Branch was auto-updated.

detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml

@@ -44,6 +44,7 @@ tags:
     of $expected_upper_threshold$ with the following command $command$.
   mitre_attack_id:
   - T1078.004
+  - T1078
   nist:
   - DE.DP
   - DE.CM

detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml

@@ -49,6 +49,7 @@ tags:
     command $command$.
   mitre_attack_id:
   - T1078.004
+  - T1078
   nist:
   - DE.DP
   - DE.CM

detections/cloud/aws_create_policy_version_to_allow_all_resources.yml

@@ -46,6 +46,7 @@ tags:
     in their account
   mitre_attack_id:
   - T1078.004
+  - T1078
   nist:
   - PR.DS
   - PR.AC

detections/cloud/aws_createaccesskey.yml

@@ -43,6 +43,7 @@ tags:
     from this IP $src$
   mitre_attack_id:
   - T1136.003
+  - T1136
   nist:
   - PR.DS
   - PR.AC

detections/cloud/aws_createloginprofile.yml

@@ -46,6 +46,7 @@ tags:
     and did a console login from this IP $src_ip$
   mitre_attack_id:
   - T1136.003
+  - T1136
   nist:
   - PR.DS
   - PR.AC

detections/cloud/aws_ecr_container_scanning_findings_high.yml

@@ -37,6 +37,7 @@ tags:
   message: Vulnerabilities with severity high found in image $image$
   mitre_attack_id:
   - T1204.003
+  - T1204
   nist:
   - PR.DS
   - PR.AC

detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml

@@ -36,6 +36,7 @@ tags:
   message: Vulnerabilities with severity high found in repository $repositoryName$
   mitre_attack_id:
   - T1204.003
+  - T1204
   nist:
   - PR.DS
   - PR.AC

detections/cloud/aws_ecr_container_scanning_findings_medium.yml

@@ -35,6 +35,7 @@ tags:
   message: Vulnerabilities with severity high found in image $image$
   mitre_attack_id:
   - T1204.003
+  - T1204
   nist:
   - PR.DS
   - PR.AC

detections/cloud/aws_ecr_container_upload_outside_business_hours.yml

@@ -33,6 +33,7 @@ tags:
   message: Container uploaded outside business hours from $user$
   mitre_attack_id:
   - T1204.003
+  - T1204
   nist:
   - PR.DS
   - PR.AC

detections/cloud/aws_ecr_container_upload_unknown_user.yml

@@ -33,6 +33,7 @@ tags:
   message: Container uploaded from unknown user $user$
   mitre_attack_id:
   - T1204.003
+  - T1204
   nist:
   - PR.DS
   - PR.AC

detections/cloud/aws_iam_successful_group_deletion.yml

@@ -42,6 +42,7 @@ tags:
   mitre_attack_id:
   - T1069.003
   - T1098
+  - T1069
   observable:
   - name: src
     type: IP Address

detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml

@@ -46,6 +46,7 @@ tags:
     CIDR $requestParameters.cidrBlock$
   mitre_attack_id:
   - T1562.007
+  - T1562
   nist:
   - DE.DP
   - DE.AE

detections/cloud/aws_network_access_control_list_deleted.yml

@@ -41,6 +41,7 @@ tags:
     $eventName$), such that the instance is accessible from anywhere
   mitre_attack_id:
   - T1562.007
+  - T1562
   nist:
   - DE.DP
   - DE.AE

detections/cloud/aws_setdefaultpolicyversion.yml

@@ -45,6 +45,7 @@ tags:
     event $eventName$ for updating the the default policy version
   mitre_attack_id:
   - T1078.004
+  - T1078
   nist:
   - PR.DS
   - PR.AC

detections/cloud/aws_updateloginprofile.yml

@@ -39,6 +39,7 @@ tags:
     user $user_arn$ more access privilleges
   mitre_attack_id:
   - T1136.003
+  - T1136
   nist:
   - PR.DS
   - PR.AC

detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml

@@ -44,6 +44,7 @@ tags:
   message: User $user$ is creating a new instance $dest$ for the first time
   mitre_attack_id:
   - T1078.004
+  - T1078
   nist:
   - ID.AM
   observable:

detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml

@@ -44,6 +44,7 @@ tags:
   message: User $user$ is modifying an instance $dest$ for the first time.
   mitre_attack_id:
   - T1078.004
+  - T1078
   nist:
   - ID.AM
   observable:

detections/cloud/correlation_by_repository_and_risk.yml

@@ -27,6 +27,7 @@ tags:
   message: Correlation triggered for user $user$
   mitre_attack_id:
   - T1204.003
+  - T1204
   nist:
   - PR.DS
   - PR.AC

detections/cloud/correlation_by_user_and_risk.yml

@@ -27,6 +27,7 @@ tags:
   message: Correlation triggered for user $user$
   mitre_attack_id:
   - T1204.003
+  - T1204
   nist:
   - PR.DS
   - PR.AC

detections/cloud/github_dependabot_alert.yml

@@ -33,6 +33,7 @@ tags:
   message: Vulnerabilities found in packages used by GitHub repository $repository$
   mitre_attack_id:
   - T1195.001
+  - T1195
   nist:
   - PR.DS
   - PR.AC

detections/cloud/github_pull_request_from_unknown_user.yml

@@ -33,6 +33,7 @@ tags:
   message: Vulnerabilities found in packages used by GitHub repository $repository$
   mitre_attack_id:
   - T1195.001
+  - T1195
   nist:
   - PR.DS
   - PR.AC

detections/cloud/gsuite_drive_share_in_external_email.yml

@@ -41,6 +41,7 @@ tags:
   message: suspicious share gdrive from $parameters.owner$ to $email$ namely as $parameters.doc_title$
   mitre_attack_id:
   - T1567.002
+  - T1567
   observable:
   - name: parameters.owner
     type: User
@@ -66,3 +67,4 @@ tags:
   - parameters.doc_type
   risk_score: 72
   security_domain: endpoint
+

detections/cloud/gsuite_email_suspicious_attachment.yml

@@ -41,6 +41,7 @@ tags:
   message: suspicious email from $source.address$ to $destination{}.address$
   mitre_attack_id:
   - T1566.001
+  - T1566
   observable:
   - name: source.address
     type: User

detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml

@@ -49,6 +49,7 @@ tags:
   message: suspicious email from $source.address$ to $destination{}.address$
   mitre_attack_id:
   - T1566.001
+  - T1566
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml

@@ -40,6 +40,7 @@ tags:
   message: suspicious email from $source.address$ to $destination{}.address$
   mitre_attack_id:
   - T1566.001
+  - T1566
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml

@@ -40,6 +40,7 @@ tags:
   message: suspicious email from $source.address$ to $destination{}.address$
   mitre_attack_id:
   - T1048.003
+  - T1048
   observable:
   - name: source.address
     type: User

detections/cloud/gsuite_suspicious_shared_file_name.yml

@@ -46,6 +46,7 @@ tags:
   message: suspicious share gdrive from $parameters.owner$ to $email$ namely as $parameters.doc_title$
   mitre_attack_id:
   - T1566.001
+  - T1566
   observable:
   - name: parameters.owner
     type: User

detections/cloud/o365_add_app_role_assignment_grant_user.yml

@@ -41,6 +41,7 @@ tags:
     Address $ActorIpAddress$
   mitre_attack_id:
   - T1136.003
+  - T1136
   observable:
   - name: ActorIpAddress
     type: IP Address

detections/cloud/o365_added_service_principal.yml

@@ -44,6 +44,7 @@ tags:
     service principal credentials from IP Address $ActorIpAddress$
   mitre_attack_id:
   - T1136.003
+  - T1136
   observable:
   - name: ActorIpAddress
     type: IP Address

detections/cloud/o365_bypass_mfa_via_trusted_ip.yml

@@ -45,6 +45,7 @@ tags:
     list of trusted IPs to bypass MFA
   mitre_attack_id:
   - T1562.007
+  - T1562
   observable:
   - name: ip_addresses_new_added
     type: IP Address

detections/cloud/o365_new_federated_domain_added.yml

@@ -44,6 +44,7 @@ tags:
     $OrganizationName$
   mitre_attack_id:
   - T1136.003
+  - T1136
   observable:
   - name: OrganizationName
     type: Other

detections/cloud/o365_suspicious_admin_email_forwarding.yml

@@ -39,6 +39,7 @@ tags:
     the same destination $ForwardingAddress$
   mitre_attack_id:
   - T1114.003
+  - T1114
   nist:
   - DE.DP
   - DE.AE

detections/cloud/o365_suspicious_rights_delegation.yml

@@ -38,6 +38,7 @@ tags:
     that allow access to sensitive
   mitre_attack_id:
   - T1114.002
+  - T1114
   nist:
   - DE.DP
   - DE.AE

detections/cloud/o365_suspicious_user_email_forwarding.yml

@@ -39,6 +39,7 @@ tags:
     a forwarding rule to same destination $ForwardingSmtpAddress$
   mitre_attack_id:
   - T1114.003
+  - T1114
   nist:
   - DE.DP
   - DE.AE