Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Adding missing TI based relevant techniques to detections #10749

Merged
merged 3 commits into from
Jul 11, 2024
Merged

Adding missing TI based relevant techniques to detections #10749

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
812bf5e
Adding missing TI based relevant techniques to detections
gitj121 Jul 8, 2024
437327b
Updated with version
gitj121 Jul 9, 2024
854dbd5
Updatedtactic
gitj121 Jul 10, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions ...ions/GreyNoiseThreatIntelligence/Analytic Rules/GreyNoise_IPEntity_CustomSecurityLog.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,9 @@ queryPeriod: 14d
triggerOperator: gt
triggerThreshold: 0
tactics:
- Impact
- CommandAndControl
relevantTechniques:
- T1071
query: |
let IPRegex = '[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}';
let dt_lookBack = 1h; // Look back 1 hour for CommonSecurityLog events
Expand Down Expand Up @@ -60,5 +62,5 @@ entityMappings:
fieldMappings:
- identifier: Address
columnName: CS_ipEntity
version: 1.0.1
version: 1.0.2
kind: Scheduled
6 changes: 4 additions & 2 deletions Solutions/GreyNoiseThreatIntelligence/Analytic Rules/GreyNoise_IPEntity_DnsEvents.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
id: ddf47b6f-870c-5712-a296-1383acb13c82
name: GreyNoise TI Map IP Entity to DnsEvents
version: 1.0.1
version: 1.0.2
kind: Scheduled
description: |
This query maps any IP indicators of compromise (IOCs) from GreyNoise Threat Intelligence (TI), by searching for matches in DnsEvents.
Expand All @@ -26,7 +26,9 @@ queryPeriod: 14d
triggerOperator: gt
triggerThreshold: 0
tactics:
- Impact
- CommandAndControl
relevantTechniques:
- T1071
query: |
let dt_lookBack = 1h; // Look back 1 hour for DNS events
let ioc_lookBack = 14d; // Look back 14 days for threat intelligence indicators
Expand Down
6 changes: 4 additions & 2 deletions Solutions/GreyNoiseThreatIntelligence/Analytic Rules/GreyNoise_IPEntity_OfficeActivity.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
id: c51628fe-999c-5150-9fd7-660fc4f58ed2
name: GreyNoise TI map IP entity to OfficeActivity
version: 1.0.0
version: 1.0.1
kind: Scheduled
description: |
This query maps any GreyNoise IP indicators of compromise (IOCs) from threat intelligence (TI), by searching for matches in OfficeActivity.
Expand All @@ -26,7 +26,9 @@ queryPeriod: 14d
triggerOperator: gt
triggerThreshold: 0
tactics:
- Impact
- CommandAndControl
relevantTechniques:
- T1071
query: |
let dt_lookBack = 1h; // Look back 1 hour for OfficeActivity events
let ioc_lookBack = 14d; // Look back 14 days for threat intelligence indicators
Expand Down
6 changes: 4 additions & 2 deletions Solutions/GreyNoiseThreatIntelligence/Analytic Rules/GreyNoise_IPEntity_SigninLogs.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
id: f6c76cc9-218c-5b76-9b82-8607f09ea1b4
name: GreyNoise TI Map IP Entity to SigninLogs
version: 1.0.0
version: 1.0.1
kind: Scheduled
description: |
'This query maps any GreyNoise IP indicators of compromise (IOCs) from threat intelligence (TI), by searching for matches in SigninLogs.'
Expand Down Expand Up @@ -29,7 +29,9 @@ queryPeriod: 14d
triggerOperator: gt
triggerThreshold: 0
tactics:
- Impact
- CommandAndControl
relevantTechniques:
- T1071
query: |
let dt_lookBack = 1h;
let ioc_lookBack = 14d;
Expand Down
6 changes: 4 additions & 2 deletions ...tions/GreyNoiseThreatIntelligence/Analytic Rules/GreyNoise_IPEntity_imNetworkSession.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
id: 536e8e5c-ce0e-575e-bcc9-aba8e7bf9316
name: GreyNoise TI map IP entity to Network Session Events (ASIM Network Session schema)
version: 1.0.2
version: 1.0.3
kind: Scheduled
description: |
'This rule identifies a match Network Sessions for which the source or destination IP address is a known GreyNoise IoC.
Expand Down Expand Up @@ -75,7 +75,9 @@ queryPeriod: 14d
triggerOperator: gt
triggerThreshold: 0
tactics:
- Impact
- CommandAndControl
relevantTechniques:
- T1071
query: |
let dt_lookBack = 1h;
let ioc_lookBack = 14d;
Expand Down
6 changes: 4 additions & 2 deletions Solutions/Threat Intelligence/Analytic Rules/DomainEntity_CloudAppEvents.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,9 @@ queryPeriod: 14d
triggerOperator: gt
triggerThreshold: 0
tactics:
- Impact
- CommandAndControl
relevantTechniques:
- T1071
query: |
let dt_lookBack = 1h;
let ioc_lookBack = 14d;
Expand Down Expand Up @@ -60,5 +62,5 @@ entityMappings:
fieldMappings:
- identifier: Address
columnName: IPAddress
version: 1.0.1
version: 1.0.2
kind: Scheduled
6 changes: 4 additions & 2 deletions Solutions/Threat Intelligence/Analytic Rules/DomainEntity_CommonSecurityLog.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,9 @@ queryPeriod: 14d
triggerOperator: gt
triggerThreshold: 0
tactics:
- Impact
- CommandAndControl
relevantTechniques:
- T1071
query: |
let dt_lookBack = 1h; // Look back 1 hour
let ioc_lookBack = 14d; // Look back 14 days
Expand Down Expand Up @@ -69,5 +71,5 @@ entityMappings:
fieldMappings:
- identifier: Url
columnName: PA_Url
version: 1.4.1
version: 1.4.2
kind: Scheduled
6 changes: 4 additions & 2 deletions Solutions/Threat Intelligence/Analytic Rules/DomainEntity_DeviceNetworkEvents.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,9 @@ queryPeriod: 14d
triggerOperator: gt
triggerThreshold: 0
tactics:
- Impact
- CommandAndControl
relevantTechniques:
- T1071
query: |
let dt_lookBack = 1h;
let ioc_lookBack = 14d;
Expand Down Expand Up @@ -68,5 +70,5 @@ entityMappings:
fieldMappings:
- identifier: CommandLine
columnName: InitiatingProcessCommandLine
version: 1.0.0
version: 1.0.1
kind: Scheduled
6 changes: 4 additions & 2 deletions Solutions/Threat Intelligence/Analytic Rules/DomainEntity_DnsEvents.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,9 @@ queryPeriod: 14d
triggerOperator: gt
triggerThreshold: 0
tactics:
- Impact
- CommandAndControl
relevantTechniques:
- T1071
query: |
// Define the lookback periods for time-based filters
let dt_lookBack = 1h; // Look back 1 hour for DNS events
Expand Down Expand Up @@ -83,5 +85,5 @@ entityMappings:
fieldMappings:
- identifier: Url
columnName: Url
version: 1.4.2
version: 1.4.3
kind: Scheduled
6 changes: 4 additions & 2 deletions Solutions/Threat Intelligence/Analytic Rules/DomainEntity_EmailEvents.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,9 @@ queryPeriod: 14d
triggerOperator: gt
triggerThreshold: 0
tactics:
- Impact
- InitialAccess
relevantTechniques:
- T1566
query: |
let dt_lookBack = 1h;
let ioc_lookBack = 14d;
Expand Down Expand Up @@ -53,5 +55,5 @@ entityMappings:
columnName: Name
- identifier: UPNSuffix
columnName: UPNSuffix
version: 1.0.1
version: 1.0.2
kind: Scheduled
6 changes: 4 additions & 2 deletions Solutions/Threat Intelligence/Analytic Rules/DomainEntity_EmailUrlInfo.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,9 @@ queryPeriod: 14d
triggerOperator: gt
triggerThreshold: 0
tactics:
- Impact
- InitialAccess
relevantTechniques:
- T1566
query: |
let dt_lookBack = 1h;
let ioc_lookBack = 14d;
Expand Down Expand Up @@ -74,5 +76,5 @@ entityMappings:
fieldMappings:
- identifier: Url
columnName: Url
version: 1.0.1
version: 1.0.2
kind: Scheduled
6 changes: 4 additions & 2 deletions Solutions/Threat Intelligence/Analytic Rules/DomainEntity_PaloAlto.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,9 @@ queryPeriod: 14d
triggerOperator: gt
triggerThreshold: 0
tactics:
- Impact
- CommandAndControl
relevantTechniques:
- T1071
query: |
let dt_lookBack = 1h; // Duration to look back for recent logs (1 hour)
let ioc_lookBack = 14d; // Duration to look back for recent threat intelligence indicators (14 days)
Expand Down Expand Up @@ -90,5 +92,5 @@ entityMappings:
fieldMappings:
- identifier: Url
columnName: PA_Url
version: 1.4.1
version: 1.4.2
kind: Scheduled
6 changes: 4 additions & 2 deletions Solutions/Threat Intelligence/Analytic Rules/DomainEntity_SecurityAlert.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,9 @@ queryPeriod: 14d
triggerOperator: gt
triggerThreshold: 0
tactics:
- Impact
- CommandAndControl
relevantTechniques:
- T1071
query: |
let dt_lookBack = 1h;
let ioc_lookBack = 14d;
Expand Down Expand Up @@ -73,5 +75,5 @@ entityMappings:
fieldMappings:
- identifier: Url
columnName: Url
version: 1.4.2
version: 1.4.3
kind: Scheduled
6 changes: 4 additions & 2 deletions Solutions/Threat Intelligence/Analytic Rules/DomainEntity_Syslog.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,9 @@ queryPeriod: 14d
triggerOperator: gt
triggerThreshold: 0
tactics:
- Impact
- CommandAndControl
relevantTechniques:
- T1071
query: |
let dt_lookBack = 1h; // Define the time range to look back for syslog data (1 hour)
let ioc_lookBack = 14d; // Define the time range to look back for threat intelligence indicators (14 days)
Expand Down Expand Up @@ -85,5 +87,5 @@ entityMappings:
fieldMappings:
- identifier: Url
columnName: Url
version: 1.4.2
version: 1.4.3
kind: Scheduled
6 changes: 4 additions & 2 deletions Solutions/Threat Intelligence/Analytic Rules/DomainEntity_imWebSession.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,9 @@ queryPeriod: 14d
triggerOperator: gt
triggerThreshold: 0
tactics:
- Impact
- CommandAndControl
relevantTechniques:
- T1071
query: |
let HAS_ANY_MAX = 10000;
let dt_lookBack = 1h;
Expand Down Expand Up @@ -71,5 +73,5 @@ customDetails:
alertDetailsOverride:
alertDisplayNameFormat: A web request from {{SrcIpAddr}} to hostname {{domain}} matched an IoC
alertDescriptionFormat: A client with address {{SrcIpAddr}} requested the URL {{Url}}, whose hostname is a known indicator of compromise of {{ThreatType}}. Consult the threat intelligence blade for more information on the indicator.
version: 1.0.5
version: 1.0.6
kind: Scheduled
6 changes: 4 additions & 2 deletions Solutions/Threat Intelligence/Analytic Rules/EmailEntity_AzureActivity.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,9 @@ queryPeriod: 14d
triggerOperator: gt
triggerThreshold: 0
tactics:
- Impact
- InitialAccess
relevantTechniques:
- T1566
query: |
let dt_lookBack = 1h;
let ioc_lookBack = 14d;
Expand Down Expand Up @@ -64,5 +66,5 @@ entityMappings:
fieldMappings:
- identifier: Url
columnName: Url
version: 1.2.6
version: 1.2.7
kind: Scheduled
6 changes: 4 additions & 2 deletions Solutions/Threat Intelligence/Analytic Rules/EmailEntity_CloudAppEvents.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,9 @@ queryPeriod: 14d
triggerOperator: gt
triggerThreshold: 0
tactics:
- Impact
- InitialAccess
relevantTechniques:
- T1566
query: |
let dt_lookBack = 10d;
let ioc_lookBack = 30d;
Expand Down Expand Up @@ -45,5 +47,5 @@ entityMappings:
columnName: User_Id
- identifier: UPNSuffix
columnName: UPNSuffix
version: 1.0.1
version: 1.0.2
kind: Scheduled
6 changes: 4 additions & 2 deletions Solutions/Threat Intelligence/Analytic Rules/EmailEntity_EmailEvents.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,9 @@ queryPeriod: 14d
triggerOperator: gt
triggerThreshold: 0
tactics:
- Impact
- InitialAccess
relevantTechniques:
- T1566
query: |
let dt_lookBack = 1h;
let ioc_lookBack = 14d;
Expand Down Expand Up @@ -52,5 +54,5 @@ entityMappings:
columnName: Name
- identifier: UPNSuffix
columnName: UPNSuffix
version: 1.0.1
version: 1.0.2
kind: Scheduled
6 changes: 4 additions & 2 deletions Solutions/Threat Intelligence/Analytic Rules/EmailEntity_OfficeActivity.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,9 @@ queryPeriod: 14d
triggerOperator: gt
triggerThreshold: 0
tactics:
- Impact
- InitialAccess
relevantTechniques:
- T1566
query: |
let dt_lookBack = 1h;
let ioc_lookBack = 14d;
Expand Down Expand Up @@ -64,5 +66,5 @@ entityMappings:
fieldMappings:
- identifier: Url
columnName: Url
version: 1.2.6
version: 1.2.7
kind: Scheduled
6 changes: 4 additions & 2 deletions Solutions/Threat Intelligence/Analytic Rules/EmailEntity_PaloAlto.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,9 @@ queryPeriod: 14d
triggerOperator: gt
triggerThreshold: 0
tactics:
- Impact
- InitialAccess
relevantTechniques:
- T1566
query: |
let dt_lookBack = 1h;
let ioc_lookBack = 14d;
Expand Down Expand Up @@ -61,5 +63,5 @@ entityMappings:
fieldMappings:
- identifier: Url
columnName: Url
version: 1.2.5
version: 1.2.6
kind: Scheduled
6 changes: 4 additions & 2 deletions Solutions/Threat Intelligence/Analytic Rules/EmailEntity_SecurityAlert.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,9 @@ queryPeriod: 14d
triggerOperator: gt
triggerThreshold: 0
tactics:
- Impact
- InitialAccess
relevantTechniques:
- T1566
query: |
let dt_lookBack = 1h;
let ioc_lookBack = 14d;
Expand Down Expand Up @@ -69,5 +71,5 @@ entityMappings:
fieldMappings:
- identifier: Url
columnName: Url
version: 1.2.7
version: 1.2.8
kind: Scheduled
Loading
Loading