Night Dragon|APT28|APT1
|
||||
T1550,Use Alternate Authentication Material,Defense Evasion|Lateral Movement,no
|
||||
T1548.004,Elevated Execution with Prompt,Privilege Escalation|Defense Evasion,no
|
||||
T1548.003,Sudo and Sudo Caching,Privilege Escalation|Defense Evasion,no
|
||||
T1548.002,Bypass User Access Control,Privilege Escalation|Defense Evasion,APT37|MuddyWater|Honeybee|Cobalt Group|Threat Group-3390|BRONZE BUTLER|Patchwork|APT29
|
||||
T1548.001,Setuid and Setgid,Privilege Escalation|Defense Evasion,no
|
||||
T1548,Abuse Elevation Control Mechanism,Privilege Escalation|Defense Evasion,no
|
||||
T1136.003,Cloud Account,Persistence,no
|
||||
T1070.002,Clear Linux or Mac System Logs,Defense Evasion,Rocke
|
||||
T1070.001,Clear Windows Event Logs,Defense Evasion,APT41|APT38|Dragonfly 2.0|APT32|FIN8|FIN5|APT28
|
||||
T1136.002,Domain Account,Persistence,Soft Cell
|
||||
T1136.001,Local Account,Persistence,APT39|APT41|Dragonfly 2.0|Leafminer|APT3
|
||||
T1547.011,Plist Modification,Persistence|Privilege Escalation,no
|
||||
T1547.010,Port Monitors,Persistence|Privilege Escalation,no
|
||||
T1547.009,Shortcut Modification,Persistence|Privilege Escalation,APT39|Darkhotel|APT29|Gorgon Group|Dragonfly 2.0|Leviathan|Lazarus Group
|
||||
T1547.008,LSASS Driver,Persistence|Privilege Escalation,no
|
||||
T1547.007,Re-opened Applications,Persistence|Privilege Escalation,no
|
||||
T1547.006,Kernel Modules and Extensions,Persistence|Privilege Escalation,no
|
||||
T1547.005,Security Support Provider,Persistence|Privilege Escalation,no
|
||||
T1547.004,Winlogon Helper DLL,Persistence|Privilege Escalation,Tropic Trooper|Turla
|
||||
T1547.003,Time Providers,Persistence|Privilege Escalation,no
|
||||
T1546.014,Emond,Privilege Escalation|Persistence,no
|
||||
T1546.013,PowerShell Profile,Privilege Escalation|Persistence,Turla
|
||||
T1546.012,Image File Execution Options Injection,Privilege Escalation|Persistence,TEMP.Veles
|
||||
T1218.008,Odbcconf,Defense Evasion,Cobalt Group
|
||||
T1546.011,Application Shimming,Privilege Escalation|Persistence,FIN7
|
||||
T1547.002,Authentication Package,Persistence|Privilege Escalation,no
|
||||
T1546.010,AppInit DLLs,Privilege Escalation|Persistence,no
|
||||
T1546.009,AppCert DLLs,Privilege Escalation|Persistence,Honeybee
|
||||
T1218.007,Msiexec,Defense Evasion,TA505|Rancor
|
||||
T1546.008,Accessibility Features,Privilege Escalation|Persistence,APT41|APT3|APT29|Deep Panda|Axiom
|
||||
T1546.007,Netsh Helper DLL,Privilege Escalation|Persistence,no
|
||||
T1546.006,LC_LOAD_DYLIB Addition,Privilege Escalation|Persistence,no
|
||||
T1546.005,Trap,Privilege Escalation|Persistence,no
|
||||
T1546.004,.bash_profile and .bashrc,Privilege Escalation|Persistence,no
|
||||
T1546.003,Windows Management Instrumentation Event Subscription,Privilege Escalation|Persistence,APT33|Blue Mockingbird|Turla|Leviathan|APT29
|
||||
T1546.002,Screensaver,Privilege Escalation|Persistence,no
|
||||
T1546.001,Change Default File Association,Privilege Escalation|Persistence,Kimsuky
|
||||
T1547.001,Registry Run Keys / Startup Folder,Persistence|Privilege Escalation,Rocke|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Silence|RTM|Inception|APT41|Machete|Kimsuky|APT33|APT39|APT32|APT18|Turla|Dark Caracal|Cobalt Group|Honeybee|Threat Group-3390|Dragonfly 2.0|Gorgon Group|Ke3chang|APT19|Leviathan|MuddyWater|APT37|BRONZE BUTLER|Magic Hound|APT3|FIN10|FIN7|Patchwork|FIN6|Lazarus Group|Putter Panda|APT29|Darkhotel
|
||||
T1218.002,Control Panel,Defense Evasion,no
|
||||
T1218.010,Regsvr32,Defense Evasion,Blue Mockingbird|Inception|WIRTE|Cobalt Group|APT19|Leviathan|APT32|Deep Panda
|
||||
T1218.009,Regsvcs/Regasm,Defense Evasion,no
|
||||
T1218.005,Mshta,Defense Evasion,Inception|Kimsuky|APT32|MuddyWater|FIN7
|
||||
T1218.004,InstallUtil,Defense Evasion,no
|
||||
T1218.001,Compiled HTML File,Defense Evasion,APT41|Silence|Lazarus Group|Dark Caracal|OilRig
|
||||
T1218.003,CMSTP,Defense Evasion,Cobalt Group|MuddyWater
|
||||
T1218.011,Rundll32,Defense Evasion,APT32|Sandworm Team|Blue Mockingbird|TA505|MuddyWater|APT29|APT19|CopyKittens|APT3|Carbanak|APT28
|
||||
T1547,Boot or Logon Autostart Execution,Persistence|Privilege Escalation,no
|
||||
T1546,Event Triggered Execution,Privilege Escalation|Persistence,no
|
||||
T1098.003,Add Office 365 Global Administrator Role,Persistence,no
|
||||
T1098.002,Exchange Email Delegate Permissions,Persistence,Magic Hound
|
||||
T1098.001,Additional Azure Service Principal Credentials,Persistence,no
|
||||
T1543.004,Launch Daemon,Persistence|Privilege Escalation,no
|
||||
T1543.003,Windows Service,Persistence|Privilege Escalation,Blue Mockingbird|DarkVishnya|Wizard Spider|APT32|APT41|Kimsuky|Tropic Trooper|Cobalt Group|Ke3chang|Honeybee|FIN7|Threat Group-3390|APT19|APT3|Lazarus Group|Carbanak
|
||||
T1543.002,Systemd Service,Persistence|Privilege Escalation,Rocke
|
||||
T1543.001,Launch Agent,Persistence|Privilege Escalation,no
|
||||
T1037.005,Startup Items,Persistence|Privilege Escalation,no
|
||||
T1037.004,Rc.common,Persistence|Privilege Escalation,no
|
||||
T1055.012,Process Hollowing,Defense Evasion|Privilege Escalation,Threat Group-3390|menuPass|Gorgon Group|Patchwork
|
||||
T1055.013,Process Doppelgänging,Defense Evasion|Privilege Escalation,Leafminer
|
||||
T1055.011,Extra Window Memory Injection,Defense Evasion|Privilege Escalation,no
|
||||
T1055.014,VDSO Hijacking,Defense Evasion|Privilege Escalation,no
|
||||
T1055.009,Proc Memory,Defense Evasion|Privilege Escalation,no
|
||||
T1055.008,Ptrace System Calls,Defense Evasion|Privilege Escalation,no
|
||||
T1055.005,Thread Local Storage,Defense Evasion|Privilege Escalation,no
|
||||
T1055.004,Asynchronous Procedure Call,Defense Evasion|Privilege Escalation,no
|
||||
T1055.003,Thread Execution Hijacking,Defense Evasion|Privilege Escalation,no
|
||||
T1055.002,Portable Executable Injection,Defense Evasion|Privilege Escalation,Rocke|Gorgon Group
|
||||
T1055.001,Dynamic-link Library Injection,Defense Evasion|Privilege Escalation,TA505|Turla|Tropic Trooper|Lazarus Group|Putter Panda
|
||||
T1037.003,Network Logon Script,Persistence|Privilege Escalation,no
|
||||
T1543,Create or Modify System Process,Persistence|Privilege Escalation,no
|
||||
T1037.002,Logon Script (Mac),Persistence|Privilege Escalation,no
|
||||
T1037.001,Logon Script (Windows),Persistence|Privilege Escalation,Cobalt Group|APT28
|
||||
T1542.003,Bootkit,Persistence|Defense Evasion,APT41|Lazarus Group|APT28
|
||||
T1542.002,Component Firmware,Persistence|Defense Evasion,Equation
|
||||
T1542.001,System Firmware,Persistence|Defense Evasion,no
|
||||
T1505.003,Web Shell,Persistence,Tropic Trooper|Soft Cell|Threat Group-3390|TEMP.Veles|Leviathan|APT39|Dragonfly 2.0|APT32|OilRig|Deep Panda
|
||||
T1505.002,Transport Agent,Persistence,no
|
||||
T1505.001,SQL Stored Procedures,Persistence,no
|
||||
T1053.003,Cron,Execution|Persistence|Privilege Escalation,Rocke
|
||||
T1053.004,Launchd,Execution|Persistence|Privilege Escalation,no
|
||||
T1053.001,At (Linux),Execution|Persistence|Privilege Escalation,no
|
||||
T1053.005,Scheduled Task,Execution|Persistence|Privilege Escalation,Gamaredon Group|Blue Mockingbird|MuddyWater|Wizard Spider|Frankenstein|APT-C-36|BRONZE BUTLER|APT41|Machete|Soft Cell|Silence|TEMP.Veles|APT33|APT39|Dragonfly 2.0|Patchwork|OilRig|Rancor|Cobalt Group|FIN8|menuPass|FIN10|APT32|FIN7|Stealth Falcon|FIN6|APT3|APT29
|
||||
T1053.002,At (Windows),Execution|Persistence|Privilege Escalation,BRONZE BUTLER|Threat Group-3390|APT18
|
||||
T1542,Pre-OS Boot,Defense Evasion|Persistence,no
|
||||
T1137.001,Office Template Macros,Persistence,MuddyWater
|
||||
T1137.004,Outlook Home Page,Persistence,OilRig
|
||||
T1137.003,Outlook Forms,Persistence,no
|
||||
T1137.005,Outlook Rules,Persistence,no
|
||||
T1137.006,Add-ins,Persistence,Naikon
|
||||
T1137.002,Office Test,Persistence,APT28
|
||||
T1531,Account Access Removal,Impact,no
|
||||
T1539,Steal Web Session Cookie,Credential Access,no
|
||||
T1529,System Shutdown/Reboot,Impact,Lazarus Group|APT38|APT37
|
||||
T1518,Software Discovery,Discovery,BRONZE BUTLER|Tropic Trooper|Inception
|
||||
T1534,Internal Spearphishing,Lateral Movement,Gamaredon Group
|
||||
T1528,Steal Application Access Token,Credential Access,APT28
|
||||
T1535,Unused/Unsupported Cloud Regions,Defense Evasion,no
|
||||
T1525,Implant Container Image,Persistence,no
|
||||
T1538,Cloud Service Dashboard,Discovery,no
|
||||
T1530,Data from Cloud Storage Object,Collection,no
|
||||
T1578,Modify Cloud Compute Infrastructure,Defense Evasion,no
|
||||
T1537,Transfer Data to Cloud Account,Exfiltration,no
|
||||
T1526,Cloud Service Discovery,Discovery,no
|
||||
T1505,Server Software Component,Persistence,no
|
||||
T1499,Endpoint Denial of Service,Impact,no
|
||||
T1497,Virtualization/Sandbox Evasion,Defense Evasion|Discovery,no
|
||||
T1498,Network Denial of Service,Impact,no
|
||||
T1496,Resource Hijacking,Impact,Blue Mockingbird|Rocke|APT41|Lazarus Group
|
||||
T1495,Firmware Corruption,Impact,no
|
||||
T1491,Defacement,Impact,no
|
||||
T1490,Inhibit System Recovery,Impact,no
|
||||
T1489,Service Stop,Impact,Lazarus Group
|
||||
T1486,Data Encrypted for Impact,Impact,APT41|TA505|APT38
|
||||
T1485,Data Destruction,Impact,Sandworm Team|Lazarus Group|APT38
|
||||
T1484,Group Policy Modification,Defense Evasion|Privilege Escalation,no
|
||||
T1482,Domain Trust Discovery,Discovery,Wizard Spider
|
||||
T1480,Execution Guardrails,Defense Evasion,no
|
||||
T1222,File and Directory Permissions Modification,Defense Evasion,no
|
||||
T1221,Template Injection,Defense Evasion,Gamaredon Group|Frankenstein|Inception|APT28|Tropic Trooper|Dragonfly 2.0|DarkHydrus
|
||||
T1220,XSL Script Processing,Defense Evasion,Cobalt Group
|
||||
T1197,BITS Jobs,Defense Evasion|Persistence,Patchwork|APT41|Leviathan
|
||||
T1217,Browser Bookmark Discovery,Discovery,no
|
||||
T1213,Data from Information Repositories,Collection,Turla
|
||||
T1189,Drive-by Compromise,Initial Access,Turla|Windshift|RTM|Darkhotel|APT38|Dragonfly 2.0|BRONZE BUTLER|Leafminer|Dark Caracal|APT19|APT32|Lazarus Group|Threat Group-3390|Elderwood|APT37|Patchwork|PLATINUM
|
||||
T1203,Exploitation for Client Execution,Execution,Sandworm Team|MuddyWater|Frankenstein|Inception|BlackTech|APT41|admin@338|Threat Group-3390|APT12|The White Company|APT33|APT32|APT28|Tropic Trooper|Lazarus Group|BRONZE BUTLER|Cobalt Group|APT37|Patchwork|Leviathan|Elderwood|TA459|APT29
|
||||
T1212,Exploitation for Credential Access,Credential Access,no
|
||||
T1211,Exploitation for Defense Evasion,Defense Evasion,APT28
|
||||
T1190,Exploit Public-Facing Application,Initial Access,Blue Mockingbird|Rocke|APT39|BlackTech|APT41|Soft Cell|Night Dragon|Axiom
|
||||
T1210,Exploitation of Remote Services,Lateral Movement,Threat Group-3390|APT28
|
||||
T1202,Indirect Command Execution,Defense Evasion,no
|
||||
T1200,Hardware Additions,Initial Access,DarkVishnya
|
||||
T1201,Password Policy Discovery,Discovery,Turla|OilRig
|
||||
T1219,Remote Access Software,Command And Control,Sandworm Team|DarkVishnya|RTM|Kimsuky|Night Dragon|Thrip|Cobalt Group|Carbanak
|
||||
T1207,Rogue Domain Controller,Defense Evasion,no
|
||||
T1199,Trusted Relationship,Initial Access,APT28|menuPass
|
||||
T1218,Signed Binary Proxy Execution,Defense Evasion,no
|
||||
T1204,User Execution,Execution,no
|
||||
T1216,Signed Script Proxy Execution,Defense Evasion,no
|
||||
T1195,Supply Chain Compromise,Initial Access,Elderwood
|
||||
T1205,Traffic Signaling,Defense Evasion|Persistence|Command And Control,no
|
||||
T1176,Browser Extensions,Persistence,Kimsuky|Stolen Pencil
|
||||
T1175,Component Object Model and Distributed COM,Lateral Movement|Execution,no
|
||||
T1187,Forced Authentication,Credential Access,DarkHydrus|Dragonfly 2.0
|
||||
T1185,Man in the Browser,Collection,no
|
||||
T1134,Access Token Manipulation,Defense Evasion|Privilege Escalation,Blue Mockingbird
|
||||
T1136,Create Account,Persistence,no
|
||||
T1140,Deobfuscate/Decode Files or Information,Defense Evasion,Rocke|Sandworm Team|Gamaredon Group|Molerats|Frankenstein|Turla|WIRTE|Darkhotel|Tropic Trooper|menuPass|Honeybee|Threat Group-3390|APT19|Gorgon Group|Leviathan|MuddyWater|APT28|OilRig|BRONZE BUTLER
|
||||
T1149,LC_MAIN Hijacking,Defense Evasion,no
|
||||
T1135,Network Share Discovery,Discovery,APT32|APT39|DarkVishnya|APT41|Tropic Trooper|APT1|Dragonfly 2.0|Sowbug
|
||||
T1137,Office Application Startup,Persistence,Gamaredon Group|APT32
|
||||
T1153,Source,Execution,no
|
||||
T1133,External Remote Services,Persistence|Initial Access,Sandworm Team|APT41|Soft Cell|TEMP.Veles|Night Dragon|OilRig|Dragonfly 2.0|Ke3chang|FIN5|Threat Group-3390|APT18
|
||||
T1132,Data Encoding,Command And Control,no
|
||||
T1129,Shared Modules,Execution,no
|
||||
T1127,Trusted Developer Utilities Proxy Execution,Defense Evasion,no
|
||||
T1125,Video Capture,Collection,Silence|FIN7
|
||||
T1124,System Time Discovery,Discovery,The White Company|Lazarus Group|BRONZE BUTLER|Turla
|
||||
T1123,Audio Capture,Collection,APT37
|
||||
T1120,Peripheral Device Discovery,Discovery,Turla|APT37|Gamaredon Group|Equation|APT28
|
||||
T1119,Automated Collection,Collection,Tropic Trooper|Frankenstein|APT1|APT28|Patchwork|OilRig|FIN5|Threat Group-3390|FIN6
|
||||
T1115,Clipboard Data,Collection,APT39|APT38
|
||||
T1114,Email Collection,Collection,no
|
||||
T1113,Screen Capture,Collection,Gamaredon Group|APT39|Silence|MuddyWater|Dragonfly 2.0|OilRig|Dark Caracal|FIN7|BRONZE BUTLER|Magic Hound|Group5|APT28
|
||||
T1112,Modify Registry,Defense Evasion,Gamaredon Group|Blue Mockingbird|Wizard Spider|Silence|APT41|Turla|APT32|APT38|Dragonfly 2.0|APT19|Threat Group-3390|Honeybee|Patchwork|Gorgon Group|FIN8
|
||||
T1111,Two-Factor Authentication Interception,Credential Access,no
|
||||
T1110,Brute Force,Credential Access,DarkVishnya|APT39|OilRig|FIN5|Turla
|
||||
T1108,Redundant Access,Defense Evasion|Persistence,no
|
||||
T1106,Native API,Execution,Gamaredon Group|Tropic Trooper|Sharpshooter|Turla|Silence|Gorgon Group|APT37
|
||||
T1105,Ingress Tool Transfer,Command And Control,Sandworm Team|Whitefly|Rocke|APT39|Tropic Trooper|Sharpshooter|Molerats|Frankenstein|Silence|APT-C-36|APT41|Soft Cell|TA505|WIRTE|APT33|MuddyWater|APT18|APT38|Rancor|Cobalt Group|Turla|Gorgon Group|OilRig|Dragonfly 2.0|APT37|FIN8|PLATINUM|Leviathan|Elderwood|Magic Hound|APT3|APT32|BRONZE BUTLER|menuPass|FIN7|Gamaredon Group|Patchwork|Lazarus Group|Threat Group-3390|APT28
|
||||
T1104,Multi-Stage Channels,Command And Control,APT41|MuddyWater|APT3
|
||||
T1102,Web Service,Command And Control,Gamaredon Group|Rocke|Inception|FIN6
|
||||
T1098,Account Manipulation,Persistence,APT3|Dragonfly 2.0|Lazarus Group
|
||||
T1095,Non-Application Layer Protocol,Command And Control,APT29|PLATINUM|APT3
|
||||
T1092,Communication Through Removable Media,Command And Control,APT28
|
||||
T1091,Replication Through Removable Media,Lateral Movement|Initial Access,Tropic Trooper|Darkhotel|APT28
|
||||
T1090,Proxy,Command And Control,Sandworm Team|Blue Mockingbird|Wizard Spider|APT41|Turla
|
||||
T1087,Account Discovery,Discovery,no
|
||||
T1083,File and Directory Discovery,Discovery,Gamaredon Group|Tropic Trooper|Inception|APT41|Kimsuky|APT32|MuddyWater|APT18|Leafminer|Honeybee|Dark Caracal|Dragonfly 2.0|Magic Hound|Sowbug|BRONZE BUTLER|APT3|APT28|Patchwork|Lazarus Group|Dust Storm|admin@338|Turla|Ke3chang
|
||||
T1082,System Information Discovery,Discovery,Rocke|Sandworm Team|Blue Mockingbird|Tropic Trooper|Frankenstein|Inception|Kimsuky|Darkhotel|MuddyWater|APT18|Honeybee|APT19|APT37|APT32|Magic Hound|OilRig|APT3|Sowbug|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|admin@338|Turla|Ke3chang
|
||||
T1080,Taint Shared Content,Lateral Movement,BRONZE BUTLER|Darkhotel
|
||||
T1078,Valid Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,Sandworm Team|Wizard Spider|Silence|APT41|Soft Cell|TEMP.Veles|APT39|FIN4|Night Dragon|Dragonfly 2.0|FIN8|Leviathan|APT33|OilRig|FIN5|menuPass|APT28|FIN10|Suckfly|FIN6|Threat Group-3390|APT18|PittyTiger|Carbanak
|
||||
T1074,Data Staged,Collection,Wizard Spider
|
||||
T1072,Software Deployment Tools,Execution|Lateral Movement,Silence|APT32|Threat Group-1314
|
||||
T1071,Application Layer Protocol,Command And Control,Rocke|Magic Hound|Dragonfly 2.0
|
||||
T1070,Indicator Removal on Host,Defense Evasion,no
|
||||
T1069,Permission Groups Discovery,Discovery,TA505|APT3
|
||||
T1068,Exploitation for Privilege Escalation,Privilege Escalation,Whitefly|APT33|Cobalt Group|PLATINUM|FIN8|APT32|Threat Group-3390|FIN6|APT28
|
||||
T1064,Scripting,Defense Evasion|Execution,no
|
||||
T1062,Hypervisor,Persistence,no
|
||||
T1061,Graphical User Interface,Execution,no
|
||||
T1059,Command and Scripting Interpreter,Execution,APT32|Molerats|Whitefly|Dragonfly 2.0|APT19|FIN7|OilRig|FIN5|Stealth Falcon|FIN6|Ke3chang
|
||||
T1057,Process Discovery,Discovery,Rocke|Frankenstein|Inception|Darkhotel|MuddyWater|APT1|APT38|Tropic Trooper|APT37|Honeybee|OilRig|APT3|Magic Hound|APT28|Winnti Group|Stealth Falcon|Poseidon Group|Lazarus Group|Molerats|Turla|Deep Panda|Ke3chang
|
||||
T1056,Input Capture,Collection|Credential Access,no
|
||||
T1055,Process Injection,Defense Evasion|Privilege Escalation,APT32|Sharpshooter|Silence|APT41|Kimsuky|Turla|Cobalt Group|APT37|Honeybee|PLATINUM
|
||||
T1053,Scheduled Task/Job,Execution|Persistence|Privilege Escalation,no
|
||||
T1052,Exfiltration Over Physical Medium,Exfiltration,no
|
||||
T1051,Shared Webroot,Lateral Movement,no
|
||||
T1049,System Network Connections Discovery,Discovery,Tropic Trooper|APT41|APT38|Soft Cell|APT32|APT1|OilRig|APT3|menuPass|Threat Group-3390|Poseidon Group|admin@338|Turla|Ke3chang
|
||||
T1048,Exfiltration Over Alternative Protocol,Exfiltration,no
|
||||
T1047,Windows Management Instrumentation,Execution,Blue Mockingbird|Wizard Spider|Frankenstein|APT41|FIN6|Soft Cell|APT32|MuddyWater|OilRig|Threat Group-3390|FIN8|Leviathan|menuPass|Stealth Falcon|Lazarus Group|APT29|Deep Panda
|
||||
T1046,Network Service Scanning,Discovery,Rocke|DarkVishnya|APT41|Tropic Trooper|APT39|APT32|Leafminer|OilRig|Cobalt Group|menuPass|Suckfly|FIN6|Threat Group-3390
|
||||
T1043,Commonly Used Port,Command And Control,Machete|OilRig|APT28|TEMP.Veles|Night Dragon|APT29|APT18|APT19|Dragonfly 2.0|FIN7|FIN8|APT37|Magic Hound|APT3|Lazarus Group|Threat Group-3390
|
||||
T1041,Exfiltration Over C2 Channel,Exfiltration,Sandworm Team|MuddyWater|Wizard Spider|Frankenstein|Kimsuky|Soft Cell|APT32|APT3|Gamaredon Group|Stealth Falcon|Lazarus Group|Ke3chang
|
||||
T1040,Network Sniffing,Credential Access|Discovery,Sandworm Team|DarkVishnya|APT33|Stolen Pencil|APT28
|
||||
T1039,Data from Network Shared Drive,Collection,Sowbug|BRONZE BUTLER|menuPass
|
||||
T1037,Boot or Logon Initialization Scripts,Persistence|Privilege Escalation,Rocke
|
||||
T1036,Masquerading,Defense Evasion,Windshift|APT32|BRONZE BUTLER|menuPass|Dragonfly 2.0
|
||||
T1034,Path Interception,Persistence|Privilege Escalation,no
|
||||
T1033,System Owner/User Discovery,Discovery,Frankenstein|APT41|Soft Cell|Tropic Trooper|APT39|MuddyWater|APT32|APT37|APT19|Dragonfly 2.0|OilRig|Magic Hound|FIN10|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|APT3
|
||||
T1030,Data Transfer Size Limits,Exfiltration,Threat Group-3390
|
||||
T1029,Scheduled Transfer,Exfiltration,no
|
||||
T1027,Obfuscated Files or Information,Defense Evasion,Gamaredon Group|Rocke|Sandworm Team|Blue Mockingbird|Whitefly|Molerats|Wizard Spider|Mofang|Frankenstein|Inception|APT-C-36|APT41|Machete|Soft Cell|Turla|TA505|Silence|APT33|Night Dragon|Darkhotel|Gallmaker|APT29|APT18|Tropic Trooper|Cobalt Group|Patchwork|Leafminer|APT37|Threat Group-3390|Honeybee|Dark Caracal|menuPass|APT19|BlackOasis|FIN8|Leviathan|Elderwood|MuddyWater|FIN7|Magic Hound|OilRig|APT3|APT32|Group5|Dust Storm|Lazarus Group|Putter Panda|APT28
|
||||
T1026,Multiband Communication,Command And Control,Lazarus Group
|
||||
T1025,Data from Removable Media,Collection,Machete|Turla|Gamaredon Group|APT28
|
||||
T1021,Remote Services,Lateral Movement,no
|
||||
T1020,Automated Exfiltration,Exfiltration,Tropic Trooper|Frankenstein|Honeybee
|
||||
T1018,Remote System Discovery,Discovery,Sandworm Team|Rocke|Wizard Spider|Silence|Soft Cell|APT39|APT32|Deep Panda|Threat Group-3390|Dragonfly 2.0|Leafminer|Ke3chang|FIN8|APT3|FIN5|BRONZE BUTLER|menuPass|FIN6|Turla
|
||||
T1016,System Network Configuration Discovery,Discovery,Sandworm Team|Tropic Trooper|Frankenstein|APT41|Soft Cell|APT32|Darkhotel|MuddyWater|APT1|APT19|Dragonfly 2.0|Magic Hound|OilRig|menuPass|Threat Group-3390|Stealth Falcon|Lazarus Group|APT3|Naikon|admin@338|Turla|Ke3chang
|
||||
T1014,Rootkit,Defense Evasion,Rocke|APT41|APT28|Winnti Group
|
||||
T1012,Query Registry,Discovery,APT32|Dragonfly 2.0|Threat Group-3390|OilRig|Stealth Falcon|Lazarus Group|Turla
|
||||
T1011,Exfiltration Over Other Network Medium,Exfiltration,no
|
||||
T1010,Application Window Discovery,Discovery,Lazarus Group
|
||||
T1008,Fallback Channels,Command And Control,APT41|OilRig|Lazarus Group
|
||||
T1007,System Service Discovery,Discovery,BRONZE BUTLER|APT1|OilRig|Poseidon Group|admin@338|Turla|Ke3chang
|
||||
T1006,Direct Volume Access,Defense Evasion,no
|
||||
T1005,Data from Local System,Collection,Gamaredon Group|APT39|Frankenstein|Inception|Kimsuky|Soft Cell|Turla|menuPass|Dark Caracal|Dragonfly 2.0|Honeybee|APT37|APT28|APT3|BRONZE BUTLER|Patchwork|Stealth Falcon|Lazarus Group|Dust Storm|Threat Group-3390|APT1|Ke3chang
|
||||
T1003,OS Credential Dumping,Credential Access,APT39|Frankenstein|APT32|APT28|Leviathan|Sowbug|Suckfly|Poseidon Group|Axiom
|
||||
T1001,Data Obfuscation,Command And Control,Axiom
|
||||
|
@@ -1 +0,0 @@
|
||||
arn,latestCount,numDataPoints,avgApiCalls,stdevApiCalls
|
||||
|
@@ -1 +0,0 @@
|
||||
bucket_name,remote_ip,earliest,latest
|
||||
|
@@ -1 +0,0 @@
|
||||
earliest,latest,userName,eventName
|
||||
|
@@ -1 +0,0 @@
|
||||
firstTime,lastTime,requestingAccountId,requestedAccountId
|
||||
|
@@ -1 +0,0 @@
|
||||
earliest,latest,awsRegion
|
||||
|
@@ -1 +0,0 @@
|
||||
firstTime,lastTime,process
|
||||
|
@@ -1 +0,0 @@
|
||||
arn,firstTime,lastTime
|
||||
|
@@ -1,17 +0,0 @@
|
||||
prohibited_applications,isProhibited
|
||||
winword.exe,prohibited
|
||||
EXCEL.EXE,prohibited
|
||||
OUTLOOK.EXE,prohibited
|
||||
POWERPNT.EXE,prohibited
|
||||
visio.exe,prohibited
|
||||
mspub.exe,prohibited
|
||||
Acrobat.exe,prohibited
|
||||
Acrord32.exe,prohibited
|
||||
chrome.exe,prohibited
|
||||
iexplore.exe,prohibited
|
||||
opera.exe,prohibited
|
||||
firefox.exe,prohibited
|
||||
java.exe,prohibited
|
||||
powershell.exe,prohibited
|
||||
mshta.exe, prohibited
|
||||
zoom.exe,prohibitied
|
||||
|
-20
@@ -1,20 +0,0 @@
|
||||
app,note
|
||||
remcom.exe,ESCU - This process is an open source replacement to psexec and is not typically seen in an enterprise environment.
|
||||
pwdump.exe,ESCU - This process is associated with a tool used to dump password hashes on a Windows system.
|
||||
pwdump2.exe,ESCU - This process is associated with a tool used to dump password hashes on a Windows system.
|
||||
nc.exe,ESCU - This process is an open source tool used for network communications.
|
||||
wce.exe,ESCU - This process is associated with a tool used to dump hashes and execute pass-the-hash and pass-the-ticket attacks.
|
||||
cain.exe,ESCU - This process is associated with a tool used to collect user credentials and execute attacks.
|
||||
nmap.exe,ESCU - This process is an open source network mapping tool used to identify hosts and listening services on a network.
|
||||
kidlogger.exe,ESCU - This process is associated with a tool used to collect keyboard input on a host.
|
||||
isass.exe,ESCU - This process name is used by attackers to hide in plain sight and look like a legitimate Windows system process.
|
||||
svch0st.exe,ESCU - This process name is used by attackers to hide in plain sight and look like a legitimate Windows system process.
|
||||
at.exe,ESCU - This process is used to schedule other processes to run. schtasks.exe should be used instead as it provides more flexibility.
|
||||
getmail.exe,ESCU - This process is seen to be used by attackers to extract email files from host machines.
|
||||
ntdll.exe,ESCU - This process was identified as malicious by DHS Alert TA18-074A.
|
||||
netpass.exe,ESCU - This process was identified as malicious by DHS Alert TA18-201A and attackers use this tool to recover all network passwords stored on your system for the current logged-on user.
|
||||
WebBrowserPassView.exe,ESCU - This process was identified as malicious by DHS Alert TA18-201A and is used by attackers as a password recovery tool that reveals the passwords stored in Web Browsers.
|
||||
OutlookAddressBookView.exe,ESCU - This process was identified as malicious by DHS Alert TA18-201A and is used by attackers to steal the details of all recipients stored in the address books of Microsoft Outlook.
|
||||
mailpv.exe,ESCU - This process was identified by DHS Alert TA18-201A and attackers use this tool is a password-recovery tool that reveals the passwords and other account details from various email clients.
|
||||
NLBrute.exe,ESCU - This process was identified in the SamSam Ransomware Campaign and attackers use this tool to brute force RDP instances with a range of commonly used passwords.
|
||||
selfdel.exe,ESCU - This executable was delivered in the SamSam Ransomware Campain and the attackers levereged this binary to delete its malicilous activities.
|
||||
|
-20
@@ -1,20 +0,0 @@
|
||||
app,note
|
||||
remcom.exe,ESCU - This process is an open source replacement to psexec and is not typically seen in an enterprise environment.
|
||||
pwdump.exe,ESCU - This process is associated with a tool used to dump password hashes on a Windows system.
|
||||
pwdump2.exe,ESCU - This process is associated with a tool used to dump password hashes on a Windows system.
|
||||
nc.exe,ESCU - This process is an open source tool used for network communications.
|
||||
wce.exe,ESCU - This process is associated with a tool used to dump hashes and execute pass-the-hash and pass-the-ticket attacks.
|
||||
cain.exe,ESCU - This process is associated with a tool used to collect user credentials and execute attacks.
|
||||
nmap.exe,ESCU - This process is an open source network mapping tool used to identify hosts and listening services on a network.
|
||||
kidlogger.exe,ESCU - This process is associated with a tool used to collect keyboard input on a host.
|
||||
isass.exe,ESCU - This process name is used by attackers to hide in plain sight and look like a legitimate Windows system process.
|
||||
svch0st.exe,ESCU - This process name is used by attackers to hide in plain sight and look like a legitimate Windows system process.
|
||||
at.exe,ESCU - This process is used to schedule other processes to run. schtasks.exe should be used instead as it provides more flexibility.
|
||||
getmail.exe,ESCU - This process is seen to be used by attackers to extract email files from host machines.
|
||||
ntdll.exe,ESCU - This process was identified as malicious by DHS Alert TA18-074A.
|
||||
netpass.exe,ESCU - This process was identified as malicious by DHS Alert TA18-201A and attackers use this tool to recover all network passwords stored on your system for the current logged-on user.
|
||||
WebBrowserPassView.exe,ESCU - This process was identified as malicious by DHS Alert TA18-201A and is used by attackers as a password recovery tool that reveals the passwords stored in Web Browsers.
|
||||
OutlookAddressBookView.exe,ESCU - This process was identified as malicious by DHS Alert TA18-201A and is used by attackers to steal the details of all recipients stored in the address books of Microsoft Outlook.
|
||||
mailpv.exe,ESCU - This process was identified by DHS Alert TA18-201A and attackers use this tool is a password-recovery tool that reveals the passwords and other account details from various email clients.
|
||||
NLBrute.exe,ESCU - This process was identified in the SamSam Ransomware Campaign and attackers use this tool to brute force RDP instances with a range of commonly used passwords.
|
||||
selfdel.exe,ESCU - This executable was delivered in the SamSam Ransomware Campain and the attackers levereged this binary to delete its malicilous activities.
|
||||
|
-299
@@ -1,299 +0,0 @@
|
||||
Extensions,Name
|
||||
.enc,.CryptoHasYou.
|
||||
.777,777
|
||||
.R4A,7ev3n
|
||||
.R5A,7ev3n
|
||||
.7h9r,7h9r
|
||||
.8lock8,8lock8
|
||||
.encrypt,Alpha Ransomware
|
||||
.amba,AMBA
|
||||
.adk,Angry Duck
|
||||
.encrypted,Apocalypse
|
||||
.SecureCrypted,Apocalypse
|
||||
.FuckYourData,Apocalypse
|
||||
.unavailable,Apocalypse
|
||||
.bleepYourFiles,Apocalypse
|
||||
.Where_my_files.txt,Apocalypse
|
||||
.encrypted,ApocalypseVM
|
||||
.locked,ApocalypseVM
|
||||
.locky,AutoLocky
|
||||
.adr,BaksoCrypt
|
||||
.bart.zip,Bart
|
||||
.bart,Bart
|
||||
.perl,Bart
|
||||
.clf,BitCryptor
|
||||
.bitstak,BitStak
|
||||
.Silent,BlackShades Crypter
|
||||
.blocatto,Blocatto
|
||||
.lock,Brazilian
|
||||
.cry,Central Security Treatment Organization
|
||||
.cerber,Cerber
|
||||
.cerber2,Cerber
|
||||
.cerber3,Cerber
|
||||
.clf,CoinVault
|
||||
.coverton,Coverton
|
||||
.enigma,Coverton
|
||||
.czvxce,Coverton
|
||||
.criptiko,CryFile
|
||||
.criptoko,CryFile
|
||||
.criptokod,CryFile
|
||||
.cripttt,CryFile
|
||||
.aga,CryFile
|
||||
.cry,CryLocker
|
||||
.ENCRYPTED,Crypren
|
||||
.crypt38,Crypt38
|
||||
.scl,CryptFIle2
|
||||
.crinf,CryptInfinite
|
||||
.frtrss,CryptoFortress
|
||||
.clf,CryptoGraphic Locker
|
||||
.crjoker,CryptoJoker
|
||||
.encrypted ,CryptoLocker
|
||||
.ENC,CryptoLocker
|
||||
.code,CryptoMix
|
||||
.scl,CryptoMix
|
||||
.crptrgr,CryptoRoger
|
||||
.locked,CryptoShocker
|
||||
.CryptoTorLocker2015!,CryptoTorLocker2015
|
||||
.crypt,CryptXXX
|
||||
.crypt,CryptXXX 2.0
|
||||
.crypt,CryptXXX 3.0
|
||||
.cryp1,CryptXXX 3.0
|
||||
.crypz,CryptXXX 3.0
|
||||
.cryptz,CryptXXX 3.0
|
||||
.cryp1,CryptXXX 3.1
|
||||
.ctbl,CTB-Locker
|
||||
.encrypted,CuteRansomware
|
||||
.ded,DEDCryptor
|
||||
.domino,Domino
|
||||
.locked,EDA2 / HiddenTear
|
||||
.isis,EduCrypt
|
||||
.locked,EduCrypt
|
||||
.ha3,El-Polocker
|
||||
.enigma,Enigma
|
||||
.1txt,Enigma
|
||||
.exotic,Exotic
|
||||
.locked,Fakben
|
||||
.fantom,Fantom
|
||||
.Z81928819,GhostCrypt
|
||||
.purge,Globe v1
|
||||
.globe,Globe v3
|
||||
.locked,GNL Locker
|
||||
.crypt,Gomasom
|
||||
.herbst,Herbst
|
||||
.cry,Hi Buddy!
|
||||
.locky,Hucky
|
||||
.crime,iLock
|
||||
.crime,iLockLight
|
||||
.btc,Jigsaw
|
||||
.kkk,Jigsaw
|
||||
.fun,Jigsaw
|
||||
.gws,Jigsaw
|
||||
.porno,Jigsaw
|
||||
.payransom,Jigsaw
|
||||
.payms,Jigsaw
|
||||
.paymst,Jigsaw
|
||||
.AFD,Jigsaw
|
||||
.paybtcs,Jigsaw
|
||||
.epic,Jigsaw
|
||||
.xyz,Jigsaw
|
||||
.locked,Job Crypter
|
||||
.encrypted,KeRanger
|
||||
.keybtc@inbox_com,KeyBTC
|
||||
.rip,Killer Locker
|
||||
.kimcilware,KimcilWare
|
||||
.locked,KimcilWare
|
||||
.kostya,Kostya
|
||||
.kratos,KratosCrypt
|
||||
.LeChiffre,LeChiffre
|
||||
.locky,Locky
|
||||
.zepto,Locky
|
||||
.odin,Locky
|
||||
.shit,Locky
|
||||
.thor,Locky
|
||||
.asier,Locky
|
||||
.zzzzz,Locky
|
||||
.osiris,Locky
|
||||
.lock93,Lock93
|
||||
.crime,Lortok
|
||||
.oor,LowLevel04
|
||||
.magic,Magic
|
||||
.Lock,MIRCOP
|
||||
.fucked,MireWare
|
||||
.fuck,MireWare
|
||||
.locked,MM Locker
|
||||
.KEYZ,Mobef
|
||||
.KEYH0LES,Mobef
|
||||
.crypted,Nemucod
|
||||
.odcodc,ODCODC
|
||||
.cbf,Offline ransomware
|
||||
.LOL!,OMG! Ransomware
|
||||
.OMG!,OMG! Ransomware
|
||||
.padcrypt,PadCrypt
|
||||
.locked,Philadelphia
|
||||
.locked,PokemonGO
|
||||
.filock,Popcorn Time
|
||||
.locky,PowerWare
|
||||
.crypt,R980
|
||||
.locked,RAA encryptor
|
||||
.RDM,Radamant
|
||||
.RRK,Radamant
|
||||
.RAD,Radamant
|
||||
.RADAMANT,Radamant
|
||||
.locked,Rakhni
|
||||
.kraken,Rakhni
|
||||
.darkness,Rakhni
|
||||
.nochance,Rakhni
|
||||
.oshit,Rakhni
|
||||
.oplata@qq_com,Rakhni
|
||||
.relock@qq_com,Rakhni
|
||||
.crypto,Rakhni
|
||||
.helpdecrypt@ukr.net,Rakhni
|
||||
.pizda@qq_com,Rakhni
|
||||
.dyatel@qq_com,Rakhni
|
||||
._ryp,Rakhni
|
||||
.nalog@qq_com,Rakhni
|
||||
.chifrator@qq_com,Rakhni
|
||||
.gruzin@qq_com,Rakhni
|
||||
.troyancoder@qq_com,Rakhni
|
||||
.encrypted,Rakhni
|
||||
.cry,Rakhni
|
||||
.AES256,Rakhni
|
||||
.enc,Rakhni
|
||||
.hb15,Rakhni
|
||||
.vscrypt,Rector
|
||||
.infected,Rector
|
||||
.bloc,Rector
|
||||
.korrektor,Rector
|
||||
.rekt,RektLocker
|
||||
.remind,RemindMe
|
||||
.crashed,RemindMe
|
||||
.rokku,Rokku
|
||||
.encryptedAES,Samas-Samsam
|
||||
.encryptedRSA,Samas-Samsam
|
||||
.encedRSA,Samas-Samsam
|
||||
.justbtcwillhelpyou,Samas-Samsam
|
||||
.btcbtcbtc,Samas-Samsam
|
||||
.btc-help-you,Samas-Samsam
|
||||
.only-we_can-help_you,Samas-Samsam
|
||||
.iwanthelpuuu,Samas-Samsam
|
||||
.notfoundrans,Samas-Samsam
|
||||
.encmywork,Samas-Samsam
|
||||
.weapologize,Samas-Samsam
|
||||
.stubbin,Samas-Samsam
|
||||
.areyoulovemyrans,Samas-Samsam
|
||||
.loveransisgood,Samas-Samsam
|
||||
.myransext2017,Samas-Samsam
|
||||
.disposed2017,Samas-Samsam
|
||||
.prosperous666,Samas-Samsam
|
||||
.supported2017,Samas-Samsam
|
||||
.country82000,Samas-Samsam
|
||||
.moments2900,Samas-Samsam
|
||||
.breeding123,Samas-Samsam
|
||||
.mention9823,Samas-Samsam
|
||||
.suppose666,Samas-Samsam
|
||||
.skjdthghh,Samas-Samsam
|
||||
.cifgksaffsfyghd,Samas-Samsam
|
||||
.iaufkakfhsaraf,Samas-Samsam
|
||||
.filegofprencrp,Samas-Samsam
|
||||
.weencedufiles,Samas-Samsam
|
||||
.encryptedyourfiles,Samas-Samsam
|
||||
.letmetrydecfiles,Samas-Samsam
|
||||
.otherinformation,Samas-Samsam
|
||||
.weareyourfriends,Samas-Samsam
|
||||
.noproblemwedecfiles,Samas-Samsam
|
||||
.powerfulldecrypt,Samas-Samsam
|
||||
.wowreadfordecryp,Samas-Samsam
|
||||
.wowwhereismyfiles,Samas-Samsam
|
||||
.helpmeencedfiles,Samas-Samsam
|
||||
.theworldisyours,Samas-Samsam
|
||||
.vekanhelpu,Samas-Samsam
|
||||
.howcanihelpusir,Samas-Samsam
|
||||
.VforVendetta,Samas-Samsam
|
||||
.checkdiskenced,Samas-Samsam
|
||||
.goforhelp,Samas-Samsam
|
||||
.iloveworld,Samas-Samsam
|
||||
.canihelpyou,Samas-Samsam
|
||||
.AreYouLoveMyRansFile,Samas-Samsam
|
||||
.fucku,Samas-Samsam
|
||||
.happenencedfiles,Samas-Samsam
|
||||
.iwishiyou,Samas-Samsam
|
||||
.powerfulldecryp,Samas-Samsam
|
||||
.suppose665,Samas-Samsam
|
||||
.Whereisyourfiles,Samas-Samsam
|
||||
.sanction,Sanction
|
||||
.locked,Shark
|
||||
.shino,ShinoLocker
|
||||
.locked,SkidLocker / Pompous
|
||||
.encrypted,Smrss32
|
||||
.RSNSlocked,SNSLocker
|
||||
.RSplited,SNSLocker
|
||||
.sport,Sport
|
||||
.locked,Stampado
|
||||
.locked,Strictor
|
||||
.surprise,Surprise
|
||||
.tzu,Surprise
|
||||
.szf,SZFLocker
|
||||
.xcri,TeleCrypt
|
||||
.vvv,TeslaCrypt 0.x - 2.2.0
|
||||
.ecc,TeslaCrypt 0.x - 2.2.0
|
||||
.exx,TeslaCrypt 0.x - 2.2.0
|
||||
.ezz,TeslaCrypt 0.x - 2.2.0
|
||||
.abc,TeslaCrypt 0.x - 2.2.0
|
||||
.aaa,TeslaCrypt 0.x - 2.2.0
|
||||
.zzz,TeslaCrypt 0.x - 2.2.0
|
||||
.xyz,TeslaCrypt 0.x - 2.2.0
|
||||
.micro,TeslaCrypt 3.0+
|
||||
.xxx,TeslaCrypt 3.0+
|
||||
.ttt,TeslaCrypt 3.0+
|
||||
.mp3,TeslaCrypt 3.0+
|
||||
.Encrypted,TorrentLocker
|
||||
.enc,TorrentLocker
|
||||
.toxcrypt,Toxcrypt
|
||||
.better_call_saul,Troldesh
|
||||
.xtbl,Troldesh
|
||||
.da_vinci_code,Troldesh
|
||||
.windows10,Troldesh
|
||||
.enc,TrueCrypter
|
||||
.locked,Turkish Ransom
|
||||
.H3LL,Ungluk
|
||||
.0x0,Ungluk
|
||||
.1999,Ungluk
|
||||
.CRRRT,Unlock92
|
||||
.CCCRRRPPP,Unlock92
|
||||
.vault,VaultCrypt
|
||||
.xort,VaultCrypt
|
||||
.trun,VaultCrypt
|
||||
.Venusf,VenusLocker
|
||||
.Venusp,VenusLocker
|
||||
.CrySiS,Virus-Encoder
|
||||
.xtbl,Virus-Encoder
|
||||
.wflx,WildFire Locker
|
||||
.EnCiPhErEd,Xorist
|
||||
.73i87A,Xorist
|
||||
.p5tkjw,Xorist
|
||||
.PoAr2w,Xorist
|
||||
.fileiscryptedhard,Xorist
|
||||
.encoderpass,Xorist
|
||||
.zc3791,Xorist
|
||||
.xrtn,XRTN
|
||||
.zcrypt,Zcrypt
|
||||
.crypto,Zimbra
|
||||
.vault,Zlader / Russian
|
||||
.zyklon,Zyklon
|
||||
.wncry,WannaCry
|
||||
.wcry,WannaCry
|
||||
.wnry,WannaCry
|
||||
.wncryt,WannaCry
|
||||
.WNCRYT,WannaCry
|
||||
.RYK,Ryuk
|
||||
.Clop,Clop
|
||||
.Cllp,Clop
|
||||
.JSWORM,JSWorm
|
||||
.NEMTY_*,Nemty
|
||||
.NEFILIM,Nefilim
|
||||
.OFFWHITE,Offwhite
|
||||
.TELEGRAM,Telegram
|
||||
.FUSION,Fusion
|
||||
.MILIHPEN,Milihpen
|
||||
.GANGBANG,Gangbang
|
||||
.reddot,RedDot
|
||||
|
-69
@@ -1,69 +0,0 @@
|
||||
ransomware_notes, status
|
||||
HELP_TO_SAVE_FILES.txt,True
|
||||
BitCryptorFileList.txt,True
|
||||
BUYUNLOCKCODE,True
|
||||
YOUR_FILES_ARE_ENCRYPTED.HTML,True
|
||||
Coin.Locker.txt,True
|
||||
DECRYPT_INSTRUCTIONS.HTML,True
|
||||
ReadDecryptFilesHere.txt,True
|
||||
HOW_DECRYPT.TXT,True
|
||||
READ IF YOU WANT YOUR FILES BACK.HTML,True
|
||||
GetYouFiles.txt,True
|
||||
HOW TO DECRYPT FILES.HTML,True
|
||||
DECRYPT_INSTRUCTION.TXT,True
|
||||
HELP_DECRYPT.TXT,True
|
||||
HELP_YOURFILES.HTML,True
|
||||
HowDecrypt.gif,True
|
||||
Decrypt All Files *.bmp,True
|
||||
cryptinfo.txt,True
|
||||
DECRYPT_Readme.TXT.ReadMe,True
|
||||
qwer.html,True
|
||||
qwer2.html,True
|
||||
Hellothere.txt,True
|
||||
FILESAREGONE.TXT,True
|
||||
HOW TO DECRYPT FILES.TXT,True
|
||||
DECRYPT_Readme.TXT.ReadMe,True
|
||||
README_DECRYPT_HYDRA_ID_*.txt,True
|
||||
DECRYPT_YOUR_FILES.HTML,True
|
||||
KryptoLocker_README.txt,True
|
||||
_Locky_recover_instructions.txt,True
|
||||
DECRYPT_Readme.TXT.ReadMe,True
|
||||
ATTENTION.RTF,True
|
||||
how to get data.txt,True
|
||||
IMPORTANT READ ME.txt,True
|
||||
UnblockFiles.vbs,True
|
||||
YOUR_FILES.url,True
|
||||
exit.hhr.obleep,True
|
||||
HOW_TO_DECRYPT.HTML,True
|
||||
HOW-TO-DECRYPT-FILES.HTML,True
|
||||
HELP_TO_SAVE_FILES.txt,True
|
||||
HELP_TO_SAVE_FILES.txt,True
|
||||
HELP_TO_SAVE_FILES.txt,True
|
||||
_H_e_l_p_RECOVER_INSTRUCTIONS+*.txt,True
|
||||
DECRYPT_INSTRUCTIONS.HTML,True
|
||||
README_DECRYPT_UMBRE_ID_*.txt,True
|
||||
Help_Decrypt.txt,True
|
||||
CryptLogFile.txt,True
|
||||
*@Please_Read_Me@.txt*,True
|
||||
*@WanaDecryptor@.exe*,True
|
||||
# DECRYPT MY FILES #.vbs,True
|
||||
# DECRYPT MY FILES #.html,True
|
||||
# DECRYPT MY FILES #.txt,True
|
||||
# DECRYPT MY FILES #.vbs,True
|
||||
# DECRYPT MY FILES #.html,True
|
||||
# DECRYPT MY FILES #.txt,True
|
||||
HELP_DECRYPT_YOUR_FILES.HTML,True
|
||||
*-HELP_FOR_DECRYPT_FILE.html,True
|
||||
*-SORRY-FOR-FILES.html,True
|
||||
*-READ-FOR-HELLPP.html,True
|
||||
RyukReadMe.html,True
|
||||
ClopReadMe.txt,True
|
||||
README_README.txt,True
|
||||
JSWORM-DECRYPT.html,True
|
||||
NEMTY_*-DECRYPT.txt,True
|
||||
NEFILIM-DECRYPT.txt,True
|
||||
OFFWHITE-MANUAL.txt,True
|
||||
TELEGRAM-RECOVER.txt,True
|
||||
FUSION-README.txt,True
|
||||
MILIHPEN-INSTRUCT.txt,True
|
||||
GANGBANG-NOTE.txt,True
|
||||
|
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user