From e105700d5876bca2d9a0f20214bfbe798c526e5d Mon Sep 17 00:00:00 2001 From: Yugoslavskiy Daniil Date: Wed, 4 Nov 2020 12:13:27 +0100 Subject: [PATCH] cleanup --- .../Customers/CU_0001_TESTCUSTOMER.md | 8 - .../Customers/CU_0002_TESTCUSTOMER2.md | 8 - .../DN0001_4688_windows_process_creation.md | 58 -- ...ndows_process_creation_with_commandline.md | 59 -- ...N0003_1_windows_sysmon_process_creation.md | 66 -- .../DN0004_4624_windows_account_logon.md | 71 -- .../DN0005_7045_windows_service_insatalled.md | 49 - ...on_process_changed_a_file_creation_time.md | 52 - ...007_3_windows_sysmon_network_connection.md | 62 -- ...ows_sysmon_sysmon_service_state_changed.md | 48 - ...009_5_windows_sysmon_process_terminated.md | 49 - .../DN0010_6_windows_sysmon_driver_loaded.md | 51 - .../DN0011_7_windows_sysmon_image_loaded.md | 59 -- ...012_8_windows_sysmon_CreateRemoteThread.md | 55 - .../DN0013_9_windows_sysmon_RawAccessRead.md | 49 - .../DN0014_10_windows_sysmon_ProcessAccess.md | 55 - .../DN0015_11_windows_sysmon_FileCreate.md | 51 - .../DN0016_12_windows_sysmon_RegistryEvent.md | 51 - .../DN0017_13_windows_sysmon_RegistryEvent.md | 52 - .../DN0018_14_windows_sysmon_RegistryEvent.md | 52 - ..._15_windows_sysmon_FileCreateStreamHash.md | 52 - .../DN0020_17_windows_sysmon_PipeEvent.md | 51 - .../DN0021_18_windows_sysmon_PipeEvent.md | 51 - .../DN0022_19_windows_sysmon_WmiEvent.md | 52 - .../DN0023_20_windows_sysmon_WmiEvent.md | 52 - .../DN0024_21_windows_sysmon_WmiEvent.md | 51 - ...s_directory_service_object_was_modified.md | 59 -- .../DN0027_4738_user_account_was_changed.md | 70 -- ...ervices_restore_mode_admin_password_set.md | 50 - ..._4661_handle_to_an_object_was_requested.md | 60 -- ...62_operation_was_performed_on_an_object.md | 58 -- .../DN0031_7036_service_started_stopped.md | 47 - ...work_share_object_was_accessed_detailed.md | 57 -- ..._5140_network_share_object_was_accessed.md | 55 - .../DN0034_104_log_file_was_cleared.md | 50 - ...0035_106_task_scheduler_task_registered.md | 46 - ...36_4104_windows_powershell_script_block.md | 49 - ...3_windows_powershell_executing_pipeline.md | 47 - ...state_is_changed_from_none_to_available.md | 42 - ...039_524_system_catalog_has_been_deleted.md | 43 - ...er_successfully_logged_on_to_a_computer.md | 40 - .../Data_Needed/DN0041_529_logon_failure.md | 39 - ...2_675_kerberos_preauthentication_failed.md | 31 - ...0_dns_server_plugin_dll_has_been_loaded.md | 46 - .../DN0044_1000_application_crashed.md | 55 - .../DN0045_1001_windows_error_reporting.md | 62 -- ...allout_dll_file_has_caused_an_exception.md | 45 - ...allout_dll_file_has_caused_an_exception.md | 45 - ...ervice_successfully_loaded_callout_dlls.md | 46 - ...hcp_service_failed_to_load_callout_dlls.md | 45 - .../DN0050_1102_audit_log_was_cleared.md | 50 - ...k_surface_reduction_blocking_mode_event.md | 55 - .../DN0052_2003_query_to_load_usb_drivers.md | 46 - ...0_pnp_or_power_operation_for_usb_device.md | 53 - ...2_pnp_or_power_operation_for_usb_device.md | 53 - .../Data_Needed/DN0054_linux_auditd_execve.md | 24 - ...DN0055_linux_auditd_read_access_to_file.md | 25 - .../DN0056_linux_auditd_syscall.md | 25 - .../DN0057_4625_account_failed_to_logon.md | 65 -- ..._4656_handle_to_an_object_was_requested.md | 61 -- ...DN0059_4657_registry_value_was_modified.md | 58 -- ...060_4658_handle_to_an_object_was_closed.md | 52 - .../DN0061_4660_object_was_deleted.md | 53 - ...63_attempt_was_made_to_access_an_object.md | 57 -- ...697_service_was_installed_in_the_system.md | 53 - .../DN0064_4698_scheduled_task_was_created.md | 50 - ...DN0065_4701_scheduled_task_was_disabled.md | 50 - .../DN0066_4704_user_right_was_assigned.md | 50 - ...67_4719_system_audit_policy_was_changed.md | 52 - ..._added_to_security_enabled_global_group.md | 54 - ...s_added_to_security_enabled_local_group.md | 54 - ...ecurity_enabled_local_group_was_changed.md | 54 - ...curity_enabled_global_group_was_changed.md | 54 - ...ity_enabled_universal_group_was_changed.md | 54 - ...d_to_a_security_enabled_universal_group.md | 54 - ...765_sid_history_was_added_to_an_account.md | 40 - ...to_add_sid_history_to_an_account_failed.md | 38 - ...ros_authentication_ticket_was_requested.md | 58 -- ...9_kerberos_service_ticket_was_requested.md | 55 - ...4771_kerberos_pre_authentication_failed.md | 55 - ...validate_the_credentials_for_an_account.md | 48 - .../Data_Needed/DN0080_5859_wmi_activity.md | 53 - .../Data_Needed/DN0081_5861_wmi_activity.md | 50 - .../DN0082_8002_ntlm_server_blocked_audit.md | 49 - ...3_16_access_history_in_hive_was_cleared.md | 48 - .../Data_Needed/DN0084_av_alert.md | 59 -- .../DN0085_22_windows_sysmon_DnsQuery.md | 52 - .../DN0086_4720_user_account_was_created.md | 69 -- ...ering_platform_has_permitted_connection.md | 57 -- .../DN0088_4616_system_time_was_changed.md | 52 - ...server_security_layer_detected_an_error.md | 42 - ...server_security_layer_detected_an_error.md | 42 - .../DN0091_linux_modsecurity_log.md | 25 - .../Data_Needed/DN0092_unix_generic_syslog.md | 25 - .../Data_Needed/DN0093_linux_clamav_log.md | 25 - .../Data_Needed/DN0094_linux_sshd_log.md | 25 - .../Data_Needed/DN0095_linux_auth_pam_log.md | 25 - .../DN0096_linux_named_client_security_log.md | 25 - .../Data_Needed/DN0097_linux_daemon_log.md | 25 - .../Data_Needed/DN0098_linux_vsftpd_log.md | 25 - .../Data_Needed/DN0099_Bind_DNS_query.md | 25 - .../Data_Needed/DN0100_Passive_DNS_log.md | 25 - ...N0108_150_dns_server_could_not_load_dll.md | 25 - .../Detection_Rules/av_exploiting.md | 187 ---- .../Detection_Rules/av_password_dumper.md | 188 ---- .../Detection_Rules/av_relevant_files.md | 193 ---- .../Detection_Rules/av_webshell.md | 183 ---- .../Detection_Rules/mal_azorult_reg.md | 180 ---- .../powershell_alternate_powershell_hosts.md | 185 ---- .../powershell_clear_powershell_history.md | 177 ---- .../powershell_create_local_user.md | 180 ---- .../powershell_data_compressed.md | 180 ---- .../powershell_dnscat_execution.md | 171 ---- .../powershell_downgrade_attack.md | 181 ---- .../powershell_exe_calling_ps.md | 182 ---- ...shell_invoke_obfuscation_obfuscated_iex.md | 192 ---- .../powershell_malicious_commandlets.md | 273 ----- .../powershell_malicious_keywords.md | 196 ---- ...owershell_nishang_malicious_commandlets.md | 248 ----- .../powershell_ntfs_ads_access.md | 178 ---- .../powershell_prompt_credentials.md | 181 ---- .../Detection_Rules/powershell_psattack.md | 177 ---- .../powershell_remote_powershell_session.md | 179 ---- .../powershell_shellcode_b64.md | 184 ---- .../powershell_suspicious_download.md | 179 ---- ...owershell_suspicious_invocation_generic.md | 181 ---- ...wershell_suspicious_invocation_specific.md | 178 ---- .../powershell_suspicious_keywords.md | 184 ---- .../powershell_suspicious_profile_create.md | 181 ---- .../powershell_winlogon_helper_dll.md | 181 ---- .../Detection_Rules/powershell_wmimplant.md | 194 ---- .../powershell_xor_commandline.md | 178 ---- .../Detection_Rules/sysmon_ads_executable.md | 183 ---- .../sysmon_alternate_powershell_hosts_pipe.md | 185 ---- .../sysmon_apt_muddywater_dnstunnel.md | 180 ---- .../sysmon_apt_turla_namedpipes.md | 181 ---- .../Detection_Rules/sysmon_cactustorch.md | 183 ---- .../Detection_Rules/sysmon_cmstp_execution.md | 288 ------ .../sysmon_cobaltstrike_process_injection.md | 179 ---- .../sysmon_createremotethread_loadlibrary.md | 175 ---- .../sysmon_cred_dump_tools_named_pipes.md | 182 ---- .../Detection_Rules/sysmon_hack_wce.md | 178 ---- ...gon_scripts_userinitmprlogonscript_proc.md | 185 ---- .../Detection_Rules/sysmon_mal_namedpipes.md | 194 ---- .../sysmon_password_dumper_lsass.md | 178 ---- .../sysmon_possible_dns_rebinding.md | 223 ----- ...aw_disk_access_using_illegitimate_tools.md | 195 ---- .../sysmon_susp_powershell_rundll32.md | 182 ---- .../sysmon_suspicious_remote_thread.md | 234 ----- .../sysmon_wmi_event_subscription.md | 177 ---- .../sysmon_wmi_susp_scripting.md | 189 ---- .../Detection_Rules/win_GPO_scheduledtasks.md | 180 ---- .../win_account_backdoor_dcsync_rights.md | 179 ---- .../Detection_Rules/win_account_discovery.md | 187 ---- .../win_ad_object_writedac_access.md | 177 ---- .../win_ad_replication_non_machine_account.md | 185 ---- .../win_ad_user_enumeration.md | 180 ---- .../Detection_Rules/win_admin_rdp_login.md | 178 ---- .../Detection_Rules/win_admin_share_access.md | 176 ---- .../win_advanced_ip_scanner.md | 173 ---- ...win_alert_active_directory_user_control.md | 175 ---- .../win_alert_ad_user_backdoors.md | 191 ---- .../win_alert_enable_weak_encryption.md | 183 ---- .../Detection_Rules/win_alert_lsass_access.md | 177 ---- .../win_alert_mimikatz_keywords.md | 196 ---- .../Detection_Rules/win_alert_ruler.md | 193 ---- .../win_apt_apt29_thinktanks.md | 175 ---- .../Detection_Rules/win_apt_apt29_tor.md | 195 ---- .../Detection_Rules/win_apt_babyshark.md | 191 ---- .../win_apt_bear_activity_gtr19.md | 179 ---- .../Detection_Rules/win_apt_bluemashroom.md | 176 ---- .../win_apt_carbonpaper_turla.md | 179 ---- .../Detection_Rules/win_apt_chafer_mar18.md | 483 --------- .../Detection_Rules/win_apt_cloudhopper.md | 179 ---- .../Detection_Rules/win_apt_dragonfly.md | 171 ---- .../Detection_Rules/win_apt_elise.md | 177 ---- .../win_apt_emissarypanda_sep19.md | 168 ---- .../Detection_Rules/win_apt_empiremonkey.md | 182 ---- .../win_apt_equationgroup_dll_u_load.md | 184 ---- .../Detection_Rules/win_apt_gallium.md | 385 ------- .../Detection_Rules/win_apt_greenbug_may20.md | 197 ---- .../win_apt_hurricane_panda.md | 176 ---- .../win_apt_judgement_panda_gtr19.md | 191 ---- .../win_apt_ke3chang_regadd.md | 183 ---- .../win_apt_lazarus_session_highjack.md | 180 ---- .../Detection_Rules/win_apt_mustangpanda.md | 179 ---- .../Detection_Rules/win_apt_slingshot.md | 268 ----- .../Detection_Rules/win_apt_sofacy.md | 186 ---- .../Detection_Rules/win_apt_stonedrill.md | 177 ---- .../Detection_Rules/win_apt_ta17_293a_ps.md | 174 ---- .../Detection_Rules/win_apt_tropictrooper.md | 172 ---- .../Detection_Rules/win_apt_turla_commands.md | 287 ------ .../win_apt_turla_comrat_may20.md | 191 ---- .../win_apt_turla_service_png.md | 176 ---- .../win_apt_unidentified_nov_18.md | 265 ----- .../win_apt_winnti_mal_hk_jan20.md | 190 ---- .../Detection_Rules/win_apt_wocao.md | 266 ----- .../Detection_Rules/win_apt_zxshell.md | 184 ---- .../Detection_Rules/win_atsvc_task.md | 183 ---- .../win_attrib_hiding_files.md | 186 ---- .../Detection_Rules/win_audit_cve.md | 171 ---- .../Detection_Rules/win_av_relevant_match.md | 187 ---- .../Detection_Rules/win_bootconf_mod.md | 187 ---- .../Detection_Rules/win_bypass_squiblytwo.md | 187 ---- .../win_change_default_file_association.md | 186 ---- .../Detection_Rules/win_cmdkey_recon.md | 180 ---- .../win_cmstp_com_object_access.md | 196 ---- .../win_commandline_path_traversal.md | 175 ---- .../Detection_Rules/win_control_panel_item.md | 187 ---- ...ng_sensitive_files_with_credential_data.md | 196 ---- .../Detection_Rules/win_crime_fireball.md | 182 ---- .../win_crime_maze_ransomware.md | 191 ---- .../win_data_compressed_with_rar.md | 185 ---- .../Detection_Rules/win_dcsync.md | 188 ---- .../Detection_Rules/win_defender_bypass.md | 179 ---- .../Detection_Rules/win_defender_disabled.md | 178 ---- .../Detection_Rules/win_defender_threat.md | 170 ---- .../win_disable_event_logging.md | 175 ---- .../win_dns_exfiltration_tools_execution.md | 171 ---- .../win_dpapi_domain_backupkey_extraction.md | 177 ---- ...n_dpapi_domain_masterkey_backup_attempt.md | 178 ---- .../win_dsquery_domain_trust_discovery.md | 178 ---- .../win_encoded_frombase64string.md | 179 ---- .../Detection_Rules/win_encoded_iex.md | 181 ---- .../Detection_Rules/win_etw_modification.md | 182 ---- .../win_etw_modification_cmdline.md | 177 ---- .../Detection_Rules/win_etw_trace_evasion.md | 184 ---- ...iltration_and_tunneling_tools_execution.md | 174 ---- .../win_exploit_cve_2015_1641.md | 174 ---- .../win_exploit_cve_2017_0261.md | 175 ---- .../win_exploit_cve_2017_11882.md | 175 ---- .../win_exploit_cve_2017_8759.md | 173 ---- .../win_exploit_cve_2019_1378.md | 182 ---- .../win_exploit_cve_2019_1388.md | 179 ---- .../win_exploit_cve_2020_10189.md | 179 ---- .../win_exploit_cve_2020_1048.md | 182 ---- .../Detection_Rules/win_external_device.md | 178 ---- .../win_file_permission_modifications.md | 183 ---- .../win_global_catalog_enumeration.md | 188 ---- .../win_grabbing_sensitive_hives_via_reg.md | 190 ---- .../Detection_Rules/win_hack_bloodhound.md | 190 ---- .../Detection_Rules/win_hack_koadic.md | 180 ---- .../Detection_Rules/win_hack_rubeus.md | 186 ---- .../Detection_Rules/win_hack_secutyxploded.md | 178 ---- .../Detection_Rules/win_hack_smbexec.md | 185 ---- .../Detection_Rules/win_hh_chm.md | 183 ---- .../win_hktl_createminidump.md | 268 ----- .../Detection_Rules/win_html_help_spawn.md | 188 ---- .../Detection_Rules/win_hwp_exploits.md | 189 ---- .../win_impacket_lateralization.md | 212 ---- .../win_impacket_secretdump.md | 180 ---- .../Detection_Rules/win_indirect_cmd.md | 182 ---- .../win_install_reg_debugger_backdoor.md | 184 ---- .../Detection_Rules/win_interactive_at.md | 181 ---- ..._obfuscation_obfuscated_iex_commandline.md | 180 ---- ...oke_obfuscation_obfuscated_iex_services.md | 353 ------- .../Detection_Rules/win_lethalhta.md | 177 ---- .../Detection_Rules/win_lm_namedpipe.md | 196 ---- ...in_local_system_owner_account_discovery.md | 216 ---- .../win_lsass_access_non_system_account.md | 186 ---- .../Detection_Rules/win_lsass_dump.md | 189 ---- .../Detection_Rules/win_mal_adwind.md | 362 ------- .../win_mal_blue_mockingbird.md | 361 ------- .../Detection_Rules/win_mal_creddumper.md | 379 ------- .../Detection_Rules/win_mal_flowcloud.md | 179 ---- .../win_mal_octopus_scanner.md | 175 ---- .../Detection_Rules/win_mal_ryuk.md | 169 ---- .../win_mal_service_installs.md | 188 ---- .../Detection_Rules/win_mal_ursnif.md | 174 ---- .../Detection_Rules/win_mal_wceaux_dll.md | 180 ---- .../Detection_Rules/win_malware_dridex.md | 179 ---- .../Detection_Rules/win_malware_dtrack.md | 171 ---- .../Detection_Rules/win_malware_emotet.md | 181 ---- .../Detection_Rules/win_malware_formbook.md | 183 ---- .../Detection_Rules/win_malware_notpetya.md | 195 ---- .../Detection_Rules/win_malware_qbot.md | 173 ---- .../Detection_Rules/win_malware_ryuk.md | 171 ---- .../win_malware_script_dropper.md | 193 ---- .../win_malware_trickbot_recon_activity.md | 176 ---- .../Detection_Rules/win_malware_wannacry.md | 187 ---- .../Detection_Rules/win_mavinject_proc_inj.md | 174 ---- .../win_metasploit_authentication.md | 183 ---- ...ltstrike_getsystem_service_installation.md | 375 ------- ...or_cobaltstrike_getsystem_service_start.md | 198 ---- .../win_mimikatz_command_line.md | 196 ---- .../win_mmc20_lateral_movement.md | 178 ---- .../Detection_Rules/win_mmc_spawn_shell.md | 190 ---- .../Detection_Rules/win_mshta_javascript.md | 184 ---- .../Detection_Rules/win_mshta_spawn_shell.md | 196 ---- .../win_multiple_suspicious_cli.md | 223 ----- .../Detection_Rules/win_net_enum.md | 183 ---- .../Detection_Rules/win_net_ntlm_downgrade.md | 273 ----- .../Detection_Rules/win_net_user_add.md | 186 ---- .../win_netsh_allow_port_rdp.md | 184 ---- .../Detection_Rules/win_netsh_fw_add.md | 179 ---- .../win_netsh_fw_add_susp_image.md | 206 ---- .../win_netsh_packet_capture.md | 175 ---- .../Detection_Rules/win_netsh_port_fwd.md | 175 ---- .../win_netsh_port_fwd_3389.md | 175 ---- .../win_netsh_wifi_credential_harvesting.md | 173 ---- .../Detection_Rules/win_network_sniffing.md | 186 ---- ...r_renamed_user_account_with_dollar_sign.md | 178 ---- .../win_new_service_creation.md | 182 ---- .../win_non_interactive_powershell.md | 177 ---- .../win_not_allowed_rdp_access.md | 177 ---- .../Detection_Rules/win_office_shell.md | 212 ---- ...n_office_spawn_exe_from_users_directory.md | 192 ---- .../Detection_Rules/win_overpass_the_hash.md | 179 ---- .../Detection_Rules/win_pass_the_hash.md | 189 ---- .../Detection_Rules/win_pass_the_hash_2.md | 187 ---- .../Detection_Rules/win_pcap_drivers.md | 191 ---- .../win_plugx_susp_exe_locations.md | 247 ----- .../win_possible_applocker_bypass.md | 191 ---- .../Detection_Rules/win_possible_dc_shadow.md | 180 ---- .../win_powershell_amsi_bypass.md | 181 ---- .../win_powershell_audio_capture.md | 174 ---- .../win_powershell_b64_shellcode.md | 176 ---- .../Detection_Rules/win_powershell_bitsjob.md | 181 ---- .../win_powershell_dll_execution.md | 184 ---- .../win_powershell_downgrade_attack.md | 187 ---- .../win_powershell_download.md | 180 ---- .../win_powershell_frombase64string.md | 172 ---- ...wershell_suspicious_parameter_variation.md | 216 ---- .../win_powershell_web_request.md | 280 ------ .../win_powershell_xor_commandline.md | 179 ---- .../win_powersploit_empire_schtasks.md | 198 ---- .../Detection_Rules/win_proc_wrong_parent.md | 193 ---- ...win_process_creation_bitsadmin_download.md | 187 ---- .../win_process_dump_rundll32_comsvcs.md | 182 ---- .../win_protected_storage_service_access.md | 174 ---- .../Detection_Rules/win_psexesvc_start.md | 174 ---- ...arkspwdump_clearing_hive_access_history.md | 175 ---- .../Detection_Rules/win_query_registry.md | 197 ---- .../win_rare_schtask_creation.md | 188 ---- .../win_rare_schtasks_creations.md | 194 ---- .../win_rare_service_installs.md | 191 ---- .../win_rdp_bluekeep_poc_scanner.md | 175 ---- .../win_rdp_hijack_shadowing.md | 169 ---- .../win_rdp_localhost_login.md | 181 ---- .../win_rdp_potential_cve-2019-0708.md | 182 ---- .../Detection_Rules/win_rdp_reverse_tunnel.md | 193 ---- .../win_redmimicry_winnti_proc.md | 179 ---- ...in_register_new_logon_process_by_rubeus.md | 177 ---- .../win_remote_powershell_session.md | 178 ---- .../win_remote_powershell_session_process.md | 180 ---- ...e_registry_management_using_reg_utility.md | 182 ---- .../win_remote_time_discovery.md | 181 ---- .../Detection_Rules/win_renamed_binary.md | 217 ---- .../win_renamed_binary_highly_relevant.md | 202 ---- .../Detection_Rules/win_renamed_jusched.md | 177 ---- .../Detection_Rules/win_renamed_paexec.md | 186 ---- .../Detection_Rules/win_renamed_powershell.md | 175 ---- .../Detection_Rules/win_renamed_procdump.md | 177 ---- .../Detection_Rules/win_renamed_psexec.md | 176 ---- .../win_run_powershell_script_from_ads.md | 178 ---- .../win_sam_registry_hive_handle_request.md | 181 ---- .../win_scm_database_handle_failure.md | 170 ---- .../win_scm_database_privileged_operation.md | 170 ---- .../win_sdbinst_shim_persistence.md | 177 ---- .../Detection_Rules/win_service_execution.md | 178 ---- .../Detection_Rules/win_service_stop.md | 179 ---- .../win_shadow_copies_access_symlink.md | 178 ---- .../win_shadow_copies_creation.md | 183 ---- .../win_shadow_copies_deletion.md | 191 ---- .../win_shell_spawn_susp_program.md | 198 ---- .../win_silenttrinity_stage_use.md | 260 ----- .../win_soundrec_audio_capture.md | 175 ---- .../Detection_Rules/win_spn_enum.md | 178 ---- .../win_susp_add_domain_trust.md | 168 ---- .../win_susp_add_sid_history.md | 186 ---- .../Detection_Rules/win_susp_backup_delete.md | 176 ---- .../Detection_Rules/win_susp_bcdedit.md | 182 ---- .../Detection_Rules/win_susp_bginfo.md | 179 ---- .../Detection_Rules/win_susp_calc.md | 176 ---- .../Detection_Rules/win_susp_cdb.md | 177 ---- .../win_susp_certutil_command.md | 203 ---- .../win_susp_certutil_encode.md | 171 ---- .../Detection_Rules/win_susp_cli_escape.md | 180 ---- .../win_susp_cmd_http_appdata.md | 182 ---- .../win_susp_codeintegrity_check_failure.md | 174 ---- .../win_susp_codepage_switch.md | 175 ---- .../win_susp_commands_recon_activity.md | 211 ---- .../win_susp_compression_params.md | 188 ---- .../win_susp_comsvcs_procdump.md | 184 ---- .../win_susp_control_dll_load.md | 186 ---- .../win_susp_copy_lateral_movement.md | 181 ---- .../Detection_Rules/win_susp_copy_system32.md | 176 ---- .../Detection_Rules/win_susp_covenant.md | 178 ---- .../win_susp_crackmapexec_execution.md | 194 ---- ...usp_crackmapexec_powershell_obfuscation.md | 192 ---- .../Detection_Rules/win_susp_csc.md | 176 ---- .../Detection_Rules/win_susp_csc_folder.md | 187 ---- .../Detection_Rules/win_susp_curl_download.md | 180 ---- .../win_susp_curl_fileupload.md | 177 ---- .../win_susp_curl_start_combo.md | 175 ---- .../win_susp_dctask64_proc_inject.md | 182 ---- .../win_susp_desktopimgdownldr.md | 185 ---- .../win_susp_devtoolslauncher.md | 177 ---- .../Detection_Rules/win_susp_dhcp_config.md | 177 ---- .../win_susp_dhcp_config_failed.md | 181 ---- ..._susp_direct_asep_reg_keys_modification.md | 192 ---- .../win_susp_disable_ie_features.md | 180 ---- .../Detection_Rules/win_susp_ditsnap.md | 177 ---- .../Detection_Rules/win_susp_dns_config.md | 180 ---- .../Detection_Rules/win_susp_dnx.md | 176 ---- .../win_susp_double_extension.md | 185 ---- .../win_susp_dsrm_password_change.md | 174 ---- .../Detection_Rules/win_susp_dxcap.md | 179 ---- .../win_susp_eventlog_clear.md | 193 ---- .../win_susp_eventlog_cleared.md | 177 ---- .../Detection_Rules/win_susp_exec_folder.md | 193 ---- .../win_susp_execution_path.md | 182 ---- .../win_susp_execution_path_webserver.md | 186 ---- .../win_susp_explorer_break_proctree.md | 173 ---- .../win_susp_failed_logon_reasons.md | 184 ---- .../win_susp_failed_logon_source.md | 205 ---- .../win_susp_failed_logons_single_source.md | 312 ------ .../win_susp_file_characteristics.md | 190 ---- .../Detection_Rules/win_susp_findstr_lnk.md | 177 ---- .../win_susp_firewall_disable.md | 173 ---- .../Detection_Rules/win_susp_fsutil_usage.md | 183 ---- .../Detection_Rules/win_susp_gup.md | 180 ---- .../win_susp_interactive_logons.md | 180 ---- .../win_susp_iss_module_install.md | 175 ---- .../win_susp_kerberos_manipulation.md | 204 ---- .../win_susp_ldap_dataexchange.md | 179 ---- .../win_susp_local_anon_logon_created.md | 173 ---- .../Detection_Rules/win_susp_lsass_dump.md | 176 ---- .../win_susp_lsass_dump_generic.md | 215 ---- .../win_susp_mshta_execution.md | 186 ---- .../Detection_Rules/win_susp_msiexec_cwd.md | 177 ---- .../win_susp_msiexec_web_install.md | 172 ---- .../Detection_Rules/win_susp_msmpeng_crash.md | 185 ---- .../Detection_Rules/win_susp_msoffice.md | 179 ---- .../Detection_Rules/win_susp_net_execution.md | 206 ---- .../win_susp_net_recon_activity.md | 185 ---- .../win_susp_netsh_dll_persistence.md | 183 ---- .../Detection_Rules/win_susp_ntdsutil.md | 174 ---- .../Detection_Rules/win_susp_ntlm_auth.md | 177 ---- .../Detection_Rules/win_susp_ntlm_rdp.md | 181 ---- .../Detection_Rules/win_susp_odbcconf.md | 182 ---- .../Detection_Rules/win_susp_openwith.md | 177 ---- .../Detection_Rules/win_susp_outlook.md | 178 ---- .../Detection_Rules/win_susp_outlook_temp.md | 175 ---- .../Detection_Rules/win_susp_ping_hex_ip.md | 178 ---- .../win_susp_powershell_empire_launch.md | 178 ---- .../win_susp_powershell_empire_uac_bypass.md | 184 ---- .../win_susp_powershell_enc_cmd.md | 194 ---- .../win_susp_powershell_hidden_b64_cmd.md | 225 ----- .../win_susp_powershell_parent_combo.md | 184 ---- .../win_susp_powershell_parent_process.md | 209 ---- .../Detection_Rules/win_susp_procdump.md | 189 ---- .../win_susp_process_creations.md | 224 ----- .../win_susp_prog_location_process_starts.md | 179 ---- .../Detection_Rules/win_susp_ps_appdata.md | 177 ---- .../win_susp_ps_downloadfile.md | 177 ---- .../Detection_Rules/win_susp_psexec.md | 183 ---- .../win_susp_psr_capture_screenshots.md | 175 ---- .../win_susp_raccess_sensitive_fext.md | 187 ---- .../Detection_Rules/win_susp_rar_flags.md | 174 ---- .../win_susp_rasdial_activity.md | 177 ---- .../Detection_Rules/win_susp_rc4_kerberos.md | 180 ---- .../win_susp_recon_activity.md | 179 ---- .../win_susp_regsvr32_anomalies.md | 201 ---- .../win_susp_renamed_dctask64.md | 180 ---- .../win_susp_renamed_debugview.md | 171 ---- .../Detection_Rules/win_susp_rottenpotato.md | 180 ---- .../Detection_Rules/win_susp_run_locations.md | 185 ---- .../win_susp_rundll32_activity.md | 191 ---- .../win_susp_rundll32_by_ordinal.md | 179 ---- .../Detection_Rules/win_susp_sam_dump.md | 175 ---- .../Detection_Rules/win_susp_samr_pwset.md | 179 ---- .../win_susp_schtask_creation.md | 187 ---- .../win_susp_script_execution.md | 182 ---- .../Detection_Rules/win_susp_sdelete.md | 188 ---- .../win_susp_security_eventlog_cleared.md | 176 ---- .../win_susp_service_path_modification.md | 185 ---- .../win_susp_squirrel_lolbin.md | 207 ---- .../Detection_Rules/win_susp_svchost.md | 182 ---- .../win_susp_svchost_no_cli.md | 179 ---- .../win_susp_sysprep_appdata.md | 174 ---- .../Detection_Rules/win_susp_sysvol_access.md | 174 ---- .../win_susp_taskmgr_localsystem.md | 171 ---- .../win_susp_taskmgr_parent.md | 179 ---- .../win_susp_time_modification.md | 184 ---- .../win_susp_tscon_localsystem.md | 174 ---- .../win_susp_tscon_rdp_redirect.md | 180 ---- .../win_susp_use_of_csharp_console.md | 174 ---- .../win_susp_userinit_child.md | 173 ---- .../Detection_Rules/win_susp_whoami.md | 178 ---- .../Detection_Rules/win_susp_wmi_execution.md | 186 ---- .../Detection_Rules/win_susp_wmi_login.md | 172 ---- ...suspicious_outbound_kerberos_connection.md | 182 ---- .../win_svcctl_remote_service.md | 175 ---- .../win_syskey_registry_access.md | 180 ---- .../win_sysmon_driver_unload.md | 173 ---- .../Detection_Rules/win_system_exe_anomaly.md | 208 ---- .../win_tap_driver_installation.md | 351 ------- .../win_tap_installer_execution.md | 170 ---- .../win_task_folder_evasion.md | 191 ---- .../win_termserv_proc_spawn.md | 173 ---- .../Detection_Rules/win_tool_psexec.md | 279 ------ ...with_credential_data_via_network_shares.md | 187 ---- .../Detection_Rules/win_trust_discovery.md | 177 ---- .../Detection_Rules/win_uac_cmstp.md | 189 ---- .../Detection_Rules/win_uac_fodhelper.md | 180 ---- .../Detection_Rules/win_uac_wsreset.md | 177 ---- .../Detection_Rules/win_usb_device_plugged.md | 176 ---- .../win_user_added_to_local_administrators.md | 177 ---- ...vileged_service_lsaregisterlogonprocess.md | 178 ---- .../Detection_Rules/win_user_creation.md | 178 ---- .../Detection_Rules/win_user_driver_loaded.md | 191 ---- ...o_change_sevice_image_path_by_non_admin.md | 183 ---- .../Detection_Rules/win_vul_cve_2020_0688.md | 176 ---- .../win_vul_java_remote_debugging.md | 175 ---- .../Detection_Rules/win_webshell_detection.md | 192 ---- .../Detection_Rules/win_webshell_spawn.md | 189 ---- .../Detection_Rules/win_whoami_as_system.md | 176 ---- .../win_win10_sched_task_0day.md | 179 ---- ...n_wmi_backdoor_exchange_transport_agent.md | 176 ---- .../Detection_Rules/win_wmi_persistence.md | 183 ---- ...n_wmi_persistence_script_event_consumer.md | 175 ---- .../win_wmi_spwns_powershell.md | 181 ---- .../win_wmiprvse_spawning_process.md | 176 ---- .../Detection_Rules/win_workflow_compiler.md | 177 ---- .../Detection_Rules/win_wsreset_uac_bypass.md | 181 ---- .../win_xsl_script_processing.md | 177 ---- .../EN0001_cache_sysmon_event_id_1_info.md | 36 - ...rich_sysmon_event_id_1_with_parent_info.md | 46 - ...ther_sysmon_events_with_event_id_1_data.md | 60 -- ...nt_id_11_with_TargetFilePathFingerprint.md | 32 - ...rprint_from_enriched_sysmon_event_id_11.md | 30 - ...1_windows_LocalAccountTokenFilterPolicy.md | 25 - .../LP0001_windows_audit_process_creation.md | 25 - ...audit_process_creation_with_commandline.md | 27 - .../LP0003_windows_sysmon_process_creation.md | 22 - .../LP0004_windows_audit_logon.md | 26 - ...P0005_windows_sysmon_network_connection.md | 18 - .../LP0006_windows_sysmon_image_loaded.md | 18 - .../LP0007_windows_sysmon_ProcessAccess.md | 28 - .../LP0008_windows_sysmon_FileCreate.md | 93 -- .../LP0009_windows_sysmon_PipeEvent.md | 21 - .../LP0010_windows_sysmon_WmiEvent.md | 24 - .../LP0011_windows_sysmon_DnsQuery.md | 22 - ...windows_audit_directory_service_changes.md | 26 - ...6_windows_audit_user_account_management.md | 26 - ..._windows_audit_directory_service_access.md | 26 - .../LP0028_windows_audit_sam.md | 26 - ...P0029_windows_audit_detailed_file_share.md | 26 - .../LP0030_windows_audit_file_share.md | 26 - .../LP0031_linux_auditd_execve.md | 38 - ...LP0032_linux_auditd_read_access_to_file.md | 32 - .../LP0033_linux_auditd_syscall.md | 35 - .../LP0034_linux_named_client_security_log.md | 35 - ...P0037_windows_audit_audit_policy_change.md | 32 - ...s_audit_kerberos_authentication_service.md | 31 - .../LP0039_windows_audit_kernel_object.md | 31 - ...indows_audit_other_object_access_events.md | 31 - ...P0042_windows_audit_handle_manipulation.md | 31 - .../LP0044_windows_ntlm_audit.md | 28 - ...ows_audit_filtering_platform_connection.md | 25 - ...046_windows_audit_security_state_change.md | 25 - .../LP0047_BIND_DNS_queries.md | 24 - .../LP0048_Passive_DNS_logging.md | 33 - ...windows_audit_security_system_extension.md | 26 - ...windows_audit_security_group_management.md | 26 - .../LP0102_windows_audit_file_system.md | 26 - .../LP0103_windows_audit_registry.md | 26 - .../LP0104_windows_audit_removable_storage.md | 26 - ...ndows_audit_authorization_policy_change.md | 26 - ...udit_kerberos_service_ticket_operations.md | 26 - ...107_windows_audit_credential_validation.md | 26 - ...P0108_windows_powershell_module_logging.md | 30 - ...109_windows_powershell_script_block_log.md | 28 - .../LP0110_windows_powershell_transcript.md | 32 - ...sr_block_credential_stealing_from_lsass.md | 26 - ...oft_defender_advanced_threat_protection.md | 20 - .../Response_Actions/RA_1001_practice.md | 13 - .../RA_1002_take_trainings.md | 22 - .../RA_1003_raise_personnel_awareness.md | 14 - ...ke_personnel_report_suspicious_activity.md | 13 - ...RA_1005_set_up_relevant_data_collection.md | 15 - ..._up_a_centralized_long-term_log_storage.md | 15 - .../RA_1007_develop_communication_map.md | 15 - .../RA_1008_make_sure_there_are_backups.md | 15 - .../RA_1009_get_network_architecture_map.md | 15 - .../RA_1010_get_access_control_matrix.md | 15 - .../RA_1011_develop_assets_knowledge_base.md | 15 - .../RA_1012_check_analysis_toolset.md | 15 - ...ss_vulnerability_management_system_logs.md | 15 - ...A_1014_connect_with_trusted_communities.md | 14 - ..._1101_access_external_network_flow_logs.md | 19 - ..._1102_access_internal_network_flow_logs.md | 15 - .../RA_1103_access_internal_http_logs.md | 15 - .../RA_1104_access_external_http_logs.md | 14 - .../RA_1105_access_internal_dns_logs.md | 15 - .../RA_1106_access_external_dns_logs.md | 20 - .../RA_1107_access_vpn_logs.md | 15 - .../RA_1108_access_dhcp_logs.md | 15 - ...109_access_internal_packet_capture_data.md | 15 - ...110_access_external_packet_capture_data.md | 15 - ...et_ability_to_block_external_ip_address.md | 18 - ...et_ability_to_block_internal_ip_address.md | 15 - ...13_get_ability_to_block_external_domain.md | 18 - ...14_get_ability_to_block_internal_domain.md | 15 - ..._1115_get_ability_to_block_external_url.md | 18 - ..._1116_get_ability_to_block_internal_url.md | 15 - ...ty_to_block_port_external_communication.md | 15 - ...ty_to_block_port_internal_communication.md | 15 - ...ty_to_block_user_external_communication.md | 15 - ...ty_to_block_user_internal_communication.md | 15 - ...ind_data_transferred_by_content_pattern.md | 15 - ...ck_data_transferring_by_content_pattern.md | 15 - ...23_get_ability_to_list_data_transferred.md | 15 - ...get_ability_to_collect_transferred_data.md | 15 - ...et_ability_to_identify_transferred_data.md | 15 - ...ind_data_transferred_by_content_pattern.md | 15 - ...lity_to_list_users_opened_email_message.md | 14 - ...ability_to_list_email_message_receivers.md | 14 - ..._1203_get_ability_to_block_email_domain.md | 14 - ..._1204_get_ability_to_block_email_sender.md | 14 - ...205_get_ability_to_delete_email_message.md | 14 - ...get_ability_to_quarantine_email_message.md | 14 - ...07_get_ability_to_collect_email_message.md | 15 - ..._1301_get_ability_to_list_files_created.md | 15 - ...1302_get_ability_to_list_files_modified.md | 15 - ..._1303_get_ability_to_list_files_deleted.md | 15 - ...04_get_ability_to_list_files_downloaded.md | 15 - ..._to_list_files_with_tampered_timestamps.md | 15 - ...A_1306_get_ability_to_find_file_by_path.md | 15 - ...07_get_ability_to_find_file_by_metadata.md | 15 - ...A_1308_get_ability_to_find_file_by_hash.md | 15 - ...1309_get_ability_to_find_file_by_format.md | 15 - ...ability_to_find_file_by_content_pattern.md | 15 - .../RA_1311_get_ability_to_collect_file.md | 15 - ..._get_ability_to_quarantine_file_by_path.md | 15 - ..._get_ability_to_quarantine_file_by_hash.md | 15 - ...et_ability_to_quarantine_file_by_format.md | 15 - ...y_to_quarantine_file_by_content_pattern.md | 15 - .../RA_1316_get_ability_to_remove_file.md | 15 - ...A_1317_get_ability_to_analyse_file_hash.md | 14 - ..._1318_get_ability_to_analyse_windows_pe.md | 14 - ...1319_get_ability_to_analyse_macos_macho.md | 14 - ...RA_1320_get_ability_to_analyse_unix_elf.md | 14 - ...1_get_ability_to_analyse_ms_office_file.md | 14 - ...RA_1322_get_ability_to_analyse_pdf_file.md | 14 - .../RA_1323_get_ability_to_analyse_script.md | 14 - ..._get_ability_to_list_processes_executed.md | 15 - ...lity_to_find_process_by_executable_path.md | 15 - ..._to_find_process_by_executable_metadata.md | 15 - ...lity_to_find_process_by_executable_hash.md | 15 - ...ty_to_find_process_by_executable_format.md | 15 - ...d_process_by_executable_content_pattern.md | 15 - ...ity_to_block_process_by_executable_path.md | 15 - ...to_block_process_by_executable_metadata.md | 15 - ...ity_to_block_process_by_executable_hash.md | 15 - ...y_to_block_process_by_executable_format.md | 15 - ...k_process_by_executable_content_pattern.md | 15 - ...ote_computer_management_system_policies.md | 15 - ..._ability_to_list_registry_keys_modified.md | 15 - ...t_ability_to_list_registry_keys_deleted.md | 15 - ..._ability_to_list_registry_keys_accessed.md | 15 - ...t_ability_to_list_registry_keys_created.md | 15 - ...06_get_ability_to_list_services_created.md | 15 - ...7_get_ability_to_list_services_modified.md | 15 - ...08_get_ability_to_list_services_deleted.md | 15 - ...1509_get_ability_to_remove_registry_key.md | 15 - .../RA_1510_get_ability_to_remove_service.md | 15 - ..._1601_manage_identity_management_system.md | 15 - ...A_1602_get_ability_to_lock_user_account.md | 15 - ...get_ability_to_list_users_authenticated.md | 15 - ...ty_to_revoke_authentication_credentials.md | 15 - ...1605_get_ability_to_remove_user_account.md | 15 - .../RA_2001_list_victims_of_security_alert.md | 15 - .../RA_2002_list_host_vulnerabilities.md | 15 - ..._put_compromised_accounts_on_monitoring.md | 14 - ...hosts_communicated_with_internal_domain.md | 15 - ...ist_hosts_communicated_with_internal_ip.md | 15 - ...st_hosts_communicated_with_internal_url.md | 15 - .../RA_2104_analyse_domain_name.md | 15 - .../Response_Actions/RA_2105_analyse_ip.md | 15 - .../Response_Actions/RA_2106_analyse_uri.md | 15 - ...RA_2107_list_hosts_communicated_by_port.md | 15 - .../RA_2108_list_hosts_connected_to_vpn.md | 15 - ...A_2109_list_hosts_connected_to_intranet.md | 15 - .../RA_2110_list_data_transferred.md | 15 - .../RA_2111_collect_transferred_data.md | 15 - .../RA_2112_identify_transferred_data.md | 15 - ...hosts_communicated_with_external_domain.md | 13 - ...ist_hosts_communicated_with_external_ip.md | 13 - ...st_hosts_communicated_with_external_url.md | 13 - ...ind_data_transferred_by_content_pattern.md | 15 - ...RA_2201_list_users_opened_email_message.md | 14 - .../RA_2202_collect_email_message.md | 23 - .../RA_2203_list_email_message_receivers.md | 14 - ...204_make_sure_email_message_is_phishing.md | 20 - ..._extract_observables_from_email_message.md | 22 - .../RA_2301_list_files_created.md | 15 - .../RA_2302_list_files_modified.md | 15 - .../RA_2303_list_files_deleted.md | 15 - .../RA_2304_list_files_downloaded.md | 15 - ...305_list_files_with_tampered_timestamps.md | 15 - .../RA_2306_find_file_by_path.md | 15 - .../RA_2307_find_file_by_metadata.md | 15 - .../RA_2308_find_file_by_hash.md | 15 - .../RA_2309_find_file_by_format.md | 15 - .../RA_2310_find_file_by_content_pattern.md | 15 - .../Response_Actions/RA_2311_collect_file.md | 15 - .../RA_2312_analyse_file_hash.md | 15 - .../RA_2313_analyse_windows_pe.md | 15 - .../RA_2314_analyse_macos_macho.md | 15 - .../RA_2315_analyse_unix_elf.md | 15 - .../RA_2316_analyse_ms_office_file.md | 15 - .../RA_2317_analyse_pdf_file.md | 15 - .../RA_2318_analyse_script.md | 14 - .../RA_2401_list_processes_executed.md | 15 - ...RA_2402_find_process_by_executable_path.md | 15 - ...403_find_process_by_executable_metadata.md | 15 - ...RA_2404_find_process_by_executable_hash.md | 15 - ..._2405_find_process_by_executable_format.md | 15 - ...d_process_by_executable_content_pattern.md | 15 - .../RA_2501_list_registry_keys_modified.md | 15 - .../RA_2502_list_registry_keys_deleted.md | 15 - .../RA_2503_list_registry_keys_accessed.md | 15 - .../RA_2504_list_registry_keys_created.md | 15 - .../RA_2505_list_services_created.md | 15 - .../RA_2506_list_services_modified.md | 15 - .../RA_2507_list_services_deleted.md | 15 - .../RA_2601_list_users_authenticated.md | 15 - .../RA_3001_patch_vulnerability.md | 15 - .../RA_3101_block_external_ip_address.md | 17 - .../RA_3102_block_internal_ip_address.md | 13 - .../RA_3103_block_external_domain.md | 18 - .../RA_3104_block_internal_domain.md | 14 - .../RA_3105_block_external_url.md | 13 - .../RA_3106_block_internal_url.md | 13 - ..._3107_block_port_external_communication.md | 13 - ..._3108_block_port_internal_communication.md | 13 - ..._3109_block_user_external_communication.md | 13 - ..._3110_block_user_internal_communication.md | 13 - ...ck_data_transferring_by_content_pattern.md | 15 - .../RA_3201_block_domain_on_email.md | 14 - .../RA_3202_block_sender_on_email.md | 14 - .../RA_3203_quarantine_email_message.md | 14 - .../RA_3301_quarantine_file_by_format.md | 15 - .../RA_3302_quarantine_file_by_hash.md | 15 - .../RA_3303_quarantine_file_by_path.md | 15 - ...3304_quarantine_file_by_content_pattern.md | 15 - ...A_3401_block_process_by_executable_path.md | 15 - ...02_block_process_by_executable_metadata.md | 15 - ...A_3403_block_process_by_executable_hash.md | 15 - ...3404_block_process_by_executable_format.md | 15 - ...k_process_by_executable_content_pattern.md | 15 - .../RA_3501_disable_system_service.md | 15 - .../RA_3601_lock_user_account.md | 15 - ...1_report_incident_to_external_companies.md | 25 - .../RA_4101_remove_rogue_network_device.md | 15 - .../RA_4201_delete_email_message.md | 13 - .../Response_Actions/RA_4301_remove_file.md | 15 - .../RA_4501_remove_registry_key.md | 15 - .../RA_4502_remove_service.md | 15 - ..._4601_revoke_authentication_credentials.md | 18 - .../RA_4602_remove_user_account.md | 15 - ...A_5001_reinstall_host_from_golden_image.md | 15 - .../RA_5002_restore_data_from_backup.md | 15 - .../RA_5101_unblock_blocked_ip.md | 13 - .../RA_5102_unblock_blocked_domain.md | 13 - .../RA_5103_unblock_blocked_url.md | 13 - .../RA_5104_unblock_blocked_port.md | 15 - .../RA_5105_unblock_blocked_user.md | 15 - .../RA_5201_unblock_domain_on_email.md | 14 - .../RA_5202_unblock_sender_on_email.md | 13 - ..._5203_restore_quarantined_email_message.md | 13 - .../RA_5301_restore_quarantined_file.md | 15 - .../RA_5401_unblock_blocked_process.md | 15 - .../RA_5501_enable_disabled_service.md | 15 - .../RA_5601_unlock_locked_user_account.md | 15 - .../RA_6001_develop_incident_report.md | 21 - ...A_6002_conduct_lessons_learned_exercise.md | 22 - .../RP_0001_phishing_email.md | 344 ------- .../Response_Stages/RS0001.md | 105 -- .../Response_Stages/RS0002.md | 65 -- .../Response_Stages/RS0003.md | 35 - .../Response_Stages/RS0004.md | 17 - .../Response_Stages/RS0005.md | 23 - .../Response_Stages/RS0006.md | 11 - .../Response_Stages/responsestages.md | 10 - Atomic_Threat_Coverage/Triggers/T1002.md | 231 ----- Atomic_Threat_Coverage/Triggers/T1003.md | 943 ------------------ Atomic_Threat_Coverage/Triggers/T1004.md | 127 --- Atomic_Threat_Coverage/Triggers/T1005.md | 44 - Atomic_Threat_Coverage/Triggers/T1007.md | 74 -- Atomic_Threat_Coverage/Triggers/T1009.md | 55 - Atomic_Threat_Coverage/Triggers/T1010.md | 61 -- Atomic_Threat_Coverage/Triggers/T1012.md | 65 -- Atomic_Threat_Coverage/Triggers/T1014.md | 158 --- Atomic_Threat_Coverage/Triggers/T1015.md | 81 -- Atomic_Threat_Coverage/Triggers/T1016.md | 209 ---- Atomic_Threat_Coverage/Triggers/T1018.md | 278 ------ Atomic_Threat_Coverage/Triggers/T1022.md | 177 ---- Atomic_Threat_Coverage/Triggers/T1023.md | 92 -- Atomic_Threat_Coverage/Triggers/T1027.md | 128 --- Atomic_Threat_Coverage/Triggers/T1028.md | 192 ---- Atomic_Threat_Coverage/Triggers/T1030.md | 57 -- Atomic_Threat_Coverage/Triggers/T1031.md | 45 - Atomic_Threat_Coverage/Triggers/T1032.md | 59 -- Atomic_Threat_Coverage/Triggers/T1033.md | 88 -- Atomic_Threat_Coverage/Triggers/T1035.md | 93 -- Atomic_Threat_Coverage/Triggers/T1036.md | 310 ------ Atomic_Threat_Coverage/Triggers/T1037.md | 233 ----- Atomic_Threat_Coverage/Triggers/T1038.md | 51 - Atomic_Threat_Coverage/Triggers/T1040.md | 149 --- Atomic_Threat_Coverage/Triggers/T1042.md | 52 - Atomic_Threat_Coverage/Triggers/T1044.md | 84 -- Atomic_Threat_Coverage/Triggers/T1045.md | 159 --- Atomic_Threat_Coverage/Triggers/T1046.md | 89 -- Atomic_Threat_Coverage/Triggers/T1047.md | 200 ---- Atomic_Threat_Coverage/Triggers/T1048.md | 192 ---- Atomic_Threat_Coverage/Triggers/T1049.md | 116 --- Atomic_Threat_Coverage/Triggers/T1050.md | 116 --- Atomic_Threat_Coverage/Triggers/T1053.md | 152 --- Atomic_Threat_Coverage/Triggers/T1055.md | 241 ----- Atomic_Threat_Coverage/Triggers/T1056.md | 53 - Atomic_Threat_Coverage/Triggers/T1057.md | 77 -- Atomic_Threat_Coverage/Triggers/T1058.md | 44 - Atomic_Threat_Coverage/Triggers/T1059.md | 42 - Atomic_Threat_Coverage/Triggers/T1060.md | 152 --- Atomic_Threat_Coverage/Triggers/T1062.md | 46 - Atomic_Threat_Coverage/Triggers/T1063.md | 165 --- Atomic_Threat_Coverage/Triggers/T1064.md | 89 -- Atomic_Threat_Coverage/Triggers/T1065.md | 72 -- Atomic_Threat_Coverage/Triggers/T1069.md | 145 --- Atomic_Threat_Coverage/Triggers/T1070.md | 235 ----- Atomic_Threat_Coverage/Triggers/T1071.md | 267 ----- Atomic_Threat_Coverage/Triggers/T1073.md | 59 -- Atomic_Threat_Coverage/Triggers/T1074.md | 113 --- Atomic_Threat_Coverage/Triggers/T1075.md | 90 -- Atomic_Threat_Coverage/Triggers/T1076.md | 93 -- Atomic_Threat_Coverage/Triggers/T1077.md | 143 --- Atomic_Threat_Coverage/Triggers/T1081.md | 125 --- Atomic_Threat_Coverage/Triggers/T1082.md | 262 ----- Atomic_Threat_Coverage/Triggers/T1083.md | 163 --- Atomic_Threat_Coverage/Triggers/T1084.md | 63 -- Atomic_Threat_Coverage/Triggers/T1085.md | 260 ----- Atomic_Threat_Coverage/Triggers/T1086.md | 462 --------- Atomic_Threat_Coverage/Triggers/T1087.md | 388 ------- Atomic_Threat_Coverage/Triggers/T1088.md | 286 ------ Atomic_Threat_Coverage/Triggers/T1089.md | 787 --------------- Atomic_Threat_Coverage/Triggers/T1090.md | 89 -- Atomic_Threat_Coverage/Triggers/T1093.md | 48 - Atomic_Threat_Coverage/Triggers/T1095.md | 132 --- Atomic_Threat_Coverage/Triggers/T1096.md | 94 -- Atomic_Threat_Coverage/Triggers/T1097.md | 45 - Atomic_Threat_Coverage/Triggers/T1098.md | 60 -- Atomic_Threat_Coverage/Triggers/T1099.md | 355 ------- Atomic_Threat_Coverage/Triggers/T1100.md | 62 -- Atomic_Threat_Coverage/Triggers/T1101.md | 45 - Atomic_Threat_Coverage/Triggers/T1102.md | 76 -- Atomic_Threat_Coverage/Triggers/T1103.md | 73 -- Atomic_Threat_Coverage/Triggers/T1105.md | 388 ------- Atomic_Threat_Coverage/Triggers/T1106.md | 53 - Atomic_Threat_Coverage/Triggers/T1107.md | 376 ------- Atomic_Threat_Coverage/Triggers/T1110.md | 71 -- Atomic_Threat_Coverage/Triggers/T1112.md | 189 ---- Atomic_Threat_Coverage/Triggers/T1113.md | 156 --- Atomic_Threat_Coverage/Triggers/T1114.md | 52 - Atomic_Threat_Coverage/Triggers/T1115.md | 74 -- Atomic_Threat_Coverage/Triggers/T1117.md | 133 --- Atomic_Threat_Coverage/Triggers/T1118.md | 645 ------------ Atomic_Threat_Coverage/Triggers/T1119.md | 146 --- Atomic_Threat_Coverage/Triggers/T1121.md | 116 --- Atomic_Threat_Coverage/Triggers/T1122.md | 175 ---- Atomic_Threat_Coverage/Triggers/T1123.md | 35 - Atomic_Threat_Coverage/Triggers/T1124.md | 67 -- Atomic_Threat_Coverage/Triggers/T1126.md | 104 -- Atomic_Threat_Coverage/Triggers/T1127.md | 83 -- Atomic_Threat_Coverage/Triggers/T1128.md | 42 - Atomic_Threat_Coverage/Triggers/T1130.md | 199 ---- Atomic_Threat_Coverage/Triggers/T1132.md | 40 - Atomic_Threat_Coverage/Triggers/T1135.md | 146 --- Atomic_Threat_Coverage/Triggers/T1136.md | 203 ---- Atomic_Threat_Coverage/Triggers/T1137.md | 90 -- Atomic_Threat_Coverage/Triggers/T1138.md | 150 --- Atomic_Threat_Coverage/Triggers/T1139.md | 40 - Atomic_Threat_Coverage/Triggers/T1140.md | 90 -- Atomic_Threat_Coverage/Triggers/T1141.md | 67 -- Atomic_Threat_Coverage/Triggers/T1142.md | 47 - Atomic_Threat_Coverage/Triggers/T1143.md | 46 - Atomic_Threat_Coverage/Triggers/T1144.md | 43 - Atomic_Threat_Coverage/Triggers/T1145.md | 138 --- Atomic_Threat_Coverage/Triggers/T1146.md | 165 --- Atomic_Threat_Coverage/Triggers/T1147.md | 38 - Atomic_Threat_Coverage/Triggers/T1148.md | 63 -- Atomic_Threat_Coverage/Triggers/T1150.md | 38 - Atomic_Threat_Coverage/Triggers/T1151.md | 35 - Atomic_Threat_Coverage/Triggers/T1152.md | 35 - Atomic_Threat_Coverage/Triggers/T1153.md | 65 -- Atomic_Threat_Coverage/Triggers/T1154.md | 37 - Atomic_Threat_Coverage/Triggers/T1155.md | 40 - Atomic_Threat_Coverage/Triggers/T1156.md | 73 -- Atomic_Threat_Coverage/Triggers/T1158.md | 368 ------- Atomic_Threat_Coverage/Triggers/T1159.md | 57 -- Atomic_Threat_Coverage/Triggers/T1160.md | 49 - Atomic_Threat_Coverage/Triggers/T1163.md | 37 - Atomic_Threat_Coverage/Triggers/T1164.md | 73 -- Atomic_Threat_Coverage/Triggers/T1165.md | 41 - Atomic_Threat_Coverage/Triggers/T1166.md | 124 --- Atomic_Threat_Coverage/Triggers/T1168.md | 143 --- Atomic_Threat_Coverage/Triggers/T1169.md | 38 - Atomic_Threat_Coverage/Triggers/T1170.md | 112 --- Atomic_Threat_Coverage/Triggers/T1173.md | 69 -- Atomic_Threat_Coverage/Triggers/T1174.md | 59 -- Atomic_Threat_Coverage/Triggers/T1176.md | 112 --- Atomic_Threat_Coverage/Triggers/T1179.md | 65 -- Atomic_Threat_Coverage/Triggers/T1180.md | 52 - Atomic_Threat_Coverage/Triggers/T1183.md | 97 -- Atomic_Threat_Coverage/Triggers/T1191.md | 99 -- Atomic_Threat_Coverage/Triggers/T1193.md | 47 - Atomic_Threat_Coverage/Triggers/T1196.md | 56 -- Atomic_Threat_Coverage/Triggers/T1197.md | 129 --- Atomic_Threat_Coverage/Triggers/T1201.md | 227 ----- Atomic_Threat_Coverage/Triggers/T1202.md | 79 -- Atomic_Threat_Coverage/Triggers/T1204.md | 213 ---- Atomic_Threat_Coverage/Triggers/T1206.md | 65 -- Atomic_Threat_Coverage/Triggers/T1207.md | 39 - Atomic_Threat_Coverage/Triggers/T1208.md | 46 - Atomic_Threat_Coverage/Triggers/T1214.md | 66 -- Atomic_Threat_Coverage/Triggers/T1215.md | 65 -- Atomic_Threat_Coverage/Triggers/T1216.md | 110 -- Atomic_Threat_Coverage/Triggers/T1217.md | 200 ---- Atomic_Threat_Coverage/Triggers/T1218.md | 360 ------- Atomic_Threat_Coverage/Triggers/T1219.md | 92 -- Atomic_Threat_Coverage/Triggers/T1220.md | 186 ---- Atomic_Threat_Coverage/Triggers/T1222.md | 441 -------- Atomic_Threat_Coverage/Triggers/T1223.md | 86 -- Atomic_Threat_Coverage/Triggers/T1482.md | 91 -- Atomic_Threat_Coverage/Triggers/T1485.md | 100 -- Atomic_Threat_Coverage/Triggers/T1489.md | 117 --- Atomic_Threat_Coverage/Triggers/T1490.md | 200 ---- Atomic_Threat_Coverage/Triggers/T1496.md | 36 - Atomic_Threat_Coverage/Triggers/T1500.md | 60 -- Atomic_Threat_Coverage/Triggers/T1501.md | 78 -- Atomic_Threat_Coverage/Triggers/T1502.md | 70 -- Atomic_Threat_Coverage/Triggers/T1504.md | 62 -- Atomic_Threat_Coverage/Triggers/T1505.md | 71 -- Atomic_Threat_Coverage/Triggers/T1518.md | 62 -- Atomic_Threat_Coverage/Triggers/T1519.md | 46 - Atomic_Threat_Coverage/Triggers/T1529.md | 263 ----- Atomic_Threat_Coverage/Triggers/T1531.md | 103 -- .../Use_Cases/UC_0001_TESTUSECASE.md | 7 - .../Use_Cases/UC_0002_INITIALACCESS.md | 7 - detection_rules/sigma | 2 +- response/atc_react | 2 +- triggers/atomic-red-team | 2 +- 954 files changed, 3 insertions(+), 111848 deletions(-) delete mode 100644 Atomic_Threat_Coverage/Customers/CU_0001_TESTCUSTOMER.md delete mode 100644 Atomic_Threat_Coverage/Customers/CU_0002_TESTCUSTOMER2.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0001_4688_windows_process_creation.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0002_4688_windows_process_creation_with_commandline.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0003_1_windows_sysmon_process_creation.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0004_4624_windows_account_logon.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0005_7045_windows_service_insatalled.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0006_2_windows_sysmon_process_changed_a_file_creation_time.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0007_3_windows_sysmon_network_connection.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0008_4_windows_sysmon_sysmon_service_state_changed.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0009_5_windows_sysmon_process_terminated.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0010_6_windows_sysmon_driver_loaded.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0011_7_windows_sysmon_image_loaded.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0012_8_windows_sysmon_CreateRemoteThread.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0013_9_windows_sysmon_RawAccessRead.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0014_10_windows_sysmon_ProcessAccess.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0015_11_windows_sysmon_FileCreate.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0016_12_windows_sysmon_RegistryEvent.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0017_13_windows_sysmon_RegistryEvent.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0018_14_windows_sysmon_RegistryEvent.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0019_15_windows_sysmon_FileCreateStreamHash.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0020_17_windows_sysmon_PipeEvent.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0021_18_windows_sysmon_PipeEvent.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0022_19_windows_sysmon_WmiEvent.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0023_20_windows_sysmon_WmiEvent.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0024_21_windows_sysmon_WmiEvent.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0026_5136_windows_directory_service_object_was_modified.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0027_4738_user_account_was_changed.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0028_4794_directory_services_restore_mode_admin_password_set.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0029_4661_handle_to_an_object_was_requested.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0030_4662_operation_was_performed_on_an_object.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0031_7036_service_started_stopped.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0032_5145_network_share_object_was_accessed_detailed.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0033_5140_network_share_object_was_accessed.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0034_104_log_file_was_cleared.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0035_106_task_scheduler_task_registered.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0036_4104_windows_powershell_script_block.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0037_4103_windows_powershell_executing_pipeline.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0038_400_engine_state_is_changed_from_none_to_available.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0039_524_system_catalog_has_been_deleted.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0040_528_user_successfully_logged_on_to_a_computer.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0041_529_logon_failure.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0042_675_kerberos_preauthentication_failed.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0043_770_dns_server_plugin_dll_has_been_loaded.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0044_1000_application_crashed.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0045_1001_windows_error_reporting.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0046_1031_dhcp_service_callout_dll_file_has_caused_an_exception.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0047_1032_dhcp_service_callout_dll_file_has_caused_an_exception.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0048_1033_dhcp_service_successfully_loaded_callout_dlls.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0049_1034_dhcp_service_failed_to_load_callout_dlls.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0050_1102_audit_log_was_cleared.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0051_1121_attack_surface_reduction_blocking_mode_event.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0052_2003_query_to_load_usb_drivers.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0053_2100_pnp_or_power_operation_for_usb_device.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0054_2102_pnp_or_power_operation_for_usb_device.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0054_linux_auditd_execve.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0055_linux_auditd_read_access_to_file.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0056_linux_auditd_syscall.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0057_4625_account_failed_to_logon.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0058_4656_handle_to_an_object_was_requested.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0059_4657_registry_value_was_modified.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0060_4658_handle_to_an_object_was_closed.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0061_4660_object_was_deleted.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0062_4663_attempt_was_made_to_access_an_object.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0063_4697_service_was_installed_in_the_system.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0064_4698_scheduled_task_was_created.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0065_4701_scheduled_task_was_disabled.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0066_4704_user_right_was_assigned.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0067_4719_system_audit_policy_was_changed.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0068_4728_member_was_added_to_security_enabled_global_group.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0069_4732_member_was_added_to_security_enabled_local_group.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0070_4735_security_enabled_local_group_was_changed.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0071_4737_security_enabled_global_group_was_changed.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0072_4755_security_enabled_universal_group_was_changed.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0073_4756_member_was_added_to_a_security_enabled_universal_group.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0074_4765_sid_history_was_added_to_an_account.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0075_4766_attempt_to_add_sid_history_to_an_account_failed.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0076_4768_kerberos_authentication_ticket_was_requested.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0077_4769_kerberos_service_ticket_was_requested.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0078_4771_kerberos_pre_authentication_failed.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0079_4776_computer_attempted_to_validate_the_credentials_for_an_account.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0080_5859_wmi_activity.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0081_5861_wmi_activity.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0082_8002_ntlm_server_blocked_audit.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0083_16_access_history_in_hive_was_cleared.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0084_av_alert.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0085_22_windows_sysmon_DnsQuery.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0086_4720_user_account_was_created.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0087_5156_windows_filtering_platform_has_permitted_connection.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0088_4616_system_time_was_changed.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0089_56_terminal_server_security_layer_detected_an_error.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0090_50_terminal_server_security_layer_detected_an_error.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0091_linux_modsecurity_log.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0092_unix_generic_syslog.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0093_linux_clamav_log.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0094_linux_sshd_log.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0095_linux_auth_pam_log.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0096_linux_named_client_security_log.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0097_linux_daemon_log.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0098_linux_vsftpd_log.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0099_Bind_DNS_query.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0100_Passive_DNS_log.md delete mode 100644 Atomic_Threat_Coverage/Data_Needed/DN0108_150_dns_server_could_not_load_dll.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/av_exploiting.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/av_password_dumper.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/av_relevant_files.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/av_webshell.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/mal_azorult_reg.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/powershell_alternate_powershell_hosts.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/powershell_clear_powershell_history.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/powershell_create_local_user.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/powershell_data_compressed.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/powershell_dnscat_execution.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/powershell_downgrade_attack.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/powershell_exe_calling_ps.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/powershell_invoke_obfuscation_obfuscated_iex.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/powershell_malicious_commandlets.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/powershell_malicious_keywords.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/powershell_nishang_malicious_commandlets.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/powershell_ntfs_ads_access.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/powershell_prompt_credentials.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/powershell_psattack.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/powershell_remote_powershell_session.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/powershell_shellcode_b64.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/powershell_suspicious_download.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/powershell_suspicious_invocation_generic.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/powershell_suspicious_invocation_specific.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/powershell_suspicious_keywords.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/powershell_suspicious_profile_create.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/powershell_winlogon_helper_dll.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/powershell_wmimplant.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/powershell_xor_commandline.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/sysmon_ads_executable.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/sysmon_alternate_powershell_hosts_pipe.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/sysmon_apt_muddywater_dnstunnel.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/sysmon_apt_turla_namedpipes.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/sysmon_cactustorch.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/sysmon_cmstp_execution.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/sysmon_cobaltstrike_process_injection.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/sysmon_createremotethread_loadlibrary.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/sysmon_cred_dump_tools_named_pipes.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/sysmon_hack_wce.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/sysmon_logon_scripts_userinitmprlogonscript_proc.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/sysmon_mal_namedpipes.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/sysmon_password_dumper_lsass.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/sysmon_possible_dns_rebinding.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/sysmon_raw_disk_access_using_illegitimate_tools.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/sysmon_susp_powershell_rundll32.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/sysmon_suspicious_remote_thread.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/sysmon_wmi_event_subscription.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/sysmon_wmi_susp_scripting.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_GPO_scheduledtasks.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_account_backdoor_dcsync_rights.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_account_discovery.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_ad_object_writedac_access.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_ad_replication_non_machine_account.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_ad_user_enumeration.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_admin_rdp_login.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_admin_share_access.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_advanced_ip_scanner.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_alert_active_directory_user_control.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_alert_ad_user_backdoors.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_alert_enable_weak_encryption.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_alert_lsass_access.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_alert_mimikatz_keywords.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_alert_ruler.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_apt_apt29_thinktanks.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_apt_apt29_tor.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_apt_babyshark.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_apt_bear_activity_gtr19.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_apt_bluemashroom.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_apt_carbonpaper_turla.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_apt_chafer_mar18.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_apt_cloudhopper.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_apt_dragonfly.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_apt_elise.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_apt_emissarypanda_sep19.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_apt_empiremonkey.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_apt_equationgroup_dll_u_load.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_apt_gallium.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_apt_greenbug_may20.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_apt_hurricane_panda.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_apt_judgement_panda_gtr19.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_apt_ke3chang_regadd.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_apt_lazarus_session_highjack.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_apt_mustangpanda.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_apt_slingshot.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_apt_sofacy.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_apt_stonedrill.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_apt_ta17_293a_ps.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_apt_tropictrooper.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_apt_turla_commands.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_apt_turla_comrat_may20.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_apt_turla_service_png.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_apt_unidentified_nov_18.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_apt_winnti_mal_hk_jan20.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_apt_wocao.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_apt_zxshell.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_atsvc_task.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_attrib_hiding_files.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_audit_cve.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_av_relevant_match.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_bootconf_mod.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_bypass_squiblytwo.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_change_default_file_association.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_cmdkey_recon.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_cmstp_com_object_access.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_commandline_path_traversal.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_control_panel_item.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_copying_sensitive_files_with_credential_data.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_crime_fireball.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_crime_maze_ransomware.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_data_compressed_with_rar.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_dcsync.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_defender_bypass.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_defender_disabled.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_defender_threat.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_disable_event_logging.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_dns_exfiltration_tools_execution.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_dpapi_domain_backupkey_extraction.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_dpapi_domain_masterkey_backup_attempt.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_dsquery_domain_trust_discovery.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_encoded_frombase64string.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_encoded_iex.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_etw_modification.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_etw_modification_cmdline.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_etw_trace_evasion.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_exfiltration_and_tunneling_tools_execution.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_exploit_cve_2015_1641.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_exploit_cve_2017_0261.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_exploit_cve_2017_11882.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_exploit_cve_2017_8759.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_exploit_cve_2019_1378.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_exploit_cve_2019_1388.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_exploit_cve_2020_10189.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_exploit_cve_2020_1048.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_external_device.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_file_permission_modifications.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_global_catalog_enumeration.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_grabbing_sensitive_hives_via_reg.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_hack_bloodhound.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_hack_koadic.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_hack_rubeus.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_hack_secutyxploded.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_hack_smbexec.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_hh_chm.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_hktl_createminidump.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_html_help_spawn.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_hwp_exploits.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_impacket_lateralization.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_impacket_secretdump.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_indirect_cmd.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_install_reg_debugger_backdoor.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_interactive_at.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_invoke_obfuscation_obfuscated_iex_commandline.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_invoke_obfuscation_obfuscated_iex_services.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_lethalhta.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_lm_namedpipe.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_local_system_owner_account_discovery.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_lsass_access_non_system_account.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_lsass_dump.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_mal_adwind.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_mal_blue_mockingbird.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_mal_creddumper.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_mal_flowcloud.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_mal_octopus_scanner.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_mal_ryuk.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_mal_service_installs.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_mal_ursnif.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_mal_wceaux_dll.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_malware_dridex.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_malware_dtrack.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_malware_emotet.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_malware_formbook.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_malware_notpetya.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_malware_qbot.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_malware_ryuk.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_malware_script_dropper.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_malware_trickbot_recon_activity.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_malware_wannacry.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_mavinject_proc_inj.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_metasploit_authentication.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_meterpreter_or_cobaltstrike_getsystem_service_installation.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_meterpreter_or_cobaltstrike_getsystem_service_start.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_mimikatz_command_line.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_mmc20_lateral_movement.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_mmc_spawn_shell.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_mshta_javascript.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_mshta_spawn_shell.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_multiple_suspicious_cli.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_net_enum.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_net_ntlm_downgrade.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_net_user_add.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_netsh_allow_port_rdp.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_netsh_fw_add.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_netsh_fw_add_susp_image.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_netsh_packet_capture.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_netsh_port_fwd.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_netsh_port_fwd_3389.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_netsh_wifi_credential_harvesting.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_network_sniffing.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_new_or_renamed_user_account_with_dollar_sign.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_new_service_creation.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_non_interactive_powershell.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_not_allowed_rdp_access.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_office_shell.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_office_spawn_exe_from_users_directory.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_overpass_the_hash.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_pass_the_hash.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_pass_the_hash_2.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_pcap_drivers.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_plugx_susp_exe_locations.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_possible_applocker_bypass.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_possible_dc_shadow.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_powershell_amsi_bypass.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_powershell_audio_capture.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_powershell_b64_shellcode.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_powershell_bitsjob.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_powershell_dll_execution.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_powershell_downgrade_attack.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_powershell_download.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_powershell_frombase64string.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_powershell_suspicious_parameter_variation.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_powershell_web_request.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_powershell_xor_commandline.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_powersploit_empire_schtasks.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_proc_wrong_parent.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_process_creation_bitsadmin_download.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_process_dump_rundll32_comsvcs.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_protected_storage_service_access.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_psexesvc_start.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_quarkspwdump_clearing_hive_access_history.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_query_registry.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_rare_schtask_creation.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_rare_schtasks_creations.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_rare_service_installs.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_rdp_bluekeep_poc_scanner.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_rdp_hijack_shadowing.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_rdp_localhost_login.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_rdp_potential_cve-2019-0708.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_rdp_reverse_tunnel.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_redmimicry_winnti_proc.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_register_new_logon_process_by_rubeus.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_remote_powershell_session.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_remote_powershell_session_process.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_remote_registry_management_using_reg_utility.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_remote_time_discovery.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_renamed_binary.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_renamed_binary_highly_relevant.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_renamed_jusched.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_renamed_paexec.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_renamed_powershell.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_renamed_procdump.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_renamed_psexec.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_run_powershell_script_from_ads.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_sam_registry_hive_handle_request.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_scm_database_handle_failure.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_scm_database_privileged_operation.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_sdbinst_shim_persistence.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_service_execution.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_service_stop.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_shadow_copies_access_symlink.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_shadow_copies_creation.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_shadow_copies_deletion.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_shell_spawn_susp_program.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_silenttrinity_stage_use.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_soundrec_audio_capture.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_spn_enum.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_add_domain_trust.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_add_sid_history.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_backup_delete.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_bcdedit.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_bginfo.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_calc.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_cdb.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_certutil_command.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_certutil_encode.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_cli_escape.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_cmd_http_appdata.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_codeintegrity_check_failure.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_codepage_switch.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_commands_recon_activity.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_compression_params.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_comsvcs_procdump.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_control_dll_load.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_copy_lateral_movement.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_copy_system32.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_covenant.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_crackmapexec_execution.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_crackmapexec_powershell_obfuscation.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_csc.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_csc_folder.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_curl_download.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_curl_fileupload.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_curl_start_combo.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_dctask64_proc_inject.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_desktopimgdownldr.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_devtoolslauncher.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_dhcp_config.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_dhcp_config_failed.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_direct_asep_reg_keys_modification.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_disable_ie_features.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_ditsnap.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_dns_config.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_dnx.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_double_extension.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_dsrm_password_change.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_dxcap.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_eventlog_clear.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_eventlog_cleared.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_exec_folder.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_execution_path.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_execution_path_webserver.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_explorer_break_proctree.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_failed_logon_reasons.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_failed_logon_source.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_failed_logons_single_source.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_file_characteristics.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_findstr_lnk.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_firewall_disable.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_fsutil_usage.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_gup.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_interactive_logons.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_iss_module_install.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_kerberos_manipulation.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_ldap_dataexchange.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_local_anon_logon_created.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_lsass_dump.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_lsass_dump_generic.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_mshta_execution.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_msiexec_cwd.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_msiexec_web_install.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_msmpeng_crash.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_msoffice.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_net_execution.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_net_recon_activity.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_netsh_dll_persistence.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_ntdsutil.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_ntlm_auth.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_ntlm_rdp.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_odbcconf.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_openwith.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_outlook.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_outlook_temp.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_ping_hex_ip.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_powershell_empire_launch.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_powershell_empire_uac_bypass.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_powershell_enc_cmd.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_powershell_hidden_b64_cmd.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_powershell_parent_combo.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_powershell_parent_process.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_procdump.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_process_creations.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_prog_location_process_starts.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_ps_appdata.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_ps_downloadfile.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_psexec.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_psr_capture_screenshots.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_raccess_sensitive_fext.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_rar_flags.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_rasdial_activity.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_rc4_kerberos.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_recon_activity.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_regsvr32_anomalies.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_renamed_dctask64.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_renamed_debugview.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_rottenpotato.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_run_locations.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_rundll32_activity.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_rundll32_by_ordinal.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_sam_dump.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_samr_pwset.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_schtask_creation.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_script_execution.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_sdelete.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_security_eventlog_cleared.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_service_path_modification.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_squirrel_lolbin.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_svchost.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_svchost_no_cli.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_sysprep_appdata.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_sysvol_access.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_taskmgr_localsystem.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_taskmgr_parent.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_time_modification.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_tscon_localsystem.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_tscon_rdp_redirect.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_use_of_csharp_console.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_userinit_child.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_whoami.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_wmi_execution.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_susp_wmi_login.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_suspicious_outbound_kerberos_connection.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_svcctl_remote_service.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_syskey_registry_access.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_sysmon_driver_unload.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_system_exe_anomaly.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_tap_driver_installation.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_tap_installer_execution.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_task_folder_evasion.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_termserv_proc_spawn.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_tool_psexec.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_transferring_files_with_credential_data_via_network_shares.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_trust_discovery.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_uac_cmstp.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_uac_fodhelper.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_uac_wsreset.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_usb_device_plugged.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_user_added_to_local_administrators.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_user_couldnt_call_privileged_service_lsaregisterlogonprocess.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_user_creation.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_user_driver_loaded.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_using_sc_to_change_sevice_image_path_by_non_admin.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_vul_cve_2020_0688.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_vul_java_remote_debugging.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_webshell_detection.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_webshell_spawn.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_whoami_as_system.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_win10_sched_task_0day.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_wmi_backdoor_exchange_transport_agent.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_wmi_persistence.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_wmi_persistence_script_event_consumer.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_wmi_spwns_powershell.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_wmiprvse_spawning_process.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_workflow_compiler.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_wsreset_uac_bypass.md delete mode 100644 Atomic_Threat_Coverage/Detection_Rules/win_xsl_script_processing.md delete mode 100644 Atomic_Threat_Coverage/Enrichments/EN0001_cache_sysmon_event_id_1_info.md delete mode 100644 Atomic_Threat_Coverage/Enrichments/EN0002_enrich_sysmon_event_id_1_with_parent_info.md delete mode 100644 Atomic_Threat_Coverage/Enrichments/EN0003_enrich_other_sysmon_events_with_event_id_1_data.md delete mode 100644 Atomic_Threat_Coverage/Enrichments/EN0004_enrich_sysmon_event_id_11_with_TargetFilePathFingerprint.md delete mode 100644 Atomic_Threat_Coverage/Enrichments/EN0005_cache_TargetFilePathFingerprint_from_enriched_sysmon_event_id_11.md delete mode 100644 Atomic_Threat_Coverage/Hardening_Policies/HP_0001_windows_LocalAccountTokenFilterPolicy.md delete mode 100644 Atomic_Threat_Coverage/Logging_Policies/LP0001_windows_audit_process_creation.md delete mode 100644 Atomic_Threat_Coverage/Logging_Policies/LP0002_windows_audit_process_creation_with_commandline.md delete mode 100644 Atomic_Threat_Coverage/Logging_Policies/LP0003_windows_sysmon_process_creation.md delete mode 100644 Atomic_Threat_Coverage/Logging_Policies/LP0004_windows_audit_logon.md delete mode 100644 Atomic_Threat_Coverage/Logging_Policies/LP0005_windows_sysmon_network_connection.md delete mode 100644 Atomic_Threat_Coverage/Logging_Policies/LP0006_windows_sysmon_image_loaded.md delete mode 100644 Atomic_Threat_Coverage/Logging_Policies/LP0007_windows_sysmon_ProcessAccess.md delete mode 100644 Atomic_Threat_Coverage/Logging_Policies/LP0008_windows_sysmon_FileCreate.md delete mode 100644 Atomic_Threat_Coverage/Logging_Policies/LP0009_windows_sysmon_PipeEvent.md delete mode 100644 Atomic_Threat_Coverage/Logging_Policies/LP0010_windows_sysmon_WmiEvent.md delete mode 100644 Atomic_Threat_Coverage/Logging_Policies/LP0011_windows_sysmon_DnsQuery.md delete mode 100644 Atomic_Threat_Coverage/Logging_Policies/LP0025_windows_audit_directory_service_changes.md delete mode 100644 Atomic_Threat_Coverage/Logging_Policies/LP0026_windows_audit_user_account_management.md delete mode 100644 Atomic_Threat_Coverage/Logging_Policies/LP0027_windows_audit_directory_service_access.md delete mode 100644 Atomic_Threat_Coverage/Logging_Policies/LP0028_windows_audit_sam.md delete mode 100644 Atomic_Threat_Coverage/Logging_Policies/LP0029_windows_audit_detailed_file_share.md delete mode 100644 Atomic_Threat_Coverage/Logging_Policies/LP0030_windows_audit_file_share.md delete mode 100644 Atomic_Threat_Coverage/Logging_Policies/LP0031_linux_auditd_execve.md delete mode 100644 Atomic_Threat_Coverage/Logging_Policies/LP0032_linux_auditd_read_access_to_file.md delete mode 100644 Atomic_Threat_Coverage/Logging_Policies/LP0033_linux_auditd_syscall.md delete mode 100644 Atomic_Threat_Coverage/Logging_Policies/LP0034_linux_named_client_security_log.md delete mode 100644 Atomic_Threat_Coverage/Logging_Policies/LP0037_windows_audit_audit_policy_change.md delete mode 100644 Atomic_Threat_Coverage/Logging_Policies/LP0038_windows_audit_kerberos_authentication_service.md delete mode 100644 Atomic_Threat_Coverage/Logging_Policies/LP0039_windows_audit_kernel_object.md delete mode 100644 Atomic_Threat_Coverage/Logging_Policies/LP0041_windows_audit_other_object_access_events.md delete mode 100644 Atomic_Threat_Coverage/Logging_Policies/LP0042_windows_audit_handle_manipulation.md delete mode 100644 Atomic_Threat_Coverage/Logging_Policies/LP0044_windows_ntlm_audit.md delete mode 100644 Atomic_Threat_Coverage/Logging_Policies/LP0045_windows_audit_filtering_platform_connection.md delete mode 100644 Atomic_Threat_Coverage/Logging_Policies/LP0046_windows_audit_security_state_change.md delete mode 100644 Atomic_Threat_Coverage/Logging_Policies/LP0047_BIND_DNS_queries.md delete mode 100644 Atomic_Threat_Coverage/Logging_Policies/LP0048_Passive_DNS_logging.md delete mode 100644 Atomic_Threat_Coverage/Logging_Policies/LP0100_windows_audit_security_system_extension.md delete mode 100644 Atomic_Threat_Coverage/Logging_Policies/LP0101_windows_audit_security_group_management.md delete mode 100644 Atomic_Threat_Coverage/Logging_Policies/LP0102_windows_audit_file_system.md delete mode 100644 Atomic_Threat_Coverage/Logging_Policies/LP0103_windows_audit_registry.md delete mode 100644 Atomic_Threat_Coverage/Logging_Policies/LP0104_windows_audit_removable_storage.md delete mode 100644 Atomic_Threat_Coverage/Logging_Policies/LP0105_windows_audit_authorization_policy_change.md delete mode 100644 Atomic_Threat_Coverage/Logging_Policies/LP0106_windows_audit_kerberos_service_ticket_operations.md delete mode 100644 Atomic_Threat_Coverage/Logging_Policies/LP0107_windows_audit_credential_validation.md delete mode 100644 Atomic_Threat_Coverage/Logging_Policies/LP0108_windows_powershell_module_logging.md delete mode 100644 Atomic_Threat_Coverage/Logging_Policies/LP0109_windows_powershell_script_block_log.md delete mode 100644 Atomic_Threat_Coverage/Logging_Policies/LP0110_windows_powershell_transcript.md delete mode 100644 Atomic_Threat_Coverage/Mitigation_Policies/MP_0001_windows_asr_block_credential_stealing_from_lsass.md delete mode 100644 Atomic_Threat_Coverage/Mitigation_Systems/MS_0001_microsoft_defender_advanced_threat_protection.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1001_practice.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1002_take_trainings.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1003_raise_personnel_awareness.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1004_make_personnel_report_suspicious_activity.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1005_set_up_relevant_data_collection.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1006_set_up_a_centralized_long-term_log_storage.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1007_develop_communication_map.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1008_make_sure_there_are_backups.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1009_get_network_architecture_map.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1010_get_access_control_matrix.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1011_develop_assets_knowledge_base.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1012_check_analysis_toolset.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1013_access_vulnerability_management_system_logs.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1014_connect_with_trusted_communities.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1101_access_external_network_flow_logs.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1102_access_internal_network_flow_logs.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1103_access_internal_http_logs.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1104_access_external_http_logs.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1105_access_internal_dns_logs.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1106_access_external_dns_logs.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1107_access_vpn_logs.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1108_access_dhcp_logs.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1109_access_internal_packet_capture_data.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1110_access_external_packet_capture_data.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1111_get_ability_to_block_external_ip_address.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1112_get_ability_to_block_internal_ip_address.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1113_get_ability_to_block_external_domain.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1114_get_ability_to_block_internal_domain.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1115_get_ability_to_block_external_url.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1116_get_ability_to_block_internal_url.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1117_get_ability_to_block_port_external_communication.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1118_get_ability_to_block_port_internal_communication.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1119_get_ability_to_block_user_external_communication.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1120_get_ability_to_block_user_internal_communication.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1121_get_ability_to_find_data_transferred_by_content_pattern.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1122_get_ability_to_block_data_transferring_by_content_pattern.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1123_get_ability_to_list_data_transferred.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1124_get_ability_to_collect_transferred_data.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1125_get_ability_to_identify_transferred_data.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1126_find_data_transferred_by_content_pattern.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1201_get_ability_to_list_users_opened_email_message.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1202_get_ability_to_list_email_message_receivers.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1203_get_ability_to_block_email_domain.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1204_get_ability_to_block_email_sender.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1205_get_ability_to_delete_email_message.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1206_get_ability_to_quarantine_email_message.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1207_get_ability_to_collect_email_message.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1301_get_ability_to_list_files_created.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1302_get_ability_to_list_files_modified.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1303_get_ability_to_list_files_deleted.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1304_get_ability_to_list_files_downloaded.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1305_get_ability_to_list_files_with_tampered_timestamps.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1306_get_ability_to_find_file_by_path.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1307_get_ability_to_find_file_by_metadata.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1308_get_ability_to_find_file_by_hash.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1309_get_ability_to_find_file_by_format.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1310_get_ability_to_find_file_by_content_pattern.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1311_get_ability_to_collect_file.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1312_get_ability_to_quarantine_file_by_path.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1313_get_ability_to_quarantine_file_by_hash.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1314_get_ability_to_quarantine_file_by_format.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1315_get_ability_to_quarantine_file_by_content_pattern.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1316_get_ability_to_remove_file.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1317_get_ability_to_analyse_file_hash.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1318_get_ability_to_analyse_windows_pe.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1319_get_ability_to_analyse_macos_macho.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1320_get_ability_to_analyse_unix_elf.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1321_get_ability_to_analyse_ms_office_file.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1322_get_ability_to_analyse_pdf_file.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1323_get_ability_to_analyse_script.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1401_get_ability_to_list_processes_executed.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1402_get_ability_to_find_process_by_executable_path.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1403_get_ability_to_find_process_by_executable_metadata.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1404_get_ability_to_find_process_by_executable_hash.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1405_get_ability_to_find_process_by_executable_format.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1406_get_ability_to_find_process_by_executable_content_pattern.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1407_get_ability_to_block_process_by_executable_path.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1408_get_ability_to_block_process_by_executable_metadata.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1409_get_ability_to_block_process_by_executable_hash.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1410_get_ability_to_block_process_by_executable_format.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1411_get_ability_to_block_process_by_executable_content_pattern.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1501_manage_remote_computer_management_system_policies.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1502_get_ability_to_list_registry_keys_modified.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1503_get_ability_to_list_registry_keys_deleted.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1504_get_ability_to_list_registry_keys_accessed.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1505_get_ability_to_list_registry_keys_created.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1506_get_ability_to_list_services_created.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1507_get_ability_to_list_services_modified.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1508_get_ability_to_list_services_deleted.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1509_get_ability_to_remove_registry_key.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1510_get_ability_to_remove_service.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1601_manage_identity_management_system.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1602_get_ability_to_lock_user_account.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1603_get_ability_to_list_users_authenticated.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1604_get_ability_to_revoke_authentication_credentials.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_1605_get_ability_to_remove_user_account.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_2001_list_victims_of_security_alert.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_2002_list_host_vulnerabilities.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_2003_put_compromised_accounts_on_monitoring.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_2101_list_hosts_communicated_with_internal_domain.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_2102_list_hosts_communicated_with_internal_ip.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_2103_list_hosts_communicated_with_internal_url.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_2104_analyse_domain_name.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_2105_analyse_ip.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_2106_analyse_uri.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_2107_list_hosts_communicated_by_port.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_2108_list_hosts_connected_to_vpn.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_2109_list_hosts_connected_to_intranet.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_2110_list_data_transferred.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_2111_collect_transferred_data.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_2112_identify_transferred_data.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_2113_list_hosts_communicated_with_external_domain.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_2114_list_hosts_communicated_with_external_ip.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_2115_list_hosts_communicated_with_external_url.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_2116_find_data_transferred_by_content_pattern.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_2201_list_users_opened_email_message.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_2202_collect_email_message.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_2203_list_email_message_receivers.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_2204_make_sure_email_message_is_phishing.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_2205_extract_observables_from_email_message.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_2301_list_files_created.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_2302_list_files_modified.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_2303_list_files_deleted.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_2304_list_files_downloaded.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_2305_list_files_with_tampered_timestamps.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_2306_find_file_by_path.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_2307_find_file_by_metadata.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_2308_find_file_by_hash.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_2309_find_file_by_format.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_2310_find_file_by_content_pattern.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_2311_collect_file.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_2312_analyse_file_hash.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_2313_analyse_windows_pe.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_2314_analyse_macos_macho.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_2315_analyse_unix_elf.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_2316_analyse_ms_office_file.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_2317_analyse_pdf_file.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_2318_analyse_script.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_2401_list_processes_executed.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_2402_find_process_by_executable_path.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_2403_find_process_by_executable_metadata.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_2404_find_process_by_executable_hash.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_2405_find_process_by_executable_format.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_2406_find_process_by_executable_content_pattern.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_2501_list_registry_keys_modified.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_2502_list_registry_keys_deleted.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_2503_list_registry_keys_accessed.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_2504_list_registry_keys_created.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_2505_list_services_created.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_2506_list_services_modified.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_2507_list_services_deleted.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_2601_list_users_authenticated.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_3001_patch_vulnerability.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_3101_block_external_ip_address.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_3102_block_internal_ip_address.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_3103_block_external_domain.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_3104_block_internal_domain.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_3105_block_external_url.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_3106_block_internal_url.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_3107_block_port_external_communication.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_3108_block_port_internal_communication.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_3109_block_user_external_communication.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_3110_block_user_internal_communication.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_3111_block_data_transferring_by_content_pattern.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_3201_block_domain_on_email.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_3202_block_sender_on_email.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_3203_quarantine_email_message.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_3301_quarantine_file_by_format.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_3302_quarantine_file_by_hash.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_3303_quarantine_file_by_path.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_3304_quarantine_file_by_content_pattern.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_3401_block_process_by_executable_path.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_3402_block_process_by_executable_metadata.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_3403_block_process_by_executable_hash.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_3404_block_process_by_executable_format.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_3405_block_process_by_executable_content_pattern.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_3501_disable_system_service.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_3601_lock_user_account.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_4001_report_incident_to_external_companies.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_4101_remove_rogue_network_device.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_4201_delete_email_message.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_4301_remove_file.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_4501_remove_registry_key.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_4502_remove_service.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_4601_revoke_authentication_credentials.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_4602_remove_user_account.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_5001_reinstall_host_from_golden_image.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_5002_restore_data_from_backup.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_5101_unblock_blocked_ip.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_5102_unblock_blocked_domain.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_5103_unblock_blocked_url.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_5104_unblock_blocked_port.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_5105_unblock_blocked_user.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_5201_unblock_domain_on_email.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_5202_unblock_sender_on_email.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_5203_restore_quarantined_email_message.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_5301_restore_quarantined_file.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_5401_unblock_blocked_process.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_5501_enable_disabled_service.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_5601_unlock_locked_user_account.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_6001_develop_incident_report.md delete mode 100644 Atomic_Threat_Coverage/Response_Actions/RA_6002_conduct_lessons_learned_exercise.md delete mode 100644 Atomic_Threat_Coverage/Response_Playbooks/RP_0001_phishing_email.md delete mode 100644 Atomic_Threat_Coverage/Response_Stages/RS0001.md delete mode 100644 Atomic_Threat_Coverage/Response_Stages/RS0002.md delete mode 100644 Atomic_Threat_Coverage/Response_Stages/RS0003.md delete mode 100644 Atomic_Threat_Coverage/Response_Stages/RS0004.md delete mode 100644 Atomic_Threat_Coverage/Response_Stages/RS0005.md delete mode 100644 Atomic_Threat_Coverage/Response_Stages/RS0006.md delete mode 100644 Atomic_Threat_Coverage/Response_Stages/responsestages.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1002.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1003.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1004.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1005.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1007.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1009.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1010.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1012.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1014.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1015.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1016.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1018.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1022.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1023.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1027.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1028.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1030.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1031.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1032.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1033.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1035.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1036.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1037.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1038.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1040.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1042.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1044.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1045.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1046.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1047.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1048.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1049.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1050.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1053.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1055.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1056.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1057.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1058.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1059.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1060.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1062.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1063.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1064.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1065.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1069.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1070.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1071.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1073.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1074.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1075.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1076.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1077.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1081.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1082.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1083.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1084.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1085.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1086.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1087.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1088.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1089.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1090.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1093.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1095.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1096.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1097.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1098.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1099.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1100.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1101.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1102.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1103.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1105.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1106.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1107.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1110.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1112.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1113.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1114.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1115.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1117.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1118.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1119.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1121.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1122.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1123.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1124.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1126.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1127.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1128.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1130.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1132.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1135.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1136.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1137.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1138.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1139.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1140.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1141.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1142.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1143.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1144.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1145.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1146.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1147.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1148.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1150.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1151.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1152.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1153.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1154.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1155.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1156.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1158.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1159.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1160.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1163.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1164.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1165.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1166.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1168.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1169.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1170.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1173.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1174.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1176.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1179.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1180.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1183.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1191.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1193.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1196.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1197.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1201.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1202.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1204.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1206.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1207.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1208.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1214.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1215.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1216.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1217.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1218.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1219.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1220.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1222.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1223.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1482.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1485.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1489.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1490.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1496.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1500.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1501.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1502.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1504.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1505.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1518.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1519.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1529.md delete mode 100644 Atomic_Threat_Coverage/Triggers/T1531.md delete mode 100644 Atomic_Threat_Coverage/Use_Cases/UC_0001_TESTUSECASE.md delete mode 100644 Atomic_Threat_Coverage/Use_Cases/UC_0002_INITIALACCESS.md diff --git a/Atomic_Threat_Coverage/Customers/CU_0001_TESTCUSTOMER.md b/Atomic_Threat_Coverage/Customers/CU_0001_TESTCUSTOMER.md deleted file mode 100644 index 8f06b11..0000000 --- a/Atomic_Threat_Coverage/Customers/CU_0001_TESTCUSTOMER.md +++ /dev/null @@ -1,8 +0,0 @@ -| Title | CU_0001_TESTCUSTOMER | -|:-------------------|:--------------------| -| **Customer Name** | TESTCUSTOMER | -| **Description** | Some text description here. It will be merged into one line. | -| **Use Cases** | | -| **Data Needed** | | -| **Logging Policy** | | -| **Detection Rule** | | \ No newline at end of file diff --git a/Atomic_Threat_Coverage/Customers/CU_0002_TESTCUSTOMER2.md b/Atomic_Threat_Coverage/Customers/CU_0002_TESTCUSTOMER2.md deleted file mode 100644 index 922170d..0000000 --- a/Atomic_Threat_Coverage/Customers/CU_0002_TESTCUSTOMER2.md +++ /dev/null @@ -1,8 +0,0 @@ -| Title | CU_0002_TESTCUSTOMER2 | -|:-------------------|:--------------------| -| **Customer Name** | TESTCUSTOMER2 | -| **Description** | Some text description here. It will be merged into one line. | -| **Use Cases** | | -| **Data Needed** | | -| **Logging Policy** | | -| **Detection Rule** | | \ No newline at end of file diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0001_4688_windows_process_creation.md b/Atomic_Threat_Coverage/Data_Needed/DN0001_4688_windows_process_creation.md deleted file mode 100644 index 212c58c..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0001_4688_windows_process_creation.md +++ /dev/null @@ -1,58 +0,0 @@ -| Title | DN0001_4688_windows_process_creation | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | Windows process creation log, not including command line | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Windows Log | -| **Channel** | Security | -| **Provider** | Microsoft-Windows-Security-Auditing | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 4688 - 2 - 0 - 13312 - 0 - 0x8020000000000000 - - 2814 - - - Security - WIN-GG82ULGC9GO.contoso.local - - - - - S-1-5-18 - WIN-GG82ULGC9GO$ - CONTOSO - 0x3e7 - 0x2bc - C:\\Windows\\System32\\rundll32.exe - %%1938 - 0xe74 - S-1-5-21-1377283216-344919071-3415362939-1104 - dadmin - CONTOSO - 0x4a5af0 - C:\\Windows\\explorer.exe - S-1-16-8192 - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0002_4688_windows_process_creation_with_commandline.md b/Atomic_Threat_Coverage/Data_Needed/DN0002_4688_windows_process_creation_with_commandline.md deleted file mode 100644 index f47a708..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0002_4688_windows_process_creation_with_commandline.md +++ /dev/null @@ -1,59 +0,0 @@ -| Title | DN0002_4688_windows_process_creation_with_commandline | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | Windows process creation log, including command line | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Windows Log | -| **Channel** | Security | -| **Provider** | Microsoft-Windows-Security-Auditing | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 4688 - 2 - 0 - 13312 - 0 - 0x8020000000000000 - - 3542561 - - - Security - atc-win-10.atc.local - - - - - S-1-5-21-540864798-2899685673-3651185163-500 - user1 - atc-win-10 - 0xcdd96 - 0x12d0 - C:\Users\user1\Desktop\PSTools\PsExec64.exe - %%1936 - 0x21d4 - PsExec64.exe -i -s -d cmd - S-1-0-0 - - - - - 0x0 - C:\Windows\System32\cmd.exe - S-1-16-12288 - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0003_1_windows_sysmon_process_creation.md b/Atomic_Threat_Coverage/Data_Needed/DN0003_1_windows_sysmon_process_creation.md deleted file mode 100644 index 1080b5c..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0003_1_windows_sysmon_process_creation.md +++ /dev/null @@ -1,66 +0,0 @@ -| Title | DN0003_1_windows_sysmon_process_creation | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | Windows process creation log, including command line | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Applications and Services Logs | -| **Channel** | Microsoft-Windows-Sysmon/Operational | -| **Provider** | Microsoft-Windows-Sysmon | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 1 - 5 - 4 - 1 - 0 - 0x8000000000000000 - - 4219 - - - Microsoft-Windows-Sysmon/Operational - atc-win-10 - - - - - - 2019-07-09 03:44:58.036 - {717CFEC0-0DBA-5D24-0000-001087BC0800} - 5500 - C:\Windows\System32\conhost.exe - 10.0.14393.0 (rs1_release.160715-1616) - Console Window Host - Microsoft® Windows® Operating System - Microsoft Corporation - CONHOST.EXE - \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - C:\Windows - atc-win-10\yugoslavskiy - {717CFEC0-0DA0-5D24-0000-0020D0F50300} - 0x3f5d0 - 1 - Medium - MD5=D752C96401E2540A443C599154FC6FA9,SHA256=046F7A1B4DE67562547ED9A180A72F481FC41E803DE49A96D7D7C731964D53A0 - {717CFEC0-0DB9-5D24-0000-0010C9BB0800} - 4412 - C:\Windows\System32\cmd.exe - "C:\Windows\System32\cmd.exe" /q /c rmdir /s /q "C:\Users\yugoslavskiy\AppData\Local\Microsoft\OneDrive\19.086.0502.0006" - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0004_4624_windows_account_logon.md b/Atomic_Threat_Coverage/Data_Needed/DN0004_4624_windows_account_logon.md deleted file mode 100644 index 3588b26..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0004_4624_windows_account_logon.md +++ /dev/null @@ -1,71 +0,0 @@ -| Title | DN0004_4624_windows_account_logon | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | An account was successfully logged on | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Windows Log | -| **Channel** | Security | -| **Provider** | Microsoft-Windows-Security-Auditing | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 4624 - 2 - 0 - 12544 - 0 - 0x8020000000000000 - - 211 - - - Security - WIN-GG82ULGC9GO - - - - - S-1-5-18 - WIN-GG82ULGC9GO$ - WORKGROUP - 0x3e7 - S-1-5-21-1377283216-344919071-3415362939-500 - Administrator - WIN-GG82ULGC9GO - 0x8dcdc - 2 - User32 - Negotiate - WIN-GG82ULGC9GO - {00000000-0000-0000-0000-000000000000} - - - - - 0 - 0x44c - C:\\Windows\\System32\\svchost.exe - 127.0.0.1 - 0 - %%1833 - - - - - - - %%1843 - 0x0 - %%1842 - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0005_7045_windows_service_insatalled.md b/Atomic_Threat_Coverage/Data_Needed/DN0005_7045_windows_service_insatalled.md deleted file mode 100644 index 2013aa4..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0005_7045_windows_service_insatalled.md +++ /dev/null @@ -1,49 +0,0 @@ -| Title | DN0005_7045_windows_service_insatalled | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | A service was installed in the system | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Windows Log | -| **Channel** | System | -| **Provider** | Service Control Manager | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 7045 - 0 - 4 - 0 - 0 - 0x8080000000000000 - - 762 - - - System - DESKTOP - - - - - sshd - C:\Program Files\OpenSSH\sshd.exe - user mode service - demand start - LocalSystem - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0006_2_windows_sysmon_process_changed_a_file_creation_time.md b/Atomic_Threat_Coverage/Data_Needed/DN0006_2_windows_sysmon_process_changed_a_file_creation_time.md deleted file mode 100644 index 15caefa..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0006_2_windows_sysmon_process_changed_a_file_creation_time.md +++ /dev/null @@ -1,52 +0,0 @@ -| Title | DN0006_2_windows_sysmon_process_changed_a_file_creation_time | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | Explicit modification of file creation timestamp by a process | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Applications and Services Logs | -| **Channel** | Microsoft-Windows-Sysmon/Operational | -| **Provider** | Microsoft-Windows-Sysmon | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 2 - 4 - 4 - 2 - 0 - 0x8000000000000000 - - 6994 - - - Microsoft-Windows-Sysmon/Operational - atc-win-10.atc.local - - - - - - 2018-12-10 15:08:56.954 - {9683FBB1-8164-5C0E-0000-00104B532800} - 2788 - C:\Users\user1\AppData\Local\Temp\chocolatey\wireshark\2.6.5\Wireshark-win64-2.6.5.exe - C:\Program Files\Wireshark\user-guide.chm - 2018-11-28 18:37:08.000 - 2018-12-10 15:08:56.486 - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0007_3_windows_sysmon_network_connection.md b/Atomic_Threat_Coverage/Data_Needed/DN0007_3_windows_sysmon_network_connection.md deleted file mode 100644 index 7137a58..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0007_3_windows_sysmon_network_connection.md +++ /dev/null @@ -1,62 +0,0 @@ -| Title | DN0007_3_windows_sysmon_network_connection | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | TCP/UDP connections made by a process | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Applications and Services Logs | -| **Channel** | Microsoft-Windows-Sysmon/Operational | -| **Provider** | Microsoft-Windows-Sysmon | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 3 - 5 - 4 - 3 - 0 - 0x8000000000000000 - - 16000 - - - Microsoft-Windows-Sysmon/Operational - ATC-WIN-7.atc.local - - - - - - 2019-02-05 15:16:17.411 - {A96EFBF1-A8C9-5C59-0000-0010D274D300} - 3900 - C:\Users\user1\Desktop\SysinternalsSuite\PsExec.exe - ATC-WIN-7\user1 - tcp - true - false - 10.0.0.111 - ATC-WIN-7.atc.local - 49603 - - false - 10.0.0.103 - ATC-WIN-10 - 135 - epmap - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0008_4_windows_sysmon_sysmon_service_state_changed.md b/Atomic_Threat_Coverage/Data_Needed/DN0008_4_windows_sysmon_sysmon_service_state_changed.md deleted file mode 100644 index b31e8f8..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0008_4_windows_sysmon_sysmon_service_state_changed.md +++ /dev/null @@ -1,48 +0,0 @@ -| Title | DN0008_4_windows_sysmon_sysmon_service_state_changed | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | Sysmon service changed status | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Applications and Services Logs | -| **Channel** | Microsoft-Windows-Sysmon/Operational | -| **Provider** | Microsoft-Windows-Sysmon | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 4 - 3 - 4 - 4 - 0 - 0x8000000000000000 - - 45818 - - - Microsoft-Windows-Sysmon/Operational - atc-win-10.atc.local - - - - - 2019-02-05 13:11:20.281 - Started - 8.00 - 4.10 - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0009_5_windows_sysmon_process_terminated.md b/Atomic_Threat_Coverage/Data_Needed/DN0009_5_windows_sysmon_process_terminated.md deleted file mode 100644 index 3e062d2..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0009_5_windows_sysmon_process_terminated.md +++ /dev/null @@ -1,49 +0,0 @@ -| Title | DN0009_5_windows_sysmon_process_terminated | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | Process has been terminated | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Applications and Services Logs | -| **Channel** | Microsoft-Windows-Sysmon/Operational | -| **Provider** | Microsoft-Windows-Sysmon | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 5 - 3 - 4 - 5 - 0 - 0x8000000000000000 - - 57994 - - - Microsoft-Windows-Sysmon/Operational - atc-win-10.atc.local - - - - - - 2019-02-05 15:16:38.821 - {9683FBB1-A8D6-5C59-0000-001009797000} - 2440 - C:\Windows\PSEXESVC.exe - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0010_6_windows_sysmon_driver_loaded.md b/Atomic_Threat_Coverage/Data_Needed/DN0010_6_windows_sysmon_driver_loaded.md deleted file mode 100644 index c02c228..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0010_6_windows_sysmon_driver_loaded.md +++ /dev/null @@ -1,51 +0,0 @@ -| Title | DN0010_6_windows_sysmon_driver_loaded | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | The driver loaded events provides information about a driver being loaded on the system. The configured hashes are provided as well as signature information | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Applications and Services Logs | -| **Channel** | Microsoft-Windows-Sysmon/Operational | -| **Provider** | Microsoft-Windows-Sysmon | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 6 - 3 - 4 - 6 - 0 - 0x8000000000000000 - - 4565 - - - Microsoft-Windows-Sysmon/Operational - atc-win-10 - - - - - - 2018-12-09 21:41:41.091 - C:\Windows\System32\drivers\PROCEXP152.SYS - MD5=8213C5972C91A56BE78CD02A4DE4E3FC,SHA256=95D07C3B8DF26790AC43BB4259F65D1E90B03EA31D66F1B3961D85E21C5FF590 - true - Sysinternals - Valid - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0011_7_windows_sysmon_image_loaded.md b/Atomic_Threat_Coverage/Data_Needed/DN0011_7_windows_sysmon_image_loaded.md deleted file mode 100644 index 2aeb564..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0011_7_windows_sysmon_image_loaded.md +++ /dev/null @@ -1,59 +0,0 @@ -| Title | DN0011_7_windows_sysmon_image_loaded | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | The image loaded event logs when a module is loaded in a specific process | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Applications and Services Logs | -| **Channel** | Microsoft-Windows-Sysmon/Operational | -| **Provider** | Microsoft-Windows-Sysmon | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 7 - 3 - 4 - 7 - 0 - 0x8000000000000000 - - 9146 - - - Microsoft-Windows-Sysmon/Operational - atc-win-10 - - - - - - 2019-07-09 04:13:59.602 - {717CFEC0-1487-5D24-0000-00103F202900} - 2352 - C:\Windows\System32\sihost.exe - C:\Windows\System32\msvcrt.dll - 7.0.14393.0 (rs1_release.160715-1616) - Windows NT CRT DLL - Microsoft® Windows® Operating System - Microsoft Corporation - msvcrt.dll - MD5=94EF9321C287FC1B179419E662996A41,SHA256=555B434EC9E8628820905A8F1D7BC7F8EE99C6D44A01892ADD16E39E6B675A0D - true - Microsoft Windows - Valid - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0012_8_windows_sysmon_CreateRemoteThread.md b/Atomic_Threat_Coverage/Data_Needed/DN0012_8_windows_sysmon_CreateRemoteThread.md deleted file mode 100644 index cd7356d..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0012_8_windows_sysmon_CreateRemoteThread.md +++ /dev/null @@ -1,55 +0,0 @@ -| Title | DN0012_8_windows_sysmon_CreateRemoteThread | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | The CreateRemoteThread event detects when a process creates a thread in another process | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Applications and Services Logs | -| **Channel** | Microsoft-Windows-Sysmon/Operational | -| **Provider** | Microsoft-Windows-Sysmon | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 8 - 2 - 4 - 8 - 0 - 0x8000000000000000 - - 739823 - - - Microsoft-Windows-Sysmon/Operational - atc-win-10.atc.local - - - - - 2017-05-13 22:53:43.214 - {A23EAE89-8E6D-5917-0000-0010DFAF5004} - 8804 - C:\Program Files (x86)\Microsoft Visual Studio 14.0\Common7\IDE\Remote Debugger\x64\msvsmon.exe - {A23EAE89-8E5A-5917-0000-00100E3E4D04} - 2024 - C:\repos\Supercharger\Mtg.Supercharger.ControllerService\bin\x64\Debug\Mtg.Supercharger.ControllerService.exe - 20532 - 0x00007FFB09321970 - C:\Windows\SYSTEM32\ntdll.dll - DbgUiRemoteBreakin - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0013_9_windows_sysmon_RawAccessRead.md b/Atomic_Threat_Coverage/Data_Needed/DN0013_9_windows_sysmon_RawAccessRead.md deleted file mode 100644 index dfa3fa3..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0013_9_windows_sysmon_RawAccessRead.md +++ /dev/null @@ -1,49 +0,0 @@ -| Title | DN0013_9_windows_sysmon_RawAccessRead | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | The RawAccessRead event detects when a process conducts reading operations from the drive using the \\.\ denotation | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Applications and Services Logs | -| **Channel** | Microsoft-Windows-Sysmon/Operational | -| **Provider** | Microsoft-Windows-Sysmon | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 9 - 2 - 4 - 9 - 0 - 0x8000000000000000 - - 1944686 - - - Microsoft-Windows-Sysmon/Operational - atc-win-10.atc.local - - - - - 2018-03-22 20:32:22.332 - {A23EAE89-C65F-5AB2-0000-0010EB030000} - 4 - System - \Device\HarddiskVolume2 - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0014_10_windows_sysmon_ProcessAccess.md b/Atomic_Threat_Coverage/Data_Needed/DN0014_10_windows_sysmon_ProcessAccess.md deleted file mode 100644 index c84e166..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0014_10_windows_sysmon_ProcessAccess.md +++ /dev/null @@ -1,55 +0,0 @@ -| Title | DN0014_10_windows_sysmon_ProcessAccess | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | The process accessed event reports when a process opens another process, an operation that’s often followed by information queries or reading and writing the address space of the target process | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Applications and Services Logs | -| **Channel** | Microsoft-Windows-Sysmon/Operational | -| **Provider** | Microsoft-Windows-Sysmon | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 10 - 3 - 4 - 10 - 0 - 0x8000000000000000 - - 42444 - - - Microsoft-Windows-Sysmon/Operational - atc-win-10.atc.local - - - - - - 2019-01-30 14:28:35.212 - {9683FBB1-B470-5C51-0000-0010521EBB00} - 6916 - 8080 - C:\Users\user1\Desktop\mimi\x64\mimikatz.exe - {9683FBB1-9A52-5C51-0000-0010C3610000} - 672 - C:\windows\system32\lsass.exe - 0x1010 - C:\windows\SYSTEM32\ntdll.dll+9a3c4|C:\windows\System32\KERNELBASE.dll+2fd5d|C:\Users\user1\Desktop\mimi\x64\mimikatz.exe+7a906|C:\Users\user1\Desktop\mimi\x64\mimikatz.exe+7ac75|C:\Users\user1\Desktop\mimi\x64\mimikatz.exe+7a82d|C:\Users\user1\Desktop\mimi\x64\mimikatz.exe+4d28c|C:\Users\user1\Desktop\mimi\x64\mimikatz.exe+4d0c4|C:\Users\user1\Desktop\mimi\x64\mimikatz.exe+4cea1|C:\Users\user1\Desktop\mimi\x64\mimikatz.exe+80675|C:\windows\System32\KERNEL32.DLL+13034|C:\windows\SYSTEM32\ntdll.dll+71471 - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0015_11_windows_sysmon_FileCreate.md b/Atomic_Threat_Coverage/Data_Needed/DN0015_11_windows_sysmon_FileCreate.md deleted file mode 100644 index d30304b..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0015_11_windows_sysmon_FileCreate.md +++ /dev/null @@ -1,51 +0,0 @@ -| Title | DN0015_11_windows_sysmon_FileCreate | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | File create operations are logged when a file is created or overwritten. This event is useful for monitoring autostart locations, like the Startup folder, as well as temporary and download directories, which are common places malware drops during initial infection | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Applications and Services Logs | -| **Channel** | Microsoft-Windows-Sysmon/Operational | -| **Provider** | Microsoft-Windows-Sysmon | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 11 - 2 - 4 - 11 - 0 - 0x8000000000000000 - - 42528 - - - Microsoft-Windows-Sysmon/Operational - atc-win-10.atc.local - - - - - - 2019-01-30 15:08:51.287 - {9683FBB1-9A3F-5C51-0000-0010EB030000} - 4 - System - C:\Windows\PSEXESVC.exe - 2019-01-30 15:08:51.287 - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0016_12_windows_sysmon_RegistryEvent.md b/Atomic_Threat_Coverage/Data_Needed/DN0016_12_windows_sysmon_RegistryEvent.md deleted file mode 100644 index 9f8568f..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0016_12_windows_sysmon_RegistryEvent.md +++ /dev/null @@ -1,51 +0,0 @@ -| Title | DN0016_12_windows_sysmon_RegistryEvent | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | Registry key and value create and delete operations map to this event type, which can be useful for monitoring for changes to Registry autostart locations, or specific malware registry modifications | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Applications and Services Logs | -| **Channel** | Microsoft-Windows-Sysmon/Operational | -| **Provider** | Microsoft-Windows-Sysmon | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 12 - 2 - 4 - 12 - 0 - 0x8000000000000000 - - 42938 - - - Microsoft-Windows-Sysmon/Operational - atc-win-10.atc.local - - - - - - DeleteKey - 2019-01-30 17:05:28.023 - {9683FBB1-D812-5C51-0000-0010F3871201} - 10396 - C:\Windows\regedit.exe - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\New Key #1 - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0017_13_windows_sysmon_RegistryEvent.md b/Atomic_Threat_Coverage/Data_Needed/DN0017_13_windows_sysmon_RegistryEvent.md deleted file mode 100644 index 83e6d8d..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0017_13_windows_sysmon_RegistryEvent.md +++ /dev/null @@ -1,52 +0,0 @@ -| Title | DN0017_13_windows_sysmon_RegistryEvent | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | This Registry event type identifies Registry value modifications. The event records the value written for Registry values of type DWORD and QWORD | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Applications and Services Logs | -| **Channel** | Microsoft-Windows-Sysmon/Operational | -| **Provider** | Microsoft-Windows-Sysmon | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 13 - 2 - 4 - 13 - 0 - 0x8000000000000000 - - 42943 - - - Microsoft-Windows-Sysmon/Operational - atc-win-10.atc.local - - - - - - SetValue - 2019-01-30 17:06:11.673 - {9683FBB1-D812-5C51-0000-0010F3871201} - 10396 - C:\Windows\regedit.exe - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\New Value #1 - C:\Program Files\Sublime Text 3\sublime_text.exe - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0018_14_windows_sysmon_RegistryEvent.md b/Atomic_Threat_Coverage/Data_Needed/DN0018_14_windows_sysmon_RegistryEvent.md deleted file mode 100644 index afc81d3..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0018_14_windows_sysmon_RegistryEvent.md +++ /dev/null @@ -1,52 +0,0 @@ -| Title | DN0018_14_windows_sysmon_RegistryEvent | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | Registry key and value rename operations map to this event type, recording the new name of the key or value that was renamed | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Applications and Services Logs | -| **Channel** | Microsoft-Windows-Sysmon/Operational | -| **Provider** | Microsoft-Windows-Sysmon | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 14 - 2 - 4 - 14 - 0 - 0x8000000000000000 - - 43065 - - - Microsoft-Windows-Sysmon/Operational - atc-win-10.atc.local - - - - - - RenameKey - 2019-01-30 18:16:38.886 - {9683FBB1-D812-5C51-0000-0010F3871201} - 10396 - C:\Windows\regedit.exe - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\New Key #1 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\New Key #2 - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0019_15_windows_sysmon_FileCreateStreamHash.md b/Atomic_Threat_Coverage/Data_Needed/DN0019_15_windows_sysmon_FileCreateStreamHash.md deleted file mode 100644 index 6d91994..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0019_15_windows_sysmon_FileCreateStreamHash.md +++ /dev/null @@ -1,52 +0,0 @@ -| Title | DN0019_15_windows_sysmon_FileCreateStreamHash | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | This event logs when a named file stream is created, and it generates events that log the hash of the contents of the file to which the stream is assigned (the unnamed stream), as well as the contents of the named stream | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Applications and Services Logs | -| **Channel** | Microsoft-Windows-Sysmon/Operational | -| **Provider** | Microsoft-Windows-Sysmon | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 15 - 2 - 4 - 15 - 0 - 0x8000000000000000 - - 34115 - - - Microsoft-Windows-Sysmon/Operational - atc-win-10.atc.local - - - - - - 2019-01-21 12:43:53.368 - {9683FBB1-A860-5C45-0000-0010274F1400} - 6604 - C:\windows\Explorer.EXE - C:\Users\user1\Downloads\wce_v1_42beta_x64\wce.exe - 2013-11-11 22:41:40.000 - MD5=CCF1D1573F175299ADE01C07791A6541,SHA256=68A15A34C2E28B9B521A240B948634617D72AD619E3950BC6DC769E60A0C3CF2 - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0020_17_windows_sysmon_PipeEvent.md b/Atomic_Threat_Coverage/Data_Needed/DN0020_17_windows_sysmon_PipeEvent.md deleted file mode 100644 index 09540d2..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0020_17_windows_sysmon_PipeEvent.md +++ /dev/null @@ -1,51 +0,0 @@ -| Title | DN0020_17_windows_sysmon_PipeEvent | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | This event generates when a named pipe is created. Malware often uses named pipes for interprocess communication | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Applications and Services Logs | -| **Channel** | Microsoft-Windows-Sysmon/Operational | -| **Provider** | Microsoft-Windows-Sysmon | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 17 - 1 - 4 - 17 - 0 - 0x8000000000000000 - - 14921 - - - Microsoft-Windows-Sysmon/Operational - atc-win-10 - - - - - - CreatePipe - 2019-07-09 04:21:39.850 - {717CFEC0-1651-5D24-0000-00109AFB3E00} - 5624 - \mojo.5624.7020.12775972776436680360 - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0021_18_windows_sysmon_PipeEvent.md b/Atomic_Threat_Coverage/Data_Needed/DN0021_18_windows_sysmon_PipeEvent.md deleted file mode 100644 index 81b2799..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0021_18_windows_sysmon_PipeEvent.md +++ /dev/null @@ -1,51 +0,0 @@ -| Title | DN0021_18_windows_sysmon_PipeEvent | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | This event logs when a named pipe connection is made between a client and a server | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Applications and Services Logs | -| **Channel** | Microsoft-Windows-Sysmon/Operational | -| **Provider** | Microsoft-Windows-Sysmon | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 18 - 1 - 4 - 18 - 0 - 0x8000000000000000 - - 15894 - - - Microsoft-Windows-Sysmon/Operational - atc-win-10 - - - - - - ConnectPipe - 2019-07-09 04:22:41.814 - {717CFEC0-1691-5D24-0000-0010663D4100} - 6376 - \crashpad_5624_JOJRKPKWKSIWYAIJ - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0022_19_windows_sysmon_WmiEvent.md b/Atomic_Threat_Coverage/Data_Needed/DN0022_19_windows_sysmon_WmiEvent.md deleted file mode 100644 index 9b0646a..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0022_19_windows_sysmon_WmiEvent.md +++ /dev/null @@ -1,52 +0,0 @@ -| Title | DN0022_19_windows_sysmon_WmiEvent | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | When a WMI event filter is registered, which is a method used by malware to execute, this event logs the WMI namespace, filter name and filter expression | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Applications and Services Logs | -| **Channel** | Microsoft-Windows-Sysmon/Operational | -| **Provider** | Microsoft-Windows-Sysmon | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 19 - 3 - 4 - 19 - 0 - 0x8000000000000000 - - 46712 - - - Microsoft-Windows-Sysmon/Operational - atc-win-10.atc.local - - - - - - WmiFilterEvent - 2019-02-05 14:44:42.432 - Created - atc-win-10\user1 - "root\\CimV2" - "AtomicRedTeam-WMIPersistence-Example" - "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' AND TargetInstance.SystemUpTime >= 240 AND TargetInstance.SystemUpTime < 325" - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0023_20_windows_sysmon_WmiEvent.md b/Atomic_Threat_Coverage/Data_Needed/DN0023_20_windows_sysmon_WmiEvent.md deleted file mode 100644 index b0cec1f..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0023_20_windows_sysmon_WmiEvent.md +++ /dev/null @@ -1,52 +0,0 @@ -| Title | DN0023_20_windows_sysmon_WmiEvent | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | This event logs the registration of WMI consumers, recording the consumer name, log, and destination | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Applications and Services Logs | -| **Channel** | Microsoft-Windows-Sysmon/Operational | -| **Provider** | Microsoft-Windows-Sysmon | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 20 - 3 - 4 - 20 - 0 - 0x8000000000000000 - - 46713 - - - Microsoft-Windows-Sysmon/Operational - atc-win-10.atc.local - - - - - - WmiConsumerEvent - 2019-02-05 14:44:42.510 - Created - atc-win-10\user1 - "AtomicRedTeam-WMIPersistence-Example" - Command Line - "C:\\windows\\System32\\notepad.exe" - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0024_21_windows_sysmon_WmiEvent.md b/Atomic_Threat_Coverage/Data_Needed/DN0024_21_windows_sysmon_WmiEvent.md deleted file mode 100644 index 3f81cf4..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0024_21_windows_sysmon_WmiEvent.md +++ /dev/null @@ -1,51 +0,0 @@ -| Title | DN0024_21_windows_sysmon_WmiEvent | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | When a consumer binds to a filter, this event logs the consumer name and filter path | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Applications and Services Logs | -| **Channel** | Microsoft-Windows-Sysmon/Operational | -| **Provider** | Microsoft-Windows-Sysmon | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 21 - 3 - 4 - 21 - 0 - 0x8000000000000000 - - 46714 - - - Microsoft-Windows-Sysmon/Operational - atc-win-10.atc.local - - - - - - WmiBindingEvent - 2019-02-05 14:44:47.087 - Created - atc-win-10\user1 - "\\\\.\\ROOT\\subscription:CommandLineEventConsumer.Name=\"AtomicRedTeam-WMIPersistence-Example\"" - "\\\\.\\ROOT\\subscription:__EventFilter.Name=\"AtomicRedTeam-WMIPersistence-Example\"" - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0026_5136_windows_directory_service_object_was_modified.md b/Atomic_Threat_Coverage/Data_Needed/DN0026_5136_windows_directory_service_object_was_modified.md deleted file mode 100644 index 7ceb470..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0026_5136_windows_directory_service_object_was_modified.md +++ /dev/null @@ -1,59 +0,0 @@ -| Title | DN0026_5136_windows_directory_service_object_was_modified | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | A directory service object was modified | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Windows Log | -| **Channel** | Security | -| **Provider** | Microsoft-Windows-Security-Auditing | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 5136 - 0 - 0 - 14081 - 0 - 0x8020000000000000 - - 410204 - - - Security - DC01.contoso.local - - - - - {02647639-8626-43CE-AFE6-7AA1AD657739} - - - S-1-5-21-3457937927-2839227994-823803824-1104 - dadmin - CONTOSO - 0x32004 - contoso.local - %%14676 - CN=Sergey,CN=Builtin,DC=contoso,DC=local - {4FE80A66-5F93-4F73-B215-68678058E613} - user - userAccountControl - 2.5.5.9 - 512 - %%14675 - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0027_4738_user_account_was_changed.md b/Atomic_Threat_Coverage/Data_Needed/DN0027_4738_user_account_was_changed.md deleted file mode 100644 index 195a749..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0027_4738_user_account_was_changed.md +++ /dev/null @@ -1,70 +0,0 @@ -| Title | DN0027_4738_user_account_was_changed | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | User object is changed | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Windows Log | -| **Channel** | Security | -| **Provider** | Microsoft-Windows-Security-Auditing | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 4738 - 0 - 0 - 13824 - 0 - 0x8020000000000000 - - 175413 - - - Security - DC01.contoso.local - - - - - ksmith - CONTOSO - S-1-5-21-3457937927-2839227994-823803824-6609 - S-1-5-21-3457937927-2839227994-823803824-1104 - dadmin - CONTOSO - 0x30dc2 - - - - - - - - - - - - - - - - - - - - - - - - - - - 0x15 - 0x211 - %%2050 %%2089 - - - - - - - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0028_4794_directory_services_restore_mode_admin_password_set.md b/Atomic_Threat_Coverage/Data_Needed/DN0028_4794_directory_services_restore_mode_admin_password_set.md deleted file mode 100644 index f78c1ea..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0028_4794_directory_services_restore_mode_admin_password_set.md +++ /dev/null @@ -1,50 +0,0 @@ -| Title | DN0028_4794_directory_services_restore_mode_admin_password_set | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | Directory Services Restore Mode (DSRM) administrator password is changed | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Windows Log | -| **Channel** | Security | -| **Provider** | Microsoft-Windows-Security-Auditing | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 4794 - 0 - 0 - 13824 - 0 - 0x8020000000000000 - - 172348 - - - Security - DC01.contoso.local - - - - - S-1-5-21-3457937927-2839227994-823803824-1104 - dadmin - CONTOSO - 0x36f67 - DC01 - 0x0 - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0029_4661_handle_to_an_object_was_requested.md b/Atomic_Threat_Coverage/Data_Needed/DN0029_4661_handle_to_an_object_was_requested.md deleted file mode 100644 index 185986a..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0029_4661_handle_to_an_object_was_requested.md +++ /dev/null @@ -1,60 +0,0 @@ -| Title | DN0029_4661_handle_to_an_object_was_requested | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | A handle was requested for either an Active Directory object or a Security Account Manager (SAM) object | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Windows Log | -| **Channel** | Security | -| **Provider** | Microsoft-Windows-Security-Auditing | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 4661 - 0 - 0 - 14080 - 0 - 0x8020000000000000 - - 1048009 - - - Security - DC01.contoso.local - - - - - S-1-5-21-3457937927-2839227994-823803824-1104 - dadmin - CONTOSO - 0x4280e - Security Account Manager - SAM\_DOMAIN - DC=contoso,DC=local - 0xdd64d36870 - {00000000-0000-0000-0000-000000000000} - %%5400 - 0x2d - Ā - - - 2949165 - 0x9000a000d002d - {bf967a90-0de6-11d0-a285-00aa003049e2} %%5400 {ccc2dc7d-a6ad-4a7a-8846-c04e3cc53501} - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0030_4662_operation_was_performed_on_an_object.md b/Atomic_Threat_Coverage/Data_Needed/DN0030_4662_operation_was_performed_on_an_object.md deleted file mode 100644 index db8da0c..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0030_4662_operation_was_performed_on_an_object.md +++ /dev/null @@ -1,58 +0,0 @@ -| Title | DN0030_4662_operation_was_performed_on_an_object | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | An operation was performed on an Active Directory object | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Windows Log | -| **Channel** | Security | -| **Provider** | Microsoft-Windows-Security-Auditing | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 4662 - 0 - 0 - 14080 - 0 - 0x8020000000000000 - - 407230 - - - Security - DC01.contoso.local - - - - - S-1-5-21-3457937927-2839227994-823803824-1104 - dadmin - CONTOSO - 0x35867 - DS - %{bf967a86-0de6-11d0-a285-00aa003049e2} - %{38b3d2e6-9948-4dc1-ae90-1605d5eab9a2} - Object Access - 0x0 - %%1537 - 0x10000 - %%1537 {bf967a86-0de6-11d0-a285-00aa003049e2} - - - - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0031_7036_service_started_stopped.md b/Atomic_Threat_Coverage/Data_Needed/DN0031_7036_service_started_stopped.md deleted file mode 100644 index 00a03c7..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0031_7036_service_started_stopped.md +++ /dev/null @@ -1,47 +0,0 @@ -| Title | DN0031_7036_service_started_stopped | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | Service entered the running/stopped state | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Windows Log | -| **Channel** | System | -| **Provider** | Service Control Manager | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 7036 - 0 - 4 - 0 - 0 - 0x8080000000000000 - - 41452 - - - System - EC2AMAZ-D6OFVS8 - - - - - Device Install Service - running - 44006500760069006300650049006E007300740061006C006C002F0034000000 - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0032_5145_network_share_object_was_accessed_detailed.md b/Atomic_Threat_Coverage/Data_Needed/DN0032_5145_network_share_object_was_accessed_detailed.md deleted file mode 100644 index 83b46e3..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0032_5145_network_share_object_was_accessed_detailed.md +++ /dev/null @@ -1,57 +0,0 @@ -| Title | DN0032_5145_network_share_object_was_accessed_detailed | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | Network share object (file or folder) was accessed. Detailed log with AccessReason and RelativeTargetName | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Windows Log | -| **Channel** | Security | -| **Provider** | Microsoft-Windows-Security-Auditing | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 5145 - 0 - 0 - 12811 - 0 - 0x8020000000000000 - - 267092 - - - Security - DC01.contoso.local - - - - - S-1-5-21-3457937927-2839227994-823803824-1104 - dadmin - CONTOSO - 0x38d34 - File - fe80::31ea:6c3c:f40d:1973 - 56926 - \\\\\*\\Documents - \\??\\C:\\Documents - Bginfo.exe - 0x100081 - %%1541 %%4416 %%4423 - %%1541: %%1801 D:(A;;FA;;;WD) %%4416: %%1801 D:(A;;FA;;;WD) %%4423: %%1801 D:(A;;FA;;;WD) - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0033_5140_network_share_object_was_accessed.md b/Atomic_Threat_Coverage/Data_Needed/DN0033_5140_network_share_object_was_accessed.md deleted file mode 100644 index 37856d1..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0033_5140_network_share_object_was_accessed.md +++ /dev/null @@ -1,55 +0,0 @@ -| Title | DN0033_5140_network_share_object_was_accessed | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | Network share object (file or folder) was accessed | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Windows Log | -| **Channel** | Security | -| **Provider** | Microsoft-Windows-Security-Auditing | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 5140 - 1 - 0 - 12808 - 0 - 0x8020000000000000 - - 268495 - - - Security - DC01.contoso.local - - - - - S-1-5-21-3457937927-2839227994-823803824-1104 - dadmin - CONTOSO - 0x541f35 - File - 10.0.0.100 - 49212 - \\\\\*\\Documents - \\??\\C:\\Documents - 0x1 - %%4416 - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0034_104_log_file_was_cleared.md b/Atomic_Threat_Coverage/Data_Needed/DN0034_104_log_file_was_cleared.md deleted file mode 100644 index d58fcec..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0034_104_log_file_was_cleared.md +++ /dev/null @@ -1,50 +0,0 @@ -| Title | DN0034_104_log_file_was_cleared | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | Windows log file was cleared | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Windows Log | -| **Channel** | System | -| **Provider** | Microsoft-Windows-Eventlog | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 104 - 0 - 4 - 104 - 0 - 0x8000000000000000 - - 7659 - - - System - ATC-WIN-7.atc.local - - - - - - - user1 - ATC-WIN-7.atc.local - Application - - - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0035_106_task_scheduler_task_registered.md b/Atomic_Threat_Coverage/Data_Needed/DN0035_106_task_scheduler_task_registered.md deleted file mode 100644 index 66557b9..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0035_106_task_scheduler_task_registered.md +++ /dev/null @@ -1,46 +0,0 @@ -| Title | DN0035_106_task_scheduler_task_registered | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | General Windows Task Registration | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Applications and Services Logs | -| **Channel** | Microsoft-Windows-TaskScheduler/Operational | -| **Provider** | Microsoft-Windows-TaskScheduler | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 106 - 0 - 4 - 106 - 0 - 0x8000000000000000 - - 5 - - - Microsoft-Windows-TaskScheduler/Operational - atc-win-10.atc.local - - - - - \atctest - atc-win-10.atc.local\user1 - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0036_4104_windows_powershell_script_block.md b/Atomic_Threat_Coverage/Data_Needed/DN0036_4104_windows_powershell_script_block.md deleted file mode 100644 index c360446..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0036_4104_windows_powershell_script_block.md +++ /dev/null @@ -1,49 +0,0 @@ -| Title | DN0036_4104_windows_powershell_script_block | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | This event records script | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Applications and Services Logs | -| **Channel** | Microsoft-Windows-PowerShell/Operational | -| **Provider** | Microsoft-Windows-PowerShell | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 4104 - 1 - 5 - 2 - 15 - 0x0 - - 75823 - - - Microsoft-Windows-PowerShell/Operational - atc-win-10.atc.local - - - - - 1 - 1 - $FilterArgs = @{name='AtomicRedTeam-WMIPersistence-Example'; EventNameSpace='root\CimV2'; QueryLanguage="WQL"; Query="SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' AND TargetInstance.SystemUpTime >= 240 AND TargetInstance.SystemUpTime < 325"}; $Filter=New-CimInstance -Namespace root/subscription -ClassName __EventFilter -Property $FilterArgs $ConsumerArgs = @{name='AtomicRedTeam-WMIPersistence-Example'; CommandLineTemplate="$($Env:SystemRoot)\System32\notepad.exe";} $Consumer=New-CimInstance -Namespace root/subscription -ClassName CommandLineEventConsumer -Property $ConsumerArgs $FilterToConsumerArgs = @{ Filter = [Ref] $Filter; Consumer = [Ref] $Consumer; } $FilterToConsumerBinding = New-CimInstance -Namespace root/subscription -ClassName __FilterToConsumerBinding -Property $FilterToConsumerArgs - 414c1110-3b57-40bf-9502-e45053cce9dd - - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0037_4103_windows_powershell_executing_pipeline.md b/Atomic_Threat_Coverage/Data_Needed/DN0037_4103_windows_powershell_executing_pipeline.md deleted file mode 100644 index c35e3e4..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0037_4103_windows_powershell_executing_pipeline.md +++ /dev/null @@ -1,47 +0,0 @@ -| Title | DN0037_4103_windows_powershell_executing_pipeline | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | This event records pipeline execution, including variable initialization and command command invocations. | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Applications and Services Logs | -| **Channel** | Microsoft-Windows-PowerShell/Operational | -| **Provider** | Microsoft-Windows-PowerShell | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 4103 - 1 - 4 - 106 - 20 - 0x0 - - 75824 - - - Microsoft-Windows-PowerShell/Operational - atc-win-10.atc.local - - - - - Severity = Informational Host Name = ConsoleHost Host Version = 5.1.17134.407 Host ID = 3ff2018b-ab29-4049-a62d-851e5ca931ed Host Application = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Engine Version = 5.1.17134.407 Runspace ID = 52c750e1-1c34-4244-a6eb-feadfd70a959 Pipeline ID = 90 Command Name = New-CimInstance Command Type = Cmdlet Script Name = Command Path = Sequence Number = 329 User = atc-win-10\user1 Connected User = Shell ID = Microsoft.PowerShell - - CommandInvocation(New-CimInstance): "New-CimInstance" ParameterBinding(New-CimInstance): name="Namespace"; value="root/subscription" ParameterBinding(New-CimInstance): name="ClassName"; value="__EventFilter" ParameterBinding(New-CimInstance): name="Property"; value="System.Collections.Hashtable" - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0038_400_engine_state_is_changed_from_none_to_available.md b/Atomic_Threat_Coverage/Data_Needed/DN0038_400_engine_state_is_changed_from_none_to_available.md deleted file mode 100644 index 81eae9b..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0038_400_engine_state_is_changed_from_none_to_available.md +++ /dev/null @@ -1,42 +0,0 @@ -| Title | DN0038_400_engine_state_is_changed_from_none_to_available | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | Information about PowerShell engine state. Engine state is changed from None to Available | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Applications and Services Logs | -| **Channel** | Windows PowerShell | -| **Provider** | PowerShell | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 400 - 4 - 4 - 0x80000000000000 - - 50575 - Windows PowerShell - atc-win-10.atc.local - - - - - Available - None - NewEngineState=Available PreviousEngineState=None SequenceNumber=13 HostName=Windows PowerShell ISE Host HostVersion=5.1.17134.407 HostId=9478b487-c2ea-4aa8-8eb3-9b7bad25b39f HostApplication=C:\windows\system32\WindowsPowerShell\v1.0\PowerShell_ISE.exe EngineVersion=5.1.17134.407 RunspaceId=9f89fa00-ca26-402e-9dea-29c6d2447f7b PipelineId= CommandName= CommandType= ScriptName= CommandPath= CommandLine= - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0039_524_system_catalog_has_been_deleted.md b/Atomic_Threat_Coverage/Data_Needed/DN0039_524_system_catalog_has_been_deleted.md deleted file mode 100644 index f23b227..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0039_524_system_catalog_has_been_deleted.md +++ /dev/null @@ -1,43 +0,0 @@ -| Title | DN0039_524_system_catalog_has_been_deleted | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | The System Catalog has been deleted | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Applications and Services Logs | -| **Channel** | Application | -| **Provider** | Microsoft-Windows-Backup | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 524 - 0 - 4 - 0 - 0 - 0x8000000000000000 - - 457 - - - Application - atc-win-2k12.atc.lab - - - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0040_528_user_successfully_logged_on_to_a_computer.md b/Atomic_Threat_Coverage/Data_Needed/DN0040_528_user_successfully_logged_on_to_a_computer.md deleted file mode 100644 index f9c0042..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0040_528_user_successfully_logged_on_to_a_computer.md +++ /dev/null @@ -1,40 +0,0 @@ -| Title | DN0040_528_user_successfully_logged_on_to_a_computer | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | User successfully logged on to a computer | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Windows Log | -| **Channel** | Security | -| **Provider** | Microsoft-Windows-Security-Auditing | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -2019-07-15 21:44:17 ATC AUDIT_SUCCESS 528 ATC\Administrator Successful Logon: - User Name: Administrator - Domain: ATC - Logon ID: (0x0,0x5A53F) - Logon Type: 2 - Logon Process: User32 - Authentication Package: Negotiate - Workstation Name: ATC - Logon GUID: - - Caller User Name: ATC$ - Caller Domain: WORKGROUP - Caller Logon ID: (0x0,0x3E7) - Caller Process ID: 380 - Transited Services: - - Source Network Address: 127.0.0.1 - Source Port: 0 - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0041_529_logon_failure.md b/Atomic_Threat_Coverage/Data_Needed/DN0041_529_logon_failure.md deleted file mode 100644 index 2bf3792..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0041_529_logon_failure.md +++ /dev/null @@ -1,39 +0,0 @@ -| Title | DN0041_529_logon_failure | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | Logon Failure - Unknown user name or bad password | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Windows Log | -| **Channel** | Security | -| **Provider** | Microsoft-Windows-Security-Auditing | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -2019-07-15 22:00:20 ATC AUDIT_FAILURE 529 NT AUTHORITY\SYSTEM Logon Failure: - Reason: Unknown user name or bad password - User Name: asdfasd - Domain: ATC - Logon Type: 10 - Logon Process: User32 - Authentication Package: Negotiate - Workstation Name: ATC - Caller User Name: ATC$ - Caller Domain: WORKGROUP - Caller Logon ID: (0x0,0x3E7) - Caller Process ID: 3064 - Transited Services: - - Source Network Address: 192.168.88.198 - Source Port: 52013 - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0042_675_kerberos_preauthentication_failed.md b/Atomic_Threat_Coverage/Data_Needed/DN0042_675_kerberos_preauthentication_failed.md deleted file mode 100644 index 233d912..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0042_675_kerberos_preauthentication_failed.md +++ /dev/null @@ -1,31 +0,0 @@ -| Title | DN0042_675_kerberos_preauthentication_failed | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | Kerberos pre-authentication failed | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Windows Log | -| **Channel** | Security | -| **Provider** | Microsoft-Windows-Security-Auditing | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -2019-07-18 00:56:03 ATC AUDIT_FAILURE 675 NT AUTHORITY\SYSTEM Pre-authentication failed: - User Name: Administrator - User ID: %{S-1-5-21-3160476663-3818360063-188177334-500} - Service Name: krbtgt/DC - Pre-Authentication Type: 0x2 - Failure Code: 0x18 - Client Address: 127.0.0.1 - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0043_770_dns_server_plugin_dll_has_been_loaded.md b/Atomic_Threat_Coverage/Data_Needed/DN0043_770_dns_server_plugin_dll_has_been_loaded.md deleted file mode 100644 index 160eb27..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0043_770_dns_server_plugin_dll_has_been_loaded.md +++ /dev/null @@ -1,46 +0,0 @@ -| Title | DN0043_770_dns_server_plugin_dll_has_been_loaded | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | Windows DNS server plug-in DLL has been loaded | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Applications and Services Logs | -| **Channel** | DNS Server | -| **Provider** | Microsoft-Windows-DNS-Server-Service | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 770 - 0 - 4 - 0 - 0 - 0x8000000000008000 - - 264 - - - DNS Server - dc1.lab.internal - - - - - \\192.168.0.149\dll\wtf.dll - dc1.lab.internal - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0044_1000_application_crashed.md b/Atomic_Threat_Coverage/Data_Needed/DN0044_1000_application_crashed.md deleted file mode 100644 index 6f5d07f..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0044_1000_application_crashed.md +++ /dev/null @@ -1,55 +0,0 @@ -| Title | DN_0044_1000_application_crashed | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | This is a very generic error and it doesn't tell much about what caused it. Some applications may fail with this error when the system is left unstable by another faulty program. | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Windows Log | -| **Channel** | Application | -| **Provider** | Application Error | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 1000 - 2 - 100 - 0x80000000000000 - - 6724 - Application - WD0000.eu.windows.com - - - - - IntelAudioService.exe - 1.0.46.0 - 59afa72c - KERNELBASE.dll - 10.0.17134.441 - 428de48c - e06d7363 - 000000000003a388 - 1240 - 01d49e823bbf0b3b - C:\WINDOWS\system32\cAVS\Intel(R) Audio Service\IntelAudioService.exe - C:\WINDOWS\System32\KERNELBASE.dll - 6220b181-a7a0-4c44-9046-d8ce090d3a86 - - - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0045_1001_windows_error_reporting.md b/Atomic_Threat_Coverage/Data_Needed/DN0045_1001_windows_error_reporting.md deleted file mode 100644 index d2b7bed..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0045_1001_windows_error_reporting.md +++ /dev/null @@ -1,62 +0,0 @@ -| Title | DN_0045_1001_windows_error_reporting | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | When application fails, the result is recorded as an informational event in the Application log by Windows Error Reporting as event 1001. | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Windows Log | -| **Channel** | Application | -| **Provider** | Windows Error Reporting | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 1001 - 4 - 0 - 0x80000000000000 - - 11279 - Application - WD00000.eu.windows.com - - - - - 2005798148961969216 - 5 - StoreAgentScanForUpdatesFailure0 - Not available - 0 - Update; - 8024402c - 16299 - 847 - Windows.Desktop - - - - - - \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER81F.tmp.WERInternalMetadata.xml - C:\ProgramData\Microsoft\Windows\WER\ReportArchive\NonCritical_Update;_ba86f388d190af6963dbd95b33715448fcb6fd5_00000000_27442451 - - 0 - 0885fc8a-5383-4c50-b209-7c570832b8bf - 268435556 - e7b725b96c0bab97abd606ca1003a440 - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0046_1031_dhcp_service_callout_dll_file_has_caused_an_exception.md b/Atomic_Threat_Coverage/Data_Needed/DN0046_1031_dhcp_service_callout_dll_file_has_caused_an_exception.md deleted file mode 100644 index 49ae165..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0046_1031_dhcp_service_callout_dll_file_has_caused_an_exception.md +++ /dev/null @@ -1,45 +0,0 @@ -| Title | DN0046_1031_dhcp_service_callout_dll_file_has_caused_an_exception | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | The installed server callout .dll file has caused an exception | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Windows Log | -| **Channel** | System | -| **Provider** | Microsoft-Windows-DHCP-Server | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 1031 - 0 - 3 - 0 - 0 - 0x80000000000000 - - 551 - - - System - atc-win-2k12 - - - - - %Exception details% - 7E000000 - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0047_1032_dhcp_service_callout_dll_file_has_caused_an_exception.md b/Atomic_Threat_Coverage/Data_Needed/DN0047_1032_dhcp_service_callout_dll_file_has_caused_an_exception.md deleted file mode 100644 index f588735..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0047_1032_dhcp_service_callout_dll_file_has_caused_an_exception.md +++ /dev/null @@ -1,45 +0,0 @@ -| Title | DN0047_1032_dhcp_service_callout_dll_file_has_caused_an_exception | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | The installed server callout .dll file has caused an exception | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Windows Log | -| **Channel** | System | -| **Provider** | Microsoft-Windows-DHCP-Server | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 1032 - 0 - 3 - 0 - 0 - 0x80000000000000 - - 551 - - - System - atc-win-2k12 - - - - - %Exception details% - 7E000000 - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0048_1033_dhcp_service_successfully_loaded_callout_dlls.md b/Atomic_Threat_Coverage/Data_Needed/DN0048_1033_dhcp_service_successfully_loaded_callout_dlls.md deleted file mode 100644 index da8352d..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0048_1033_dhcp_service_successfully_loaded_callout_dlls.md +++ /dev/null @@ -1,46 +0,0 @@ -| Title | DN0048_1033_dhcp_service_successfully_loaded_callout_dlls | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | The DHCP service has successfully loaded one or more callout DLLs | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Applications and Services Logs | -| **Channel** | System | -| **Provider** | Microsoft-Windows-DHCP-Server | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 1033 - 0 - 4 - 0 - 0 - 0x80000000000000 - - EventRecordID>6653 - - - System - dc1.lab.internal - - - - - Der Vorgang wurde erfolgreich beendet. - 00000000 - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0049_1034_dhcp_service_failed_to_load_callout_dlls.md b/Atomic_Threat_Coverage/Data_Needed/DN0049_1034_dhcp_service_failed_to_load_callout_dlls.md deleted file mode 100644 index 541dc78..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0049_1034_dhcp_service_failed_to_load_callout_dlls.md +++ /dev/null @@ -1,45 +0,0 @@ -| Title | DN0049_1034_dhcp_service_failed_to_load_callout_dlls | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | The DHCP service has failed to load one or more callout DLLs | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Windows Log | -| **Channel** | System | -| **Provider** | Microsoft-Windows-DHCP-Server | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 1034 - 0 - 3 - 0 - 0 - 0x80000000000000 - - 551 - - - System - atc-win-2k12 - - - - - The specified module could not be found. - 7E000000 - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0050_1102_audit_log_was_cleared.md b/Atomic_Threat_Coverage/Data_Needed/DN0050_1102_audit_log_was_cleared.md deleted file mode 100644 index 5358e7d..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0050_1102_audit_log_was_cleared.md +++ /dev/null @@ -1,50 +0,0 @@ -| Title | DN0050_1102_audit_log_was_cleared | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | Event 1102 is created whenever the Security log is cleared, REGARDLESS of the status of the Audit System Events audit policy | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Windows Log | -| **Channel** | Security | -| **Provider** | Microsoft-Windows-Eventlog | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 1102 - 0 - 4 - 104 - 0 - 0x4020000000000000 - - 1087729 - - - Security - DC01.contoso.local - - - - - - - S-1-5-21-3457937927-2839227994-823803824-1104 - dadmin - CONTOSO - 0x55cd1d - - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0051_1121_attack_surface_reduction_blocking_mode_event.md b/Atomic_Threat_Coverage/Data_Needed/DN0051_1121_attack_surface_reduction_blocking_mode_event.md deleted file mode 100644 index d646eea..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0051_1121_attack_surface_reduction_blocking_mode_event.md +++ /dev/null @@ -1,55 +0,0 @@ -| Title | DN0051_1121_attack_surface_reduction_blocking_mode_event | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | Event generated when an attack surface reduction rule fires in block mode | -| **Logging Policy** | | -| **Mitigation Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Applications and Services Logs | -| **Channel** | Microsoft-Windows-Windows Defender/Operational | -| **Provider** | Microsoft-Windows-Windows Defender | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 1121 - 0 - 3 - 0 - 0 - 0x8000000000000000 - - 66 - - - Microsoft-Windows-Windows Defender/Operational - ATC-WIN-10 - - - - - %%827 - 4.18.1907.4 - - 9E6C4E1F-7D60-472F-BA1A-A39EF669E4B2 - 2019-07-29T12:13:55.890Z - ATC-WIN-10\yugoslavskiy - C:\Windows\System32\lsass.exe - C:\Program Files (x86)\GUM7534.tmp\GoogleUpdate.exe - 1.299.756.0 - 1.1.16200.1 - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0052_2003_query_to_load_usb_drivers.md b/Atomic_Threat_Coverage/Data_Needed/DN0052_2003_query_to_load_usb_drivers.md deleted file mode 100644 index 5f924c7..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0052_2003_query_to_load_usb_drivers.md +++ /dev/null @@ -1,46 +0,0 @@ -| Title | DN0052_2003_query_to_load_usb_drivers | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | Host Process has been asked to load drivers for USB device | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Applications and Services Logs | -| **Channel** | Microsoft-Windows-DriverFrameworks-UserMode/Operational | -| **Provider** | Microsoft-Windows-DriverFrameworks-UserMode | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 2003 - 1 - 4 - 33 - 1 - 0x8000000000000000 - - 65 - - - Microsoft-Windows-DriverFrameworks-UserMode/Operational - ALPHA - - - - - - - - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0053_2100_pnp_or_power_operation_for_usb_device.md b/Atomic_Threat_Coverage/Data_Needed/DN0053_2100_pnp_or_power_operation_for_usb_device.md deleted file mode 100644 index 1f7433c..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0053_2100_pnp_or_power_operation_for_usb_device.md +++ /dev/null @@ -1,53 +0,0 @@ -| Title | DN0053_2100_pnp_or_power_operation_for_usb_device | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | Received a Pnp or Power operation for USB device | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Applications and Services Logs | -| **Channel** | Microsoft-Windows-DriverFrameworks-UserMode/Operational | -| **Provider** | Microsoft-Windows-DriverFrameworks-UserMode | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 2100 - 1 - 4 - 37 - 1 - 0x8000000000000000 - - 240 - - - Microsoft-Windows-DriverFrameworks-UserMode/Operational - DavidClient - - - - - - - - - 0x51100 - 0x200000001 - 0x0 - 0x0 - - 3221225659 - - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0054_2102_pnp_or_power_operation_for_usb_device.md b/Atomic_Threat_Coverage/Data_Needed/DN0054_2102_pnp_or_power_operation_for_usb_device.md deleted file mode 100644 index 722dec1..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0054_2102_pnp_or_power_operation_for_usb_device.md +++ /dev/null @@ -1,53 +0,0 @@ -| Title | DN0054_2102_pnp_or_power_operation_for_usb_device | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | Finished PnP or Power operation for USB device | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Applications and Services Logs | -| **Channel** | Microsoft-Windows-DriverFrameworks-UserMode/Operational | -| **Provider** | Microsoft-Windows-DriverFrameworks-UserMode | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 2102 - 1 - 4 - 37 - 2 - 0x8000000000000000 - - 201772 - - - Microsoft-Windows-DriverFrameworks-UserMode/Operational - Sal - - - - - - - - - 0x0 - 0x6 - 0x6 - 0x0 - - 3221225659 - - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0054_linux_auditd_execve.md b/Atomic_Threat_Coverage/Data_Needed/DN0054_linux_auditd_execve.md deleted file mode 100644 index c47b4d1..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0054_linux_auditd_execve.md +++ /dev/null @@ -1,24 +0,0 @@ -| Title | DN0054_linux_auditd_execve | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | Linux auditd log of process (binary) execution (execeve syscall) with command line arguments | -| **Logging Policy** | | -| **References** | | -| **Platform** | Linux | -| **Type** | EXECVE | -| **Channel** | auditd | -| **Provider** | auditd | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -type=EXECVE msg=audit(1564425065.452:651): argc=3 a0="ls" a1="-l" a2="/var/lib/pgsql" -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0055_linux_auditd_read_access_to_file.md b/Atomic_Threat_Coverage/Data_Needed/DN0055_linux_auditd_read_access_to_file.md deleted file mode 100644 index 5d6399e..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0055_linux_auditd_read_access_to_file.md +++ /dev/null @@ -1,25 +0,0 @@ -| Title | DN0055_linux_auditd_read_access_to_file | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | Linux auditd log of read access to file | -| **Logging Policy** | | -| **References** | | -| **Platform** | Linux | -| **Type** | PATH | -| **Channel** | auditd | -| **Provider** | auditd | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -type=PATH msg=audit(1564423065.282:742): item=0 name="/etc/passwd" inode=24673227 dev=fd:00 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:passwd_file_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0 - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0056_linux_auditd_syscall.md b/Atomic_Threat_Coverage/Data_Needed/DN0056_linux_auditd_syscall.md deleted file mode 100644 index b85115f..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0056_linux_auditd_syscall.md +++ /dev/null @@ -1,25 +0,0 @@ -| Title | DN0056_linux_auditd_syscall | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | Linux auditd log of specific system call (syscall) | -| **Logging Policy** | | -| **References** | | -| **Platform** | Linux | -| **Type** | SYSCALL | -| **Channel** | auditd | -| **Provider** | auditd | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -type=SYSCALL msg=audit(1529507591.700:304): arch=c000003e syscall=62 success=yes exit=0 a0=829 a1=9 a2=0 a3=829 items=0 ppid=1783 pid=1784 auid=1001 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="bash" exe="/usr/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="kill_rule" - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0057_4625_account_failed_to_logon.md b/Atomic_Threat_Coverage/Data_Needed/DN0057_4625_account_failed_to_logon.md deleted file mode 100644 index 8930989..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0057_4625_account_failed_to_logon.md +++ /dev/null @@ -1,65 +0,0 @@ -| Title | DN0057_4625_account_failed_to_logon | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | An account failed to log on | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Windows Log | -| **Channel** | Security | -| **Provider** | Microsoft-Windows-Security-Auditing | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 4625 - 0 - 0 - 12546 - 0 - 0x8010000000000000 - - 229977 - - - Security - DC01.contoso.local - - - - - S-1-5-18 - DC01$ - CONTOSO - 0x3e7 - S-1-0-0 - Auditor - CONTOSO - 0xc0000234 - %%2307 - 0x0 - 2 - User32 - Negotiate - DC01 - - - - - 0 - 0x1bc - C:\\Windows\\System32\\winlogon.exe - 127.0.0.1 - 0 - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0058_4656_handle_to_an_object_was_requested.md b/Atomic_Threat_Coverage/Data_Needed/DN0058_4656_handle_to_an_object_was_requested.md deleted file mode 100644 index f90d492..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0058_4656_handle_to_an_object_was_requested.md +++ /dev/null @@ -1,61 +0,0 @@ -| Title | DN0058_4656_handle_to_an_object_was_requested | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | This event indicates that specific access was requested for an object. The object could be a file system, kernel, or registry object, or a file system object on removable storage or a device. If access was declined, a Failure event is generated. This event generates only if the object’s SACL has the required ACE to handle the use of specific access rights | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Windows Log | -| **Channel** | Security | -| **Provider** | Microsoft-Windows-Security-Auditing | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 4656 - 1 - 0 - 12800 - 0 - 0x8010000000000000 - - 274057 - - - Security - DC01.contoso.local - - - - - S-1-5-21-3457937927-2839227994-823803824-1104 - dadmin - CONTOSO - 0x4367b - Security - File - C:\\Documents\\HBI Data.txt - 0x0 - {00000000-0000-0000-0000-000000000000} - %%1538 %%1541 %%4416 %%4417 %%4418 %%4419 %%4420 %%4423 %%4424 - %%1538: %%1804 %%1541: %%1809 %%4416: %%1809 %%4417: %%1809 %%4418: %%1802 D:(D;;LC;;;S-1-5-21-3457937927-2839227994-823803824-1104) %%4419: %%1809 %%4420: %%1809 %%4423: %%1811 D:(A;OICI;FA;;;S-1-5-21-3457937927-2839227994-823803824-1104) %%4424: %%1809 - 0x12019f - - - 0 - 0x1074 - C:\\Windows\\System32\\notepad.exe - S:AI(RA;ID;;;;WD;("Impact\_MS",TI,0x10020,3000)) - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0059_4657_registry_value_was_modified.md b/Atomic_Threat_Coverage/Data_Needed/DN0059_4657_registry_value_was_modified.md deleted file mode 100644 index 1588445..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0059_4657_registry_value_was_modified.md +++ /dev/null @@ -1,58 +0,0 @@ -| Title | DN0059_4657_registry_value_was_modified | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | This event generates when a registry key value was modified. It doesn't generate when a registry key was modified. This event generates only if "Set Value" auditing is set in registry key’s SACL | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Windows Log | -| **Channel** | Security | -| **Provider** | Microsoft-Windows-Security-Auditing | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 4657 - 0 - 0 - 12801 - 0 - 0x8020000000000000 - - 744725 - - - Security - DC01.contoso.local - - - - - S-1-5-21-3457937927-2839227994-823803824-1104 - dadmin - CONTOSO - 0x364eb - \\REGISTRY\\MACHINE - Name\_New - 0x54 - %%1905 - %%1873 - - %%1873 - Andrei - 0xce4 - C:\\Windows\\regedit.exe - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0060_4658_handle_to_an_object_was_closed.md b/Atomic_Threat_Coverage/Data_Needed/DN0060_4658_handle_to_an_object_was_closed.md deleted file mode 100644 index 12ed6ca..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0060_4658_handle_to_an_object_was_closed.md +++ /dev/null @@ -1,52 +0,0 @@ -| Title | DN0060_4658_handle_to_an_object_was_closed | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | This event generates when the handle to an object is closed. The object could be a file system, kernel, or registry object, or a file system object on removable storage or a device. This event generates only if Success auditing is enabled for Audit Handle Manipulation subcategory. Typically this event is needed if you need to know how long the handle to the object was open. Otherwise, it might not have any security relevance | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Windows Log | -| **Channel** | Security | -| **Provider** | Microsoft-Windows-Security-Auditing | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 4658 - 0 - 0 - 12800 - 0 - 0x8020000000000000 - - 276724 - - - Security - DC01.contoso.local - - - - - S-1-5-21-3457937927-2839227994-823803824-1104 - dadmin - CONTOSO - 0x4367b - Security - 0x18a8 - 0xef0 - C:\\Windows\\explorer.exe - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0061_4660_object_was_deleted.md b/Atomic_Threat_Coverage/Data_Needed/DN0061_4660_object_was_deleted.md deleted file mode 100644 index ed3c766..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0061_4660_object_was_deleted.md +++ /dev/null @@ -1,53 +0,0 @@ -| Title | DN0061_4660_object_was_deleted | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | This event generates when an object was deleted. The object could be a file system, kernel, or registry object. This event generates only if "Delete" auditing is set in object’s SACL. This event doesn’t contain the name of the deleted object (only the Handle ID). It is better to use "4663(S): An attempt was made to access an object" with DELETE access to track object deletion. The advantage of this event is that it’s generated only during real delete operations. In contrast, "4663(S): An attempt was made to access an object" also generates during other actions, such as object renaming | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Windows Log | -| **Channel** | Security | -| **Provider** | Microsoft-Windows-Security-Auditing | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 4660 - 0 - 0 - 12800 - 0 - 0x8020000000000000 - - 270188 - - - Security - DC01.contoso.local - - - - - S-1-5-21-3457937927-2839227994-823803824-1104 - dadmin - CONTOSO - 0x4367b - Security - 0x1678 - 0xef0 - C:\\Windows\\explorer.exe - {00000000-0000-0000-0000-000000000000} - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0062_4663_attempt_was_made_to_access_an_object.md b/Atomic_Threat_Coverage/Data_Needed/DN0062_4663_attempt_was_made_to_access_an_object.md deleted file mode 100644 index 7d3fd7f..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0062_4663_attempt_was_made_to_access_an_object.md +++ /dev/null @@ -1,57 +0,0 @@ -| Title | DN0062_4663_attempt_was_made_to_access_an_object | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | This event indicates that a specific operation was performed on an object. The object could be a file system, kernel, or registry object, or a file system object on removable storage or a device. This event generates only if object’s SACL has required ACE to handle specific access right use. The main difference with "4656: A handle to an object was requested." event is that 4663 shows that access right was used instead of just requested and 4663 doesn’t have Failure events | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Windows Log | -| **Channel** | Security | -| **Provider** | Microsoft-Windows-Security-Auditing | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 4663 - 1 - 0 - 12800 - 0 - 0x8020000000000000 - - 273866 - - - Security - DC01.contoso.local - - - - - S-1-5-21-3457937927-2839227994-823803824-1104 - dadmin - CONTOSO - 0x4367b - Security - File - C:\\Documents\\HBI Data.txt - 0x1bc - %%4417 %%4418 - 0x6 - 0x458 - C:\\Windows\\System32\\notepad.exe - S:AI(RA;ID;;;;WD;("Impact\_MS",TI,0x10020,3000)) - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0063_4697_service_was_installed_in_the_system.md b/Atomic_Threat_Coverage/Data_Needed/DN0063_4697_service_was_installed_in_the_system.md deleted file mode 100644 index 964f0f2..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0063_4697_service_was_installed_in_the_system.md +++ /dev/null @@ -1,53 +0,0 @@ -| Title | DN0063_4697_service_was_installed_in_the_system | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | A service was installed in the system | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Windows Log | -| **Channel** | Security | -| **Provider** | Microsoft-Windows-Security-Auditing | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 4697 - 0 - 0 - 12289 - 0 - 0x8020000000000000 - - 2778 - - - Security - atc-win-10.atc.local - - - - - S-1-5-18 - atc-win-10$ - CONTOSO - 0x3e7 - AppHostSvc - %windir%\\system32\\svchost.exe -k apphost - 0x20 - 2 - localSystem - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0064_4698_scheduled_task_was_created.md b/Atomic_Threat_Coverage/Data_Needed/DN0064_4698_scheduled_task_was_created.md deleted file mode 100644 index 851df3d..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0064_4698_scheduled_task_was_created.md +++ /dev/null @@ -1,50 +0,0 @@ -| Title | DN0064_4698_scheduled_task_was_created | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | This event generates every time a new scheduled task is created | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Windows Log | -| **Channel** | Security | -| **Provider** | Microsoft-Windows-Security-Auditing | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 4698 - 0 - 0 - 12804 - 0 - 0x8020000000000000 - - 344740 - - - Security - DC01.contoso.local - - - - - S-1-5-21-3457937927-2839227994-823803824-1104 - dadmin - CONTOSO - 0x364eb - \\Microsoft\\StartListener - 2015-09-22T19:03:06.9258653 CONTOSO\\dadmin LeastPrivilege CONTOSO\\dadmin InteractiveToken IgnoreNew true true true false false true false true true false false false P3D 7 C:\\Documents\\listener.exe - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0065_4701_scheduled_task_was_disabled.md b/Atomic_Threat_Coverage/Data_Needed/DN0065_4701_scheduled_task_was_disabled.md deleted file mode 100644 index 40b48e7..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0065_4701_scheduled_task_was_disabled.md +++ /dev/null @@ -1,50 +0,0 @@ -| Title | DN0065_4701_scheduled_task_was_disabled | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | This event generates every time a scheduled task is disabled | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Windows Log | -| **Channel** | Security | -| **Provider** | Microsoft-Windows-Security-Auditing | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 4701 - 0 - 0 - 12804 - 0 - 0x8020000000000000 - - 344860 - - - Security - DC01.contoso.local - - - - - S-1-5-21-3457937927-2839227994-823803824-1104 - dadmin - CONTOSO - 0x364eb - \\Microsoft\\StartListener - 2015-09-22T19:03:06.9258653 CONTOSO\\dadmin LeastPrivilege CONTOSO\\dadmin InteractiveToken IgnoreNew true true true false false true false true false false false false P3D 7 C:\\Documents\\listener.exe - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0066_4704_user_right_was_assigned.md b/Atomic_Threat_Coverage/Data_Needed/DN0066_4704_user_right_was_assigned.md deleted file mode 100644 index 500e14a..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0066_4704_user_right_was_assigned.md +++ /dev/null @@ -1,50 +0,0 @@ -| Title | DN0066_4704_user_right_was_assigned | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | This event generates every time local user right policy is changed and user right was assigned to an account. You will see unique event for every user | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Windows Log | -| **Channel** | Security | -| **Provider** | Microsoft-Windows-Security-Auditing | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 4704 - 0 - 0 - 13570 - 0 - 0x8020000000000000 - - 1049866 - - - Security - DC01.contoso.local - - - - - S-1-5-18 - DC01$ - CONTOSO - 0x3e7 - S-1-5-21-3457937927-2839227994-823803824-1104 - SeAuditPrivilege SeIncreaseWorkingSetPrivilege - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0067_4719_system_audit_policy_was_changed.md b/Atomic_Threat_Coverage/Data_Needed/DN0067_4719_system_audit_policy_was_changed.md deleted file mode 100644 index 35235e7..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0067_4719_system_audit_policy_was_changed.md +++ /dev/null @@ -1,52 +0,0 @@ -| Title | DN0067_4719_system_audit_policy_was_changed | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | This event generates when the computer's audit policy changes. This event is always logged regardless of the "Audit Policy Change" sub-category setting | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Windows Log | -| **Channel** | Security | -| **Provider** | Microsoft-Windows-Security-Auditing | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 4719 - 0 - 0 - 13568 - 0 - 0x8020000000000000 - - 1049418 - - - Security - DC01.contoso.local - - - - - S-1-5-18 - DC01$ - CONTOSO - 0x3e7 - %%8274 - %%12807 - {0CCE9223-69AE-11D9-BED3-505054503030} - %%8448, %%8450 - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0068_4728_member_was_added_to_security_enabled_global_group.md b/Atomic_Threat_Coverage/Data_Needed/DN0068_4728_member_was_added_to_security_enabled_global_group.md deleted file mode 100644 index 870b443..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0068_4728_member_was_added_to_security_enabled_global_group.md +++ /dev/null @@ -1,54 +0,0 @@ -| Title | DN0068_4728_member_was_added_to_security_enabled_global_group | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | Member was added to a security-enabled global group | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Windows Log | -| **Channel** | Security | -| **Provider** | Microsoft-Windows-Security-Auditing | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 4728 - 0 - 0 - 13826 - 0 - 0x8020000000000000 - - 4408768 - - - Security - atc-win-2k16.atc.local - - - - - CN=test_user,CN=Users,DC=atc,DC=local - S-1-5-21-2245550993-2622282683-2531201460-18603 - Domain Admins - ATC - S-1-5-21-2245550993-2622282683-2531201460-512 - S-1-5-21-2245550993-2622282683-2531201460-500 - demouser - ATC - 0x109a6c - - - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0069_4732_member_was_added_to_security_enabled_local_group.md b/Atomic_Threat_Coverage/Data_Needed/DN0069_4732_member_was_added_to_security_enabled_local_group.md deleted file mode 100644 index d0ce4b9..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0069_4732_member_was_added_to_security_enabled_local_group.md +++ /dev/null @@ -1,54 +0,0 @@ -| Title | DN0069_4732_member_was_added_to_security_enabled_local_group | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | This event generates every time a new member was added to a security-enabled (security) local group. This event generates on domain controllers, member servers, and workstations | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Windows Log | -| **Channel** | Security | -| **Provider** | Microsoft-Windows-Security-Auditing | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 4732 - 0 - 0 - 13826 - 0 - 0x8020000000000000 - - 174856 - - - Security - DC01.contoso.local - - - - - CN=eadmin,CN=Users,DC=contoso,DC=local - S-1-5-21-3457937927-2839227994-823803824-500 - AccountOperators - CONTOSO - S-1-5-21-3457937927-2839227994-823803824-6605 - S-1-5-21-3457937927-2839227994-823803824-1104 - dadmin - CONTOSO - 0x3031e - - - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0070_4735_security_enabled_local_group_was_changed.md b/Atomic_Threat_Coverage/Data_Needed/DN0070_4735_security_enabled_local_group_was_changed.md deleted file mode 100644 index aa0049e..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0070_4735_security_enabled_local_group_was_changed.md +++ /dev/null @@ -1,54 +0,0 @@ -| Title | DN0070_4735_security_enabled_local_group_was_changed | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | This event generates every time a security-enabled (security) local group is changed. This event generates on domain controllers, member servers, and workstations | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Windows Log | -| **Channel** | Security | -| **Provider** | Microsoft-Windows-Security-Auditing | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 4735 - 0 - 0 - 13826 - 0 - 0x8020000000000000 - - 174850 - - - Security - DC01.contoso.local - - - - - AccountOperators\_NEW - CONTOSO - S-1-5-21-3457937927-2839227994-823803824-6605 - S-1-5-21-3457937927-2839227994-823803824-1104 - dadmin - CONTOSO - 0x3031e - - - AccountOperators\_NEW - - - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0071_4737_security_enabled_global_group_was_changed.md b/Atomic_Threat_Coverage/Data_Needed/DN0071_4737_security_enabled_global_group_was_changed.md deleted file mode 100644 index b171cba..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0071_4737_security_enabled_global_group_was_changed.md +++ /dev/null @@ -1,54 +0,0 @@ -| Title | DN0071_4737_security_enabled_global_group_was_changed | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | Security-enabled global group was changed | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Windows Log | -| **Channel** | Security | -| **Provider** | Microsoft-Windows-Security-Auditing | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 4737 - 0 - 0 - 13826 - 0 - 0x8020000000000000 - - 4408769 - - - Security - atc-win-2k16.atc.local - - - - - Domain Admins - ATC - S-1-5-21-2245550993-2622282683-2531201460-512 - S-1-5-21-2245550993-2622282683-2531201460-500 - demouser - ATC - 0x109a6c - - - - - - - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0072_4755_security_enabled_universal_group_was_changed.md b/Atomic_Threat_Coverage/Data_Needed/DN0072_4755_security_enabled_universal_group_was_changed.md deleted file mode 100644 index 6dfd072..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0072_4755_security_enabled_universal_group_was_changed.md +++ /dev/null @@ -1,54 +0,0 @@ -| Title | DN0072_4755_security_enabled_universal_group_was_changed | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | Security-enabled universal group was changed | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Windows Log | -| **Channel** | Security | -| **Provider** | Microsoft-Windows-Security-Auditing | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 4755 - 0 - 0 - 13826 - 0 - 0x8020000000000000 - - 4405438 - - - Security - atc-win-2k16.atc.local - - - - - Enterprise Admins - ATC - S-1-5-21-2245550993-2622282683-2531201460-519 - S-1-5-21-2245550993-2622282683-2531201460-500 - demouser - ATC - 0x109a6c - - - - - - - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0073_4756_member_was_added_to_a_security_enabled_universal_group.md b/Atomic_Threat_Coverage/Data_Needed/DN0073_4756_member_was_added_to_a_security_enabled_universal_group.md deleted file mode 100644 index ca172b8..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0073_4756_member_was_added_to_a_security_enabled_universal_group.md +++ /dev/null @@ -1,54 +0,0 @@ -| Title | DN0073_4756_member_was_added_to_a_security_enabled_universal_group | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | Member was added to a security-enabled universal group | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Windows Log | -| **Channel** | Security | -| **Provider** | Microsoft-Windows-Security-Auditing | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 4756 - 0 - 0 - 13826 - 0 - 0x8020000000000000 - - 4405437 - - - Security - atc-win-2k16.atc.local - - - - - CN=demouser,CN=Users,DC=atc,DC=local - S-1-5-21-2245550993-2690282630-2861202560-18603 - Enterprise Admins - ATC - S-1-5-21-2245550993-2622282683-2531201460-519 - S-1-5-21-2245550993-2622282683-2531201460-500 - test_user - ATC - 0x109a6c - - - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0074_4765_sid_history_was_added_to_an_account.md b/Atomic_Threat_Coverage/Data_Needed/DN0074_4765_sid_history_was_added_to_an_account.md deleted file mode 100644 index 0dbc367..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0074_4765_sid_history_was_added_to_an_account.md +++ /dev/null @@ -1,40 +0,0 @@ -| Title | DN0074_4765_sid_history_was_added_to_an_account | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | SID History was added to an account | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Windows Log | -| **Channel** | Security | -| **Provider** | Microsoft-Windows-Security-Auditing | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -SID History was added to an account. -Subject: -Security ID:%6 -Account Name:%7 -Account Domain:%8 -Logon ID:%9 -Target Account: -Security ID:%5 -Account Name:%3 -Account Domain:%4 -Source Account: -Security ID:%2 -Account Name:%1 -Additional Information: -Privileges:%10 -SID List:%11 - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0075_4766_attempt_to_add_sid_history_to_an_account_failed.md b/Atomic_Threat_Coverage/Data_Needed/DN0075_4766_attempt_to_add_sid_history_to_an_account_failed.md deleted file mode 100644 index 823691c..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0075_4766_attempt_to_add_sid_history_to_an_account_failed.md +++ /dev/null @@ -1,38 +0,0 @@ -| Title | DN0075_4766_attempt_to_add_sid_history_to_an_account_failed | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | An attempt to add SID History to an account failed | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Windows Log | -| **Channel** | Security | -| **Provider** | Microsoft-Windows-Security-Auditing | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -An attempt to add SID History to an account failed. -Subject: -Security ID:- -Account Name:%5 -Account Domain:%6 -Logon ID:%7 -Target Account: -Security ID:%4 -Account Name:%2 -Account Domain:%3 -Source Account: -Account Name:%1 -Additional Information: -Privileges:%8 - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0076_4768_kerberos_authentication_ticket_was_requested.md b/Atomic_Threat_Coverage/Data_Needed/DN0076_4768_kerberos_authentication_ticket_was_requested.md deleted file mode 100644 index e349de2..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0076_4768_kerberos_authentication_ticket_was_requested.md +++ /dev/null @@ -1,58 +0,0 @@ -| Title | DN0076_4768_kerberos_authentication_ticket_was_requested | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | This event generates every time Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT). This event generates only on domain controllers. If TGT issue fails then you will see Failure event with Result Code field not equal to "0x0" | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Windows Log | -| **Channel** | Security | -| **Provider** | Microsoft-Windows-Security-Auditing | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 4768 - 0 - 0 - 14339 - 0 - 0x8020000000000000 - - 166747 - - - Security - DC01.contoso.local - - - - - dadmin - CONTOSO.LOCAL - S-1-5-21-3457937927-2839227994-823803824-1104 - krbtgt - S-1-5-21-3457937927-2839227994-823803824-502 - 0x40810010 - 0x0 - 0x12 - 15 - ::ffff:10.0.0.12 - 49273 - contoso-DC01-CA-1 - 1D0000000D292FBE3C6CDDAFA200020000000D - 564DFAEE99C71D62ABC553E695BD8DBC46669413 - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0077_4769_kerberos_service_ticket_was_requested.md b/Atomic_Threat_Coverage/Data_Needed/DN0077_4769_kerberos_service_ticket_was_requested.md deleted file mode 100644 index cac4aaa..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0077_4769_kerberos_service_ticket_was_requested.md +++ /dev/null @@ -1,55 +0,0 @@ -| Title | DN0077_4769_kerberos_service_ticket_was_requested | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | This event generates every time Key Distribution Center gets a Kerberos Ticket Granting Service (TGS) ticket request. This event generates only on domain controllers. If TGS issue fails then you will see Failure event with Failure Code field not equal to "0x0" | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Windows Log | -| **Channel** | Security | -| **Provider** | Microsoft-Windows-Security-Auditing | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 4769 - 0 - 0 - 14337 - 0 - 0x8020000000000000 - - 166746 - - - Security - DC01.contoso.local - - - - - dadmin@CONTOSO.LOCAL - CONTOSO.LOCAL - WIN2008R2$ - S-1-5-21-3457937927-2839227994-823803824-2102 - 0x40810000 - 0x12 - ::ffff:10.0.0.12 - 49272 - 0x0 - {F85C455E-C66E-205C-6B39-F6C60A7FE453} - - - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0078_4771_kerberos_pre_authentication_failed.md b/Atomic_Threat_Coverage/Data_Needed/DN0078_4771_kerberos_pre_authentication_failed.md deleted file mode 100644 index 425019a..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0078_4771_kerberos_pre_authentication_failed.md +++ /dev/null @@ -1,55 +0,0 @@ -| Title | DN0078_4771_kerberos_pre_authentication_failed | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | This event generates every time the Key Distribution Center fails to issue a Kerberos Ticket Granting Ticket (TGT). This can occur when a domain controller doesn’t have a certificate installed for smart card authentication (for example, with a "Domain Controller" or "Domain Controller Authentication" template), the user’s password has expired, or the wrong password was provided. This event generates only on domain controllers | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Windows Log | -| **Channel** | Security | -| **Provider** | Microsoft-Windows-Security-Auditing | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 4771 - 0 - 0 - 14339 - 0 - 0x8010000000000000 - - 166708 - - - Security - DC01.contoso.local - - - - - dadmin - S-1-5-21-3457937927-2839227994-823803824-1104 - krbtgt/CONTOSO.LOCAL - 0x40810010 - 0x10 - 15 - ::ffff:10.0.0.12 - 49254 - - - - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0079_4776_computer_attempted_to_validate_the_credentials_for_an_account.md b/Atomic_Threat_Coverage/Data_Needed/DN0079_4776_computer_attempted_to_validate_the_credentials_for_an_account.md deleted file mode 100644 index 7c1c1a1..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0079_4776_computer_attempted_to_validate_the_credentials_for_an_account.md +++ /dev/null @@ -1,48 +0,0 @@ -| Title | DN0079_4776_computer_attempted_to_validate_the_credentials_for_an_account | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | This event generates every time that a credential validation occurs using NTLM authentication. This event occurs only on the computer that is authoritative for the provided credentials. For domain accounts, the domain controller is authoritative. For local accounts, the local computer is authoritative | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Windows Log | -| **Channel** | Security | -| **Provider** | Microsoft-Windows-Security-Auditing | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 4776 - 0 - 0 - 14336 - 0 - 0x8010000000000000 - - 165437 - - - Security - DC01.contoso.local - - - - - MICROSOFT\_AUTHENTICATION\_PACKAGE\_V1\_0 - dadmin - WIN81 - 0xc0000234 - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0080_5859_wmi_activity.md b/Atomic_Threat_Coverage/Data_Needed/DN0080_5859_wmi_activity.md deleted file mode 100644 index 48f578b..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0080_5859_wmi_activity.md +++ /dev/null @@ -1,53 +0,0 @@ -| Title | DN0080_5859_wmi_activity | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | WMI Event which provide ability to catch Timer-based WMI Events and provide usefult information for identification of suspicious WMI activity | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Applications and Services Logs | -| **Channel** | Microsoft-Windows-WMI-Activity/Operational | -| **Provider** | Microsoft-Windows-WMI-Activity | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 5859 - 0 - 0 - 0 - 0 - 0x4000000000000000 - - 57003 - - - Microsoft-Windows-WMI-Activity/Operational - atc-win-10.atc.local - - - - - - - //./root/cimv2 - select * from MSFT_SCMEventLogEvent - S-1-5-32-544 - 436 - SCM Event Provider - 0 - Permanent - - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0081_5861_wmi_activity.md b/Atomic_Threat_Coverage/Data_Needed/DN0081_5861_wmi_activity.md deleted file mode 100644 index b1ab071..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0081_5861_wmi_activity.md +++ /dev/null @@ -1,50 +0,0 @@ -| Title | DN0081_5861_wmi_activity | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | WMI Event which provide ability to catch Timer-based WMI Events and provide usefult information for identification of suspicious WMI activity | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Applications and Services Logs | -| **Channel** | Microsoft-Windows-WMI-Activity/Operational | -| **Provider** | Microsoft-Windows-WMI-Activity | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 5861 - 0 - 0 - 0 - 0 - 0x4000000000000000 - - 56793 - - - Microsoft-Windows-WMI-Activity/Operational - atc-win-10.atc.local - - - - - - - //./ROOT/Subscription - SCM Event Log Filter - NTEventLogEventConsumer="SCM Event Log Consumer" - Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; }; - - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0082_8002_ntlm_server_blocked_audit.md b/Atomic_Threat_Coverage/Data_Needed/DN0082_8002_ntlm_server_blocked_audit.md deleted file mode 100644 index 12f0f1e..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0082_8002_ntlm_server_blocked_audit.md +++ /dev/null @@ -1,49 +0,0 @@ -| Title | DN0082_8002_ntlm_server_blocked_audit | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | NTLM server blocked audit: Audit Incoming NTLM Traffic that would be blocked. Actually it's just event about NTLM authentication, it doesn't necessary supposed to be blocked. Blocked NTLM auth is the same provider but Event ID 4002 | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Applications and Services Logs | -| **Channel** | Microsoft-Windows-NTLM/Operational | -| **Provider** | Microsoft-Windows-NTLM | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 8002 - 0 - 4 - 2 - 0 - 0x8000000000000000 - - 12 - - - Microsoft-Windows-NTLM/Operational - dc.yugoslavskiy.local - - - - - 4 - - 0x3e7 - DC$ - atc - 1.3.6.1.4.1.311.2.2.10 - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0083_16_access_history_in_hive_was_cleared.md b/Atomic_Threat_Coverage/Data_Needed/DN0083_16_access_history_in_hive_was_cleared.md deleted file mode 100644 index d34701e..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0083_16_access_history_in_hive_was_cleared.md +++ /dev/null @@ -1,48 +0,0 @@ -| Title | DN0083_16_access_history_in_hive_was_cleared | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | The access history in hive was cleared updating X keys and creating Y modified pages | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Windows Log | -| **Channel** | System | -| **Provider** | Microsoft-Windows-Kernel-General | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 16 - 0 - 4 - 0 - 0 - 0x8000000000000000 - - 1705 - - - System - atc-win-10.atc.local - - - - - 31 - \SystemRoot\System32\Config\SAM - 65 - 7 - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0084_av_alert.md b/Atomic_Threat_Coverage/Data_Needed/DN0084_av_alert.md deleted file mode 100644 index d0f7397..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0084_av_alert.md +++ /dev/null @@ -1,59 +0,0 @@ -| Title | DN0084_av_alert | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | Anti-virus alert | -| **Logging Policy** | | -| **References** | | -| **Platform** | antivirus | -| **Type** | None | -| **Channel** | None | -| **Provider** | None | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -{ - "AlertTime":"2017-01-23T07:32:54.1861171Z", - "ComputerDnsName":"desktop-bvccckk", - "AlertTitle":"Suspicious PowerShell commandline", - "Category":"SuspiciousActivity", - "Severity":"Medium", - "AlertId":"636207535742330111_-1114309685", - "Actor":null, - "LinkToWDATP":"https://securitycenter.windows.com/alert/636207535742330111_-1114309685", - "IocName":null, - "IocValue":null, - "CreatorIocName":null, - "CreatorIocValue":null, - "Sha1":"69484ca722b4285a234896a2e31707cbedc59ef9", - "FileName":"powershell.exe", - "FilePath":"C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", - "IpAddress":null, - "Url":null, - "IoaDefinitiondId":"7f1c3609-a3ff-40e2-995b-c01770161d68", - "UserName":null, - "AlertPart":0, - "FullId":"636207535742330111_-1114309685:9DE735BA9FF87725E392C6DFBEB2AF279035CDE229FCC00D28C0F3242C5A50AF", - "LastProcessedTimeUtc":"2017-01-23T11:33:45.0760449Z", - "ThreatCategory":null, - "ThreatFamily":null, - "ThreatName":null, - "RemediationAction":null, - "RemediationIsSuccess":null, - "Source":"Windows Defender ATP", - "Md5":null, - "Sha256":null, - "WasExecutingWhileDetected":null, - "FileHash":"69484ca722b4285a234896a2e31707cbedc59ef9", - "IocUniqueId":"9DE735BA9FF87725E392C6DFBEB2AF279035CDE229FCC00D28C0F3242C5A50AF" -} - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0085_22_windows_sysmon_DnsQuery.md b/Atomic_Threat_Coverage/Data_Needed/DN0085_22_windows_sysmon_DnsQuery.md deleted file mode 100644 index 8e6b102..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0085_22_windows_sysmon_DnsQuery.md +++ /dev/null @@ -1,52 +0,0 @@ -| Title | DN0085_22_windows_sysmon_DnsQuery | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | This event generates when a process executes a DNS query, whether the result is successful or fails, cached or not | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Applications and Services Logs | -| **Channel** | Microsoft-Windows-Sysmon/Operational | -| **Provider** | Microsoft-Windows-Sysmon | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 22 - 5 - 4 - 22 - 0 - 0x8000000000000000 - - 2637 - - - Microsoft-Windows-Sysmon/Operational - atc-win-10.atc.local - - - - - - 2019-06-24 00:56:50.125 - {717CFEC0-1A16-5D10-0000-0010CDEA1F00} - 3192 - kibana.atomicthreatcoverage.com - 0 - ::ffff:157.230.126.111; - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0086_4720_user_account_was_created.md b/Atomic_Threat_Coverage/Data_Needed/DN0086_4720_user_account_was_created.md deleted file mode 100644 index 913dc5c..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0086_4720_user_account_was_created.md +++ /dev/null @@ -1,69 +0,0 @@ -| Title | DN0086_4720_user_account_was_created | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | A user account was created | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Windows Log | -| **Channel** | Security | -| **Provider** | Microsoft-Windows-Security-Auditing | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 4720 - 0 - 0 - 13824 - 0 - 0x8020000000000000 - - 1346 - - - Security - atc-win-2k12 - - - - - newuser - ATC-WIN-2K12 - S-1-5-21-1566719857-3102892733-3273982148-1005 - S-1-5-21-1566719857-3102892733-3273982148-1001 - yugoslavskiy - ATC-WIN-2K12 - 0x14c6b - - - newuser - %%1793 - - - %%1793 - %%1793 - %%1793 - %%1793 - %%1793 - %%1794 - %%1794 - 513 - - - 0x0 - 0x15 - %%2080 %%2082 %%2084 - %%1793 - - - %%1797 - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0087_5156_windows_filtering_platform_has_permitted_connection.md b/Atomic_Threat_Coverage/Data_Needed/DN0087_5156_windows_filtering_platform_has_permitted_connection.md deleted file mode 100644 index f7518ff..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0087_5156_windows_filtering_platform_has_permitted_connection.md +++ /dev/null @@ -1,57 +0,0 @@ -| Title | DN0087_5156_windows_filtering_platform_has_permitted_connection | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | The Windows Filtering Platform has permitted a connection | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Windows Log | -| **Channel** | Security | -| **Provider** | Microsoft-Windows-Security-Auditing | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 5156 - 1 - 0 - 12810 - 0 - 0x8020000000000000 - - 1360 - - - Security - atc-win-2k12 - - - - - 4 - System - %%14593 - fe80::e8a5:2a62:cc49:96cb - 143 - ff02::16 - 0 - 58 - 67456 - %%14611 - 50 - S-1-0-0 - S-1-0-0 - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0088_4616_system_time_was_changed.md b/Atomic_Threat_Coverage/Data_Needed/DN0088_4616_system_time_was_changed.md deleted file mode 100644 index 36c7af8..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0088_4616_system_time_was_changed.md +++ /dev/null @@ -1,52 +0,0 @@ -| Title | DN0088_4616_system_time_was_changed | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | The system time was changed | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Windows Log | -| **Channel** | Security | -| **Provider** | Microsoft-Windows-Security-Auditing | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 4616 - 1 - 0 - 12288 - 0 - 0x8020000000000000 - - 1101699 - - - Security - DC01.contoso.local - - - - - S-1-5-21-3457937927-2839227994-823803824-1104 - dadmin - CONTOSO - 0x48f29 - 2015-10-09T05:04:30.000941900Z - 2015-10-09T05:04:30.000000000Z - 0x1074 - C:\\Windows\\WinSxS\\amd64\_microsoft-windows-com-surrogate-core\_31bf3856ad364e35\_6.3.9600.16384\_none\_25a8f00faa8f185c\\dllhost.exe - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0089_56_terminal_server_security_layer_detected_an_error.md b/Atomic_Threat_Coverage/Data_Needed/DN0089_56_terminal_server_security_layer_detected_an_error.md deleted file mode 100644 index 4d55564..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0089_56_terminal_server_security_layer_detected_an_error.md +++ /dev/null @@ -1,42 +0,0 @@ -| Title | DN0089_56_terminal_server_security_layer_detected_an_error | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | The Terminal Server security layer detected an error in the protocol stream and has disconnected the client | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Windows Log | -| **Channel** | System | -| **Provider** | TermDD | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 56 - 2 - 0 - 0x80000000000000 - - 147091 - System - atc-demo - - - - - \Device\Termdd - 00050600010000000000000038000AC00000000039000AC00000000000000000000000000000000030030980 - - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0090_50_terminal_server_security_layer_detected_an_error.md b/Atomic_Threat_Coverage/Data_Needed/DN0090_50_terminal_server_security_layer_detected_an_error.md deleted file mode 100644 index 34ee7b8..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0090_50_terminal_server_security_layer_detected_an_error.md +++ /dev/null @@ -1,42 +0,0 @@ -| Title | DN0090_50_terminal_server_security_layer_detected_an_error | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | The RDP protocol component detected an error in the protocol stream and has disconnected the client | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Windows Log | -| **Channel** | System | -| **Provider** | TermDD | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -- - - - - 50 - 2 - 0 - 0x80000000000000 - - 5483 - System - atc-win-7 - - - - - \Device\Termdd - X.224 - 00000B00020034000000000032000AC00000000032000AC0000000000000000000000000000000000B00000016030100C30100 - - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0091_linux_modsecurity_log.md b/Atomic_Threat_Coverage/Data_Needed/DN0091_linux_modsecurity_log.md deleted file mode 100644 index 179dfce..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0091_linux_modsecurity_log.md +++ /dev/null @@ -1,25 +0,0 @@ -| Title | DN0091_linux_modsecurity_log | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | Mod_security (Web Application Firewall) audit/error log | -| **Logging Policy** | | -| **References** | | -| **Platform** | Linux | -| **Type** | modsecurity | -| **Channel** | modsecurity | -| **Provider** | modsecurity | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -[Thu Jul 02 04:14:31 2018] [error] [client 190.222.135.100] mod_security: Access denied with code 500. Pattern match "SomePattern" at HEADER("USER-AGENT") [hostname "samplesite.com"] [uri "/some/uri"] - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0092_unix_generic_syslog.md b/Atomic_Threat_Coverage/Data_Needed/DN0092_unix_generic_syslog.md deleted file mode 100644 index 7c856af..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0092_unix_generic_syslog.md +++ /dev/null @@ -1,25 +0,0 @@ -| Title | DN0092_unix_generic_syslog | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | Unix generic syslog | -| **Logging Policy** | | -| **References** | | -| **Platform** | Unix | -| **Type** | generic | -| **Channel** | syslog | -| **Provider** | syslog | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -Nov 12 18:47:02 foo.bar.baz unix: rpc.ttdbserverd[1932] attempt to execute code on stack by uid 0 - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0093_linux_clamav_log.md b/Atomic_Threat_Coverage/Data_Needed/DN0093_linux_clamav_log.md deleted file mode 100644 index c3ca954..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0093_linux_clamav_log.md +++ /dev/null @@ -1,25 +0,0 @@ -| Title | DN0093_linux_clamav_log | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | Linux ClamAV anti-virus logs | -| **Logging Policy** | | -| **References** | | -| **Platform** | Linux | -| **Type** | None | -| **Channel** | ClamAV | -| **Provider** | ClamAV | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -/var/vcap/data/test.txt: Eicar-Test-Signature FOUND - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0094_linux_sshd_log.md b/Atomic_Threat_Coverage/Data_Needed/DN0094_linux_sshd_log.md deleted file mode 100644 index 921b280..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0094_linux_sshd_log.md +++ /dev/null @@ -1,25 +0,0 @@ -| Title | DN0094_linux_sshd_log | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | OpenSSH SSH daemon (sshd) log | -| **Logging Policy** | | -| **References** | | -| **Platform** | Linux | -| **Type** | auth | -| **Channel** | auth.log | -| **Provider** | sshd | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -May 18 16:41:20 hostname sshd[890]: error: buffer_get_string_ret: buffer_get failed - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0095_linux_auth_pam_log.md b/Atomic_Threat_Coverage/Data_Needed/DN0095_linux_auth_pam_log.md deleted file mode 100644 index 0d58218..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0095_linux_auth_pam_log.md +++ /dev/null @@ -1,25 +0,0 @@ -| Title | DN0095_linux_auth_pam_log | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | Linux Pluggable Authentication Modules (PAM) authentication log | -| **Logging Policy** | | -| **References** | | -| **Platform** | Linux | -| **Type** | auth | -| **Channel** | auth.log | -| **Provider** | pam | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -May 18 16:41:20 hostname service: (pam_unix) authentication failure; logname= uid=33 euid=33 tty= ruser= rhost= user=root - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0096_linux_named_client_security_log.md b/Atomic_Threat_Coverage/Data_Needed/DN0096_linux_named_client_security_log.md deleted file mode 100644 index 49900b2..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0096_linux_named_client_security_log.md +++ /dev/null @@ -1,25 +0,0 @@ -| Title | DN0096_linux_named_client_security_log | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | Linux named (BIND) messages relating to client access and security | -| **Logging Policy** | | -| **References** | | -| **Platform** | Linux | -| **Type** | client_security_log | -| **Channel** | client_security_log | -| **Provider** | named | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -28-Aug-2019 02:03:13.739 security: error: client 192.168.0.2#53274 (atc.local): zone transfer 'atc.local/AXFR/IN' denied - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0097_linux_daemon_log.md b/Atomic_Threat_Coverage/Data_Needed/DN0097_linux_daemon_log.md deleted file mode 100644 index 60294c4..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0097_linux_daemon_log.md +++ /dev/null @@ -1,25 +0,0 @@ -| Title | DN0097_linux_daemon_log | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | The daemons log at /var/log/daemon.log and contains information about running system and application daemons | -| **Logging Policy** | | -| **References** | | -| **Platform** | Linux | -| **Type** | daemon | -| **Channel** | daemon.log | -| **Provider** | many | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -Aug 28 23:39:09 debian-9-x64-atc named[32010]: exiting (due to fatal error) - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0098_linux_vsftpd_log.md b/Atomic_Threat_Coverage/Data_Needed/DN0098_linux_vsftpd_log.md deleted file mode 100644 index 77c3546..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0098_linux_vsftpd_log.md +++ /dev/null @@ -1,25 +0,0 @@ -| Title | DN0098_linux_vsftpd_log | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | vsftpd (FTP server) log | -| **Logging Policy** | | -| **References** | | -| **Platform** | Linux | -| **Type** | vsftpd.log | -| **Channel** | vsftpd.log | -| **Provider** | vsftpd | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -Sat Jun 2 11:20:19 2018 [pid 3616] CONNECT: Client "ip", "Connection refused: too many sessions for this address." - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0099_Bind_DNS_query.md b/Atomic_Threat_Coverage/Data_Needed/DN0099_Bind_DNS_query.md deleted file mode 100644 index be6d3b3..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0099_Bind_DNS_query.md +++ /dev/null @@ -1,25 +0,0 @@ -| Title | DN0099_Bind_DNS_query | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | DNS Query from BIND Server | -| **Logging Policy** | | -| **References** | | -| **Platform** | Linux | -| **Type** | queries log | -| **Channel** | queries_log | -| **Provider** | BIND | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -25-Oct-2019 01:22:19.421 queries: info: client 192.168.1.200#51364 (yahoo.com): query: yahoo.com IN TXT + (192.168.1.235) - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0100_Passive_DNS_log.md b/Atomic_Threat_Coverage/Data_Needed/DN0100_Passive_DNS_log.md deleted file mode 100644 index 8a7fcf9..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0100_Passive_DNS_log.md +++ /dev/null @@ -1,25 +0,0 @@ -| Title | DN0100_Passive_DNS_log | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | Log from Passive DNS | -| **Logging Policy** | | -| **References** | | -| **Platform** | Linux | -| **Type** | queries log | -| **Channel** | passivedns | -| **Provider** | Passive DNS | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -1523230478.705932||192.168.1.235||8.8.8.8||IN||facebook.com.||TXT||"v=spf1 redirect=_spf.facebook.com"||21323||1 - -``` - - - - diff --git a/Atomic_Threat_Coverage/Data_Needed/DN0108_150_dns_server_could_not_load_dll.md b/Atomic_Threat_Coverage/Data_Needed/DN0108_150_dns_server_could_not_load_dll.md deleted file mode 100644 index 4b415f7..0000000 --- a/Atomic_Threat_Coverage/Data_Needed/DN0108_150_dns_server_could_not_load_dll.md +++ /dev/null @@ -1,25 +0,0 @@ -| Title | DN0036_150_dns_server_could_not_load_dll | -|:-------------------|:------------------| -| **Author** | @atc_project | -| **Description** | Windows DNS server could not load or initialize the plug-in DLL | -| **Logging Policy** | | -| **References** | | -| **Platform** | Windows | -| **Type** | Applications and Services Logs | -| **Channel** | DNS Server | -| **Provider** | Microsoft-Windows-DNS-Server-Service | -| **Fields** | | - - -## Log Samples - -### Raw Log - -``` -todo - -``` - - - - diff --git a/Atomic_Threat_Coverage/Detection_Rules/av_exploiting.md b/Atomic_Threat_Coverage/Detection_Rules/av_exploiting.md deleted file mode 100644 index fb6f7be..0000000 --- a/Atomic_Threat_Coverage/Detection_Rules/av_exploiting.md +++ /dev/null @@ -1,187 +0,0 @@ -| Title | Antivirus Exploitation Framework Detection | -|:-------------------------|:------------------| -| **Description** | Detects a highly relevant Antivirus alert that reports an exploitation framework | -| **ATT&CK Tactic** | | -| **ATT&CK Technique** | | -| **Data Needed** | | -| **Trigger** | | -| **Severity Level** | critical | -| **False Positives** | | -| **Development Status** | Development Status wasn't defined for this Detection Rule yet | -| **References** | | -| **Author** | Florian Roth | - - -## Detection Rules - -### Sigma rule - -``` -title: Antivirus Exploitation Framework Detection -id: 238527ad-3c2c-4e4f-a1f6-92fd63adb864 -description: Detects a highly relevant Antivirus alert that reports an exploitation framework -date: 2018/09/09 -modified: 2019/01/16 -author: Florian Roth -references: - - https://www.nextron-systems.com/2018/09/08/antivirus-event-analysis-cheat-sheet-v1-4/ -tags: - - attack.execution - - attack.t1203 - - attack.command_and_control - - attack.t1219 -logsource: - product: antivirus -detection: - selection: - Signature: - - "*MeteTool*" - - "*MPreter*" - - "*Meterpreter*" - - "*Metasploit*" - - "*PowerSploit*" - - "*CobaltSrike*" - - "*Swrort*" - - "*Rozena*" - - "*Backdoor.Cobalt*" - condition: selection -fields: - - FileName - - User -falsepositives: - - Unlikely -level: critical - -``` - - - - - -### powershell - -``` -Get-WinEvent | where {($_.message -match "Signature.*.*MeteTool.*" -or $_.message -match "Signature.*.*MPreter.*" -or $_.message -match "Signature.*.*Meterpreter.*" -or $_.message -match "Signature.*.*Metasploit.*" -or $_.message -match "Signature.*.*PowerSploit.*" -or $_.message -match "Signature.*.*CobaltSrike.*" -or $_.message -match "Signature.*.*Swrort.*" -or $_.message -match "Signature.*.*Rozena.*" -or $_.message -match "Signature.*.*Backdoor.Cobalt.*") } | select TimeCreated,Id,RecordId,ProcessId,MachineName,Message -``` - - -### es-qs - -``` -winlog.event_data.Signature.keyword:(*MeteTool* OR *MPreter* OR *Meterpreter* OR *Metasploit* OR *PowerSploit* OR *CobaltSrike* OR *Swrort* OR *Rozena* OR *Backdoor.Cobalt*) -``` - - -### xpack-watcher - -``` -curl -s -XPUT -H 'Content-Type: application/json' --data-binary @- localhost:9200/_watcher/watch/238527ad-3c2c-4e4f-a1f6-92fd63adb864 <
  • [TA0006: Credential Access](https://attack.mitre.org/tactics/TA0006)
    • | -| **ATT&CK Technique** |
    • [T1003: OS Credential Dumping](https://attack.mitre.org/techniques/T1003)
    • [T1558: Steal or Forge Kerberos Tickets](https://attack.mitre.org/techniques/T1558)
    | -| **Data Needed** |
    • [DN0084_av_alert](../Data_Needed/DN0084_av_alert.md)
    | -| **Trigger** |
    • [T1003: OS Credential Dumping](../Triggers/T1003.md)
    | -| **Severity Level** | critical | -| **False Positives** |
    • Unlikely
    | -| **Development Status** | Development Status wasn't defined for this Detection Rule yet | -| **References** |
    • [https://www.nextron-systems.com/2018/09/08/antivirus-event-analysis-cheat-sheet-v1-4/](https://www.nextron-systems.com/2018/09/08/antivirus-event-analysis-cheat-sheet-v1-4/)
    | -| **Author** | Florian Roth | -| Other Tags |
    • attack.t1003.001
    • attack.t1003.002
    | - -## Detection Rules - -### Sigma rule - -``` -title: Antivirus Password Dumper Detection -id: 78cc2dd2-7d20-4d32-93ff-057084c38b93 -description: Detects a highly relevant Antivirus alert that reports a password dumper -date: 2018/09/09 -modified: 2019/10/04 -author: Florian Roth -references: - - https://www.nextron-systems.com/2018/09/08/antivirus-event-analysis-cheat-sheet-v1-4/ -tags: - - attack.credential_access - - attack.t1003 - - attack.t1558 - - attack.t1003.001 - - attack.t1003.002 -logsource: - product: antivirus -detection: - selection: - Signature: - - "*DumpCreds*" - - "*Mimikatz*" - - "*PWCrack*" - - "HTool/WCE" - - "*PSWtool*" - - "*PWDump*" - - "*SecurityTool*" - - "*PShlSpy*" - condition: selection -fields: - - FileName - - User -falsepositives: - - Unlikely -level: critical - -``` - - - - - -### powershell - -``` -Get-WinEvent | where {($_.message -match "Signature.*.*DumpCreds.*" -or $_.message -match "Signature.*.*Mimikatz.*" -or $_.message -match "Signature.*.*PWCrack.*" -or $_.message -match "HTool/WCE" -or $_.message -match "Signature.*.*PSWtool.*" -or $_.message -match "Signature.*.*PWDump.*" -or $_.message -match "Signature.*.*SecurityTool.*" -or $_.message -match "Signature.*.*PShlSpy.*") } | select TimeCreated,Id,RecordId,ProcessId,MachineName,Message -``` - - -### es-qs - -``` -winlog.event_data.Signature.keyword:(*DumpCreds* OR *Mimikatz* OR *PWCrack* OR HTool\/WCE OR *PSWtool* OR *PWDump* OR *SecurityTool* OR *PShlSpy*) -``` - - -### xpack-watcher - -``` -curl -s -XPUT -H 'Content-Type: application/json' --data-binary @- localhost:9200/_watcher/watch/78cc2dd2-7d20-4d32-93ff-057084c38b93 <
  • [DN0084_av_alert](../Data_Needed/DN0084_av_alert.md)
    • | -| **Trigger** | There is no documented Trigger for this Detection Rule yet | -| **Severity Level** | high | -| **False Positives** |
    • Unlikely
    | -| **Development Status** | Development Status wasn't defined for this Detection Rule yet | -| **References** |
    • [https://www.nextron-systems.com/2018/09/08/antivirus-event-analysis-cheat-sheet-v1-4/](https://www.nextron-systems.com/2018/09/08/antivirus-event-analysis-cheat-sheet-v1-4/)
    | -| **Author** | Florian Roth | - - -## Detection Rules - -### Sigma rule - -``` -title: Antivirus Relevant File Paths Alerts -id: c9a88268-0047-4824-ba6e-4d81ce0b907c -description: Detects an Antivirus alert in a highly relevant file path or with a relevant file name -date: 2018/09/09 -modified: 2019/10/04 -author: Florian Roth -references: - - https://www.nextron-systems.com/2018/09/08/antivirus-event-analysis-cheat-sheet-v1-4/ -logsource: - product: antivirus -detection: - selection: - FileName: - - 'C:\Windows\Temp\\*' - - 'C:\Temp\\*' - - '*\\Client\\*' - - 'C:\PerfLogs\\*' - - 'C:\Users\Public\\*' - - 'C:\Users\Default\\*' - - '*.ps1' - - '*.vbs' - - '*.bat' - - '*.chm' - - '*.xml' - - '*.txt' - - '*.jsp' - - '*.jspx' - - '*.asp' - - '*.aspx' - - '*.php' - - '*.war' - - '*.hta' - - '*.lnk' - - '*.scf' - - '*.sct' - - '*.vbe' - - '*.wsf' - - '*.wsh' - condition: selection -fields: - - Signature - - User -falsepositives: - - Unlikely -level: high - -``` - - - - - -### powershell - -``` -Get-WinEvent | where {($_.message -match "FileName.*C:\\Windows\\Temp\\.*" -or $_.message -match "FileName.*C:\\Temp\\.*" -or $_.message -match "FileName.*.*\\Client\\.*" -or $_.message -match "FileName.*C:\\PerfLogs\\.*" -or $_.message -match "FileName.*C:\\Users\\Public\\.*" -or $_.message -match "FileName.*C:\\Users\\Default\\.*" -or $_.message -match "FileName.*.*.ps1" -or $_.message -match "FileName.*.*.vbs" -or $_.message -match "FileName.*.*.bat" -or $_.message -match "FileName.*.*.chm" -or $_.message -match "FileName.*.*.xml" -or $_.message -match "FileName.*.*.txt" -or $_.message -match "FileName.*.*.jsp" -or $_.message -match "FileName.*.*.jspx" -or $_.message -match "FileName.*.*.asp" -or $_.message -match "FileName.*.*.aspx" -or $_.message -match "FileName.*.*.php" -or $_.message -match "FileName.*.*.war" -or $_.message -match "FileName.*.*.hta" -or $_.message -match "FileName.*.*.lnk" -or $_.message -match "FileName.*.*.scf" -or $_.message -match "FileName.*.*.sct" -or $_.message -match "FileName.*.*.vbe" -or $_.message -match "FileName.*.*.wsf" -or $_.message -match "FileName.*.*.wsh") } | select TimeCreated,Id,RecordId,ProcessId,MachineName,Message -``` - - -### es-qs - -``` -winlog.event_data.FileName.keyword:(C\:\\Windows\\Temp\\* OR C\:\\Temp\\* OR *\\Client\\* OR C\:\\PerfLogs\\* OR C\:\\Users\\Public\\* OR C\:\\Users\\Default\\* OR *.ps1 OR *.vbs OR *.bat OR *.chm OR *.xml OR *.txt OR *.jsp OR *.jspx OR *.asp OR *.aspx OR *.php OR *.war OR *.hta OR *.lnk OR *.scf OR *.sct OR *.vbe OR *.wsf OR *.wsh) -``` - - -### xpack-watcher - -``` -curl -s -XPUT -H 'Content-Type: application/json' --data-binary @- localhost:9200/_watcher/watch/c9a88268-0047-4824-ba6e-4d81ce0b907c <
  • [TA0003: Persistence](https://attack.mitre.org/tactics/TA0003)
    • | -| **ATT&CK Technique** |
    • [T1100: Web Shell](https://attack.mitre.org/techniques/T1100)
    | -| **Data Needed** |
    • [DN0084_av_alert](../Data_Needed/DN0084_av_alert.md)
    | -| **Trigger** | There is no documented Trigger for this Detection Rule yet | -| **Severity Level** | critical | -| **False Positives** |
    • Unlikely
    | -| **Development Status** | Development Status wasn't defined for this Detection Rule yet | -| **References** |
    • [https://www.nextron-systems.com/2018/09/08/antivirus-event-analysis-cheat-sheet-v1-4/](https://www.nextron-systems.com/2018/09/08/antivirus-event-analysis-cheat-sheet-v1-4/)
    | -| **Author** | Florian Roth | -| Other Tags |
    • attack.t1505.003
    | - -## Detection Rules - -### Sigma rule - -``` -title: Antivirus Web Shell Detection -id: fdf135a2-9241-4f96-a114-bb404948f736 -description: Detects a highly relevant Antivirus alert that reports a web shell -date: 2018/09/09 -modified: 2019/10/04 -author: Florian Roth -references: - - https://www.nextron-systems.com/2018/09/08/antivirus-event-analysis-cheat-sheet-v1-4/ -tags: - - attack.persistence - - attack.t1100 - - attack.t1505.003 -logsource: - product: antivirus -detection: - selection: - Signature: - - "PHP/Backdoor*" - - "JSP/Backdoor*" - - "ASP/Backdoor*" - - "Backdoor.PHP*" - - "Backdoor.JSP*" - - "Backdoor.ASP*" - - "*Webshell*" - condition: selection -fields: - - FileName - - User -falsepositives: - - Unlikely -level: critical - -``` - - - - - -### powershell - -``` -Get-WinEvent | where {($_.message -match "Signature.*PHP/Backdoor.*" -or $_.message -match "Signature.*JSP/Backdoor.*" -or $_.message -match "Signature.*ASP/Backdoor.*" -or $_.message -match "Signature.*Backdoor.PHP.*" -or $_.message -match "Signature.*Backdoor.JSP.*" -or $_.message -match "Signature.*Backdoor.ASP.*" -or $_.message -match "Signature.*.*Webshell.*") } | select TimeCreated,Id,RecordId,ProcessId,MachineName,Message -``` - - -### es-qs - -``` -winlog.event_data.Signature.keyword:(PHP\/Backdoor* OR JSP\/Backdoor* OR ASP\/Backdoor* OR Backdoor.PHP* OR Backdoor.JSP* OR Backdoor.ASP* OR *Webshell*) -``` - - -### xpack-watcher - -``` -curl -s -XPUT -H 'Content-Type: application/json' --data-binary @- localhost:9200/_watcher/watch/fdf135a2-9241-4f96-a114-bb404948f736 <
  • [TA0002: Execution](https://attack.mitre.org/tactics/TA0002)
    • | -| **ATT&CK Technique** |
    • [T1112: Modify Registry](https://attack.mitre.org/techniques/T1112)
    | -| **Data Needed** | There is no documented Data Needed for this Detection Rule yet | -| **Trigger** |
    • [T1112: Modify Registry](../Triggers/T1112.md)
    | -| **Severity Level** | critical | -| **False Positives** |
    • unknown
    | -| **Development Status** | experimental | -| **References** |
    • [https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.azoruit.a](https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.azoruit.a)
    | -| **Author** | Trent Liffick | - - -## Detection Rules - -### Sigma rule - -``` -title: Registy Entries For Azorult Malware -id: f7f9ab88-7557-4a69-b30e-0a8f91b3a0e7 -description: Detects the presence of a registry key created during Azorult execution -status: experimental -references: - - https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.azoruit.a -author: Trent Liffick -date: 2020/05/08 -tags: - - attack.execution - - attack.t1112 -logsource: - product: windows - service: sysmon -detection: - selection: - EventID: - - 12 - - 13 - TargetObject: - - '*SYSTEM\\*\services\localNETService' - condition: selection -fields: - - Image - - TargetObject - - TargetDetails -falsepositives: - - unknown -level: critical - -``` - - - - - -### powershell - -``` -Get-WinEvent -LogName Microsoft-Windows-Sysmon/Operational | where {(($_.ID -eq "12" -or $_.ID -eq "13") -and ($_.message -match "TargetObject.*.*SYSTEM\\.*\\services\\localNETService")) } | select TimeCreated,Id,RecordId,ProcessId,MachineName,Message -``` - - -### es-qs - -``` -(winlog.channel:"Microsoft\-Windows\-Sysmon\/Operational" AND winlog.event_id:("12" OR "13") AND winlog.event_data.TargetObject.keyword:(*SYSTEM\\*\\services\\localNETService)) -``` - - -### xpack-watcher - -``` -curl -s -XPUT -H 'Content-Type: application/json' --data-binary @- localhost:9200/_watcher/watch/f7f9ab88-7557-4a69-b30e-0a8f91b3a0e7 <
  • [TA0002: Execution](https://attack.mitre.org/tactics/TA0002)
    • | -| **ATT&CK Technique** |
    • [T1086: PowerShell](https://attack.mitre.org/techniques/T1086)
    | -| **Data Needed** | There is no documented Data Needed for this Detection Rule yet | -| **Trigger** | There is no documented Trigger for this Detection Rule yet | -| **Severity Level** | medium | -| **False Positives** |
    • Programs using PowerShell directly without invocation of a dedicated interpreter
    • MSP Detection Searcher
    • Citrix ConfigSync.ps1
    | -| **Development Status** | experimental | -| **References** |
    • [https://github.com/Cyb3rWard0g/ThreatHunter-Playbook/tree/master/playbooks/windows/02_execution/T1086_powershell/alternate_signed_powershell_hosts.md](https://github.com/Cyb3rWard0g/ThreatHunter-Playbook/tree/master/playbooks/windows/02_execution/T1086_powershell/alternate_signed_powershell_hosts.md)
    | -| **Author** | Roberto Rodriguez @Cyb3rWard0g | -| Other Tags |
    • attack.t1059.001
    | - -## Detection Rules - -### Sigma rule - -``` -title: Alternate PowerShell Hosts -id: 64e8e417-c19a-475a-8d19-98ea705394cc -description: Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe -status: experimental -date: 2019/08/11 -modified: 2020/02/25 -author: Roberto Rodriguez @Cyb3rWard0g -references: - - https://github.com/Cyb3rWard0g/ThreatHunter-Playbook/tree/master/playbooks/windows/02_execution/T1086_powershell/alternate_signed_powershell_hosts.md -tags: - - attack.execution - - attack.t1086 - - attack.t1059.001 -logsource: - product: windows - service: powershell -detection: - selection: - EventID: - - 4103 - - 400 - ContextInfo: '*' - filter: - - ContextInfo: 'powershell.exe' - - Message: 'powershell.exe' - # Both fields contain key=value pairs where the key HostApplication ist relevant but - # can't be referred directly as event field. - condition: selection and not filter -falsepositives: - - Programs using PowerShell directly without invocation of a dedicated interpreter - - MSP Detection Searcher - - Citrix ConfigSync.ps1 -level: medium - -``` - - - - - -### powershell - -``` -Get-WinEvent -LogName Microsoft-Windows-PowerShell/Operational | where {((($_.ID -eq "4103" -or $_.ID -eq "400") -and $_.message -match "ContextInfo.*.*") -and -not ($_.message -match "ContextInfo.*powershell.exe" -or $_.message -match "Message.*powershell.exe")) } | select TimeCreated,Id,RecordId,ProcessId,MachineName,Message -``` - - -### es-qs - -``` -((winlog.event_id:("4103" OR "400") AND ContextInfo.keyword:*) AND (NOT (ContextInfo:"powershell.exe" OR Message:"powershell.exe"))) -``` - - -### xpack-watcher - -``` -curl -s -XPUT -H 'Content-Type: application/json' --data-binary @- localhost:9200/_watcher/watch/64e8e417-c19a-475a-8d19-98ea705394cc <
  • [TA0005: Defense Evasion](https://attack.mitre.org/tactics/TA0005)
    • | -| **ATT&CK Technique** |
    • [T1146: Clear Command History](https://attack.mitre.org/techniques/T1146)
    | -| **Data Needed** |
    • [DN0036_4104_windows_powershell_script_block](../Data_Needed/DN0036_4104_windows_powershell_script_block.md)
    • [DN0037_4103_windows_powershell_executing_pipeline](../Data_Needed/DN0037_4103_windows_powershell_executing_pipeline.md)
    | -| **Trigger** | There is no documented Trigger for this Detection Rule yet | -| **Severity Level** | medium | -| **False Positives** |
    • some PS-scripts
    | -| **Development Status** | experimental | -| **References** |
    • [https://gist.github.com/hook-s3c/7363a856c3cdbadeb71085147f042c1a](https://gist.github.com/hook-s3c/7363a856c3cdbadeb71085147f042c1a)
    | -| **Author** | Ilyas Ochkov, oscd.community | -| Other Tags |
    • attack.t1551.003
    | - -## Detection Rules - -### Sigma rule - -``` -title: Clear PowerShell History -id: dfba4ce1-e0ea-495f-986e-97140f31af2d -status: experimental -description: Detects keywords that could indicate clearing PowerShell history -date: 2019/10/25 -author: Ilyas Ochkov, oscd.community -references: - - https://gist.github.com/hook-s3c/7363a856c3cdbadeb71085147f042c1a -tags: - - attack.defense_evasion - - attack.t1146 - - attack.t1551.003 -logsource: - product: windows - service: powershell -detection: - keywords: - - 'del (Get-PSReadlineOption).HistorySavePath' - - 'Set-PSReadlineOption –HistorySaveStyle SaveNothing' - - 'Remove-Item (Get-PSReadlineOption).HistorySavePath' - - 'rm (Get-PSReadlineOption).HistorySavePath' - condition: keywords -falsepositives: - - some PS-scripts -level: medium - -``` - - - - - -### powershell - -``` -Get-WinEvent -LogName Microsoft-Windows-PowerShell/Operational | where {(($_.message -match "del (Get-PSReadlineOption).HistorySavePath" -or $_.message -match "Set-PSReadlineOption –HistorySaveStyle SaveNothing" -or $_.message -match "Remove-Item (Get-PSReadlineOption).HistorySavePath" -or $_.message -match "rm (Get-PSReadlineOption).HistorySavePath")) } | select TimeCreated,Id,RecordId,ProcessId,MachineName,Message -``` - - -### es-qs - -``` -\*.keyword:(*del\ \(Get\-PSReadlineOption\).HistorySavePath* OR *Set\-PSReadlineOption\ –HistorySaveStyle\ SaveNothing* OR *Remove\-Item\ \(Get\-PSReadlineOption\).HistorySavePath* OR *rm\ \(Get\-PSReadlineOption\).HistorySavePath*) -``` - - -### xpack-watcher - -``` -curl -s -XPUT -H 'Content-Type: application/json' --data-binary @- localhost:9200/_watcher/watch/dfba4ce1-e0ea-495f-986e-97140f31af2d <
  • [TA0002: Execution](https://attack.mitre.org/tactics/TA0002)
  • [TA0003: Persistence](https://attack.mitre.org/tactics/TA0003)
    • | -| **ATT&CK Technique** |
    • [T1086: PowerShell](https://attack.mitre.org/techniques/T1086)
    • [T1136: Create Account](https://attack.mitre.org/techniques/T1136)
    | -| **Data Needed** | There is no documented Data Needed for this Detection Rule yet | -| **Trigger** | There is no documented Trigger for this Detection Rule yet | -| **Severity Level** | medium | -| **False Positives** |
    • Legitimate user creation
    | -| **Development Status** | experimental | -| **References** |
    • [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1136/T1136.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1136/T1136.md)
    | -| **Author** | @ROxPinTeddy | -| Other Tags |
    • attack.t1059.001
    | - -## Detection Rules - -### Sigma rule - -``` -title: PowerShell Create Local User -id: 243de76f-4725-4f2e-8225-a8a69b15ad61 -status: experimental -description: Detects creation of a local user via PowerShell -references: - - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1136/T1136.md -tags: - - attack.execution - - attack.t1086 - - attack.persistence - - attack.t1136 - - attack.t1059.001 -author: '@ROxPinTeddy' -date: 2020/04/11 -logsource: - product: windows - service: powershell -detection: - selection: - EventID: 4104 - Message|contains: - - 'New-LocalUser' - condition: selection -falsepositives: - - Legitimate user creation -level: medium - -``` - - - - - -### powershell - -``` -Get-WinEvent -LogName Microsoft-Windows-PowerShell/Operational | where {($_.ID -eq "4104" -and ($_.message -match "Message.*.*New-LocalUser.*")) } | select TimeCreated,Id,RecordId,ProcessId,MachineName,Message -``` - - -### es-qs - -``` -(winlog.event_id:"4104" AND Message.keyword:(*New\-LocalUser*)) -``` - - -### xpack-watcher - -``` -curl -s -XPUT -H 'Content-Type: application/json' --data-binary @- localhost:9200/_watcher/watch/243de76f-4725-4f2e-8225-a8a69b15ad61 <
  • [TA0010: Exfiltration](https://attack.mitre.org/tactics/TA0010)
    • | -| **ATT&CK Technique** |
    • [T1002: Data Compressed](https://attack.mitre.org/techniques/T1002)
    • [T1560: Archive Collected Data](https://attack.mitre.org/techniques/T1560)
    | -| **Data Needed** | There is no documented Data Needed for this Detection Rule yet | -| **Trigger** |
    • [T1560: Archive Collected Data](../Triggers/T1560.md)
    | -| **Severity Level** | low | -| **False Positives** |
    • highly likely if archive ops are done via PS
    | -| **Development Status** | experimental | -| **References** |
    • [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1002/T1002.yaml](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1002/T1002.yaml)
    | -| **Author** | Timur Zinniatullin, oscd.community | - - -## Detection Rules - -### Sigma rule - -``` -title: Data Compressed - Powershell -id: 6dc5d284-69ea-42cf-9311-fb1c3932a69a -status: experimental -description: An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network -author: Timur Zinniatullin, oscd.community -date: 2019/10/21 -modified: 2019/11/04 -references: - - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1002/T1002.yaml -logsource: - product: windows - service: powershell - description: 'Script block logging must be enabled' -detection: - selection: - EventID: 4104 - keywords|contains|all: - - '-Recurse' - - '|' - - 'Compress-Archive' - condition: selection -falsepositives: - - highly likely if archive ops are done via PS -level: low -tags: - - attack.exfiltration - - attack.t1002 - - attack.t1560 - -``` - - - - - -### powershell - -``` -Get-WinEvent -LogName Microsoft-Windows-PowerShell/Operational | where {($_.ID -eq "4104" -and $_.message -match "keywords.*.*-Recurse.*" -and $_.message -match "keywords.*.*|.*" -and $_.message -match "keywords.*.*Compress-Archive.*") } | select TimeCreated,Id,RecordId,ProcessId,MachineName,Message -``` - - -### es-qs - -``` -(winlog.event_id:"4104" AND keywords.keyword:*\-Recurse* AND keywords.keyword:*|* AND keywords.keyword:*Compress\-Archive*) -``` - - -### xpack-watcher - -``` -curl -s -XPUT -H 'Content-Type: application/json' --data-binary @- localhost:9200/_watcher/watch/6dc5d284-69ea-42cf-9311-fb1c3932a69a <
  • [TA0010: Exfiltration](https://attack.mitre.org/tactics/TA0010)
    • | -| **ATT&CK Technique** |
    • [T1048: Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048)
    | -| **Data Needed** | There is no documented Data Needed for this Detection Rule yet | -| **Trigger** |
    • [T1048: Exfiltration Over Alternative Protocol](../Triggers/T1048.md)
    | -| **Severity Level** | critical | -| **False Positives** |
    • Legitimate usage of PowerShell Dnscat2 — DNS Exfiltration tool (unlikely)
    | -| **Development Status** | experimental | -| **References** | There are no documented References for this Detection Rule yet | -| **Author** | Daniil Yugoslavskiy, oscd.community | - - -## Detection Rules - -### Sigma rule - -``` -title: Dnscat Execution -id: a6d67db4-6220-436d-8afc-f3842fe05d43 -description: Dnscat exfiltration tool execution -status: experimental -author: Daniil Yugoslavskiy, oscd.community -date: 2019/10/24 -tags: - - attack.exfiltration - - attack.t1048 -logsource: - product: windows - service: powershell -detection: - selection: - EventID: 4104 - ScriptBlockText|contains: "Start-Dnscat2" - condition: selection -falsepositives: - - Legitimate usage of PowerShell Dnscat2 — DNS Exfiltration tool (unlikely) -level: critical - -``` - - - - - -### powershell - -``` -Get-WinEvent -LogName Microsoft-Windows-PowerShell/Operational | where {($_.ID -eq "4104" -and $_.message -match "ScriptBlockText.*.*Start-Dnscat2.*") } | select TimeCreated,Id,RecordId,ProcessId,MachineName,Message -``` - - -### es-qs - -``` -(winlog.event_id:"4104" AND ScriptBlockText.keyword:*Start\-Dnscat2*) -``` - - -### xpack-watcher - -``` -curl -s -XPUT -H 'Content-Type: application/json' --data-binary @- localhost:9200/_watcher/watch/a6d67db4-6220-436d-8afc-f3842fe05d43 <
  • [TA0005: Defense Evasion](https://attack.mitre.org/tactics/TA0005)
  • [TA0002: Execution](https://attack.mitre.org/tactics/TA0002)
    • | -| **ATT&CK Technique** |
    • [T1086: PowerShell](https://attack.mitre.org/techniques/T1086)
    | -| **Data Needed** | There is no documented Data Needed for this Detection Rule yet | -| **Trigger** | There is no documented Trigger for this Detection Rule yet | -| **Severity Level** | medium | -| **False Positives** |
    • Penetration Test
    • Unknown
    | -| **Development Status** | experimental | -| **References** |
    • [http://www.leeholmes.com/blog/2017/03/17/detecting-and-preventing-powershell-downgrade-attacks/](http://www.leeholmes.com/blog/2017/03/17/detecting-and-preventing-powershell-downgrade-attacks/)
    | -| **Author** | Florian Roth (rule), Lee Holmes (idea), Harish Segar (improvements) | -| Other Tags |
    • attack.t1059.001
    | - -## Detection Rules - -### Sigma rule - -``` -title: PowerShell Downgrade Attack -id: 6331d09b-4785-4c13-980f-f96661356249 -status: experimental -description: Detects PowerShell downgrade attack by comparing the host versions with the actually used engine version 2.0 -references: - - http://www.leeholmes.com/blog/2017/03/17/detecting-and-preventing-powershell-downgrade-attacks/ -tags: - - attack.defense_evasion - - attack.execution - - attack.t1086 - - attack.t1059.001 -author: Florian Roth (rule), Lee Holmes (idea), Harish Segar (improvements) -date: 2017/03/22 -modified: 2020/03/20 -logsource: - product: windows - service: powershell-classic -detection: - selection: - EventID: 400 - EngineVersion|startswith: '2.' - filter: - HostVersion|startswith: '2.' - condition: selection and not filter -falsepositives: - - Penetration Test - - Unknown -level: medium - -``` - - - - - -### powershell - -``` -Get-WinEvent -LogName Windows PowerShell | where {(($_.ID -eq "400" -and $_.message -match "EngineVersion.*2..*") -and -not ($_.message -match "HostVersion.*2..*")) } | select TimeCreated,Id,RecordId,ProcessId,MachineName,Message -``` - - -### es-qs - -``` -((winlog.event_id:"400" AND winlog.event_data.EngineVersion.keyword:2.*) AND (NOT (winlog.event_data.HostVersion.keyword:2.*))) -``` - - -### xpack-watcher - -``` -curl -s -XPUT -H 'Content-Type: application/json' --data-binary @- localhost:9200/_watcher/watch/6331d09b-4785-4c13-980f-f96661356249 <
  • [TA0005: Defense Evasion](https://attack.mitre.org/tactics/TA0005)
  • [TA0002: Execution](https://attack.mitre.org/tactics/TA0002)
    • | -| **ATT&CK Technique** |
    • [T1086: PowerShell](https://attack.mitre.org/techniques/T1086)
    | -| **Data Needed** | There is no documented Data Needed for this Detection Rule yet | -| **Trigger** | There is no documented Trigger for this Detection Rule yet | -| **Severity Level** | high | -| **False Positives** |
    • Penetration Tests
    • Unknown
    | -| **Development Status** | experimental | -| **References** |
    • [https://adsecurity.org/?p=2921](https://adsecurity.org/?p=2921)
    | -| **Author** | Sean Metcalf (source), Florian Roth (rule) | -| Other Tags |
    • attack.t1059.001
    | - -## Detection Rules - -### Sigma rule - -``` -title: PowerShell Called from an Executable Version Mismatch -id: c70e019b-1479-4b65-b0cc-cd0c6093a599 -status: experimental -description: Detects PowerShell called from an executable by the version mismatch method -references: - - https://adsecurity.org/?p=2921 -tags: - - attack.defense_evasion - - attack.execution - - attack.t1086 - - attack.t1059.001 -author: Sean Metcalf (source), Florian Roth (rule) -date: 2017/03/05 -logsource: - product: windows - service: powershell-classic -detection: - selection1: - EventID: 400 - EngineVersion: - - '2.*' - - '4.*' - - '5.*' - HostVersion: '3.*' - condition: selection1 -falsepositives: - - Penetration Tests - - Unknown -level: high - -``` - - - - - -### powershell - -``` -Get-WinEvent -LogName Windows PowerShell | where {($_.ID -eq "400" -and ($_.message -match "EngineVersion.*2..*" -or $_.message -match "EngineVersion.*4..*" -or $_.message -match "EngineVersion.*5..*") -and $_.message -match "HostVersion.*3..*") } | select TimeCreated,Id,RecordId,ProcessId,MachineName,Message -``` - - -### es-qs - -``` -(winlog.event_id:"400" AND winlog.event_data.EngineVersion.keyword:(2.* OR 4.* OR 5.*) AND winlog.event_data.HostVersion.keyword:3.*) -``` - - -### xpack-watcher - -``` -curl -s -XPUT -H 'Content-Type: application/json' --data-binary @- localhost:9200/_watcher/watch/c70e019b-1479-4b65-b0cc-cd0c6093a599 <
  • [TA0005: Defense Evasion](https://attack.mitre.org/tactics/TA0005)
    • | -| **ATT&CK Technique** |
    • [T1027: Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027)
    | -| **Data Needed** | There is no documented Data Needed for this Detection Rule yet | -| **Trigger** |
    • [T1027: Obfuscated Files or Information](../Triggers/T1027.md)
    | -| **Severity Level** | high | -| **False Positives** |
    • Unknown
    | -| **Development Status** | experimental | -| **References** | There are no documented References for this Detection Rule yet | -| **Author** | Daniel Bohannon (@Mandiant/@FireEye), oscd.community | - - -## Detection Rules - -### Sigma rule - -``` -title: Invoke-Obfuscation Obfuscated IEX Invocation -id: 1b9dc62e-6e9e-42a3-8990-94d7a10007f7 -description: "Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the following code block \u2014 https://github.com/danielbohannon/Invoke-Obfuscation/blob/master/Out-ObfuscatedStringCommand.ps1#L873-L888" -status: experimental -author: Daniel Bohannon (@Mandiant/@FireEye), oscd.community -date: 2019/11/08 -tags: - - attack.defense_evasion - - attack.t1027 -logsource: - product: windows - service: powershell -detection: - selection_1: - EventID: 4104 - selection_2: - - ScriptBlockText|re: '\$PSHome\[\s*\d{1,3}\s*\]\s*\+\s*\$PSHome\[' - - ScriptBlockText|re: '\$ShellId\[\s*\d{1,3}\s*\]\s*\+\s*\$ShellId\[' - - ScriptBlockText|re: '\$env:Public\[\s*\d{1,3}\s*\]\s*\+\s*\$env:Public\[' - - ScriptBlockText|re: '\$env:ComSpec\[(\s*\d{1,3}\s*,){2}' - - ScriptBlockText|re: '\*mdr\*\W\s*\)\.Name' - - ScriptBlockText|re: '\$VerbosePreference\.ToString\(' - - ScriptBlockText|re: '\String\]\s*\$VerbosePreference' - selection_3: - EventID: 4103 - selection_4: - - Payload|re: '\$PSHome\[\s*\d{1,3}\s*\]\s*\+\s*\$PSHome\[' - - Payload|re: '\$ShellId\[\s*\d{1,3}\s*\]\s*\+\s*\$ShellId\[' - - Payload|re: '\$env:Public\[\s*\d{1,3}\s*\]\s*\+\s*\$env:Public\[' - - Payload|re: '\$env:ComSpec\[(\s*\d{1,3}\s*,){2}' - - Payload|re: '\*mdr\*\W\s*\)\.Name' - - Payload|re: '\$VerbosePreference\.ToString\(' - - Payload|re: '\String\]\s*\$VerbosePreference' - condition: ( selection_1 and selection_2 ) or ( selection_3 and selection_4 ) -falsepositives: - - Unknown -level: high - -``` - - - - - -### powershell - -``` -An unsupported feature is required for this Sigma rule (detection_rules/sigma/rules/windows/powershell/powershell_invoke_obfuscation_obfuscated_iex.yml): Backend does not support map values of type -Feel free to contribute for fun and fame, this is open source :) -> https://github.com/Neo23x0/sigma -``` - - -### es-qs - -``` -((winlog.event_id:"4104" AND (ScriptBlockText:/\$PSHome\[\s*\d{1,3}\s*\]\s*\+\s*\$PSHome\[/ OR ScriptBlockText:/\$ShellId\[\s*\d{1,3}\s*\]\s*\+\s*\$ShellId\[/ OR ScriptBlockText:/\$env:Public\[\s*\d{1,3}\s*\]\s*\+\s*\$env:Public\[/ OR ScriptBlockText:/\$env:ComSpec\[(\s*\d{1,3}\s*,){2}/ OR ScriptBlockText:/\*mdr\*\W\s*\)\.Name/ OR ScriptBlockText:/\$VerbosePreference\.ToString\(/ OR ScriptBlockText:/\String\]\s*\$VerbosePreference/)) OR (winlog.event_id:"4103" AND (Payload:/\$PSHome\[\s*\d{1,3}\s*\]\s*\+\s*\$PSHome\[/ OR Payload:/\$ShellId\[\s*\d{1,3}\s*\]\s*\+\s*\$ShellId\[/ OR Payload:/\$env:Public\[\s*\d{1,3}\s*\]\s*\+\s*\$env:Public\[/ OR Payload:/\$env:ComSpec\[(\s*\d{1,3}\s*,){2}/ OR Payload:/\*mdr\*\W\s*\)\.Name/ OR Payload:/\$VerbosePreference\.ToString\(/ OR Payload:/\String\]\s*\$VerbosePreference/))) -``` - - -### xpack-watcher - -``` -curl -s -XPUT -H 'Content-Type: application/json' --data-binary @- localhost:9200/_watcher/watch/1b9dc62e-6e9e-42a3-8990-94d7a10007f7 < https://github.com/Neo23x0/sigma -``` - - -### logpoint - -``` -An unsupported feature is required for this Sigma rule (detection_rules/sigma/rules/windows/powershell/powershell_invoke_obfuscation_obfuscated_iex.yml): Type modifier 're' is not supported by backend -Feel free to contribute for fun and fame, this is open source :) -> https://github.com/Neo23x0/sigma -``` - - -### grep - -``` -An unsupported feature is required for this Sigma rule (detection_rules/sigma/rules/windows/powershell/powershell_invoke_obfuscation_obfuscated_iex.yml): Node type not implemented for this backend -Feel free to contribute for fun and fame, this is open source :) -> https://github.com/Neo23x0/sigma -``` - - - diff --git a/Atomic_Threat_Coverage/Detection_Rules/powershell_malicious_commandlets.md b/Atomic_Threat_Coverage/Detection_Rules/powershell_malicious_commandlets.md deleted file mode 100644 index 19c8673..0000000 --- a/Atomic_Threat_Coverage/Detection_Rules/powershell_malicious_commandlets.md +++ /dev/null @@ -1,273 +0,0 @@ -| Title | Malicious PowerShell Commandlets | -|:-------------------------|:------------------| -| **Description** | Detects Commandlet names from well-known PowerShell exploitation frameworks | -| **ATT&CK Tactic** |
    • [TA0002: Execution](https://attack.mitre.org/tactics/TA0002)
    | -| **ATT&CK Technique** |
    • [T1086: PowerShell](https://attack.mitre.org/techniques/T1086)
    | -| **Data Needed** | There is no documented Data Needed for this Detection Rule yet | -| **Trigger** | There is no documented Trigger for this Detection Rule yet | -| **Severity Level** | high | -| **False Positives** |
    • Penetration testing
    | -| **Development Status** | experimental | -| **References** |
    • [https://adsecurity.org/?p=2921](https://adsecurity.org/?p=2921)
    | -| **Author** | Sean Metcalf (source), Florian Roth (rule) | -| Other Tags |
    • attack.t1059.001
    | - -## Detection Rules - -### Sigma rule - -``` -title: Malicious PowerShell Commandlets -id: 89819aa4-bbd6-46bc-88ec-c7f7fe30efa6 -status: experimental -description: Detects Commandlet names from well-known PowerShell exploitation frameworks -modified: 2019/01/22 -references: - - https://adsecurity.org/?p=2921 -tags: - - attack.execution - - attack.t1086 - - attack.t1059.001 -author: Sean Metcalf (source), Florian Roth (rule) -date: 2017/03/05 -logsource: - product: windows - service: powershell - definition: 'It is recommended to use the new "Script Block Logging" of PowerShell v5 https://adsecurity.org/?p=2277' -detection: - keywords: - Message: - - "*Invoke-DllInjection*" - - "*Invoke-Shellcode*" - - "*Invoke-WmiCommand*" - - "*Get-GPPPassword*" - - "*Get-Keystrokes*" - - "*Get-TimedScreenshot*" - - "*Get-VaultCredential*" - - "*Invoke-CredentialInjection*" - - "*Invoke-Mimikatz*" - - "*Invoke-NinjaCopy*" - - "*Invoke-TokenManipulation*" - - "*Out-Minidump*" - - "*VolumeShadowCopyTools*" - - "*Invoke-ReflectivePEInjection*" - - "*Invoke-UserHunter*" - - "*Find-GPOLocation*" - - "*Invoke-ACLScanner*" - - "*Invoke-DowngradeAccount*" - - "*Get-ServiceUnquoted*" - - "*Get-ServiceFilePermission*" - - "*Get-ServicePermission*" - - "*Invoke-ServiceAbuse*" - - "*Install-ServiceBinary*" - - "*Get-RegAutoLogon*" - - "*Get-VulnAutoRun*" - - "*Get-VulnSchTask*" - - "*Get-UnattendedInstallFile*" - - "*Get-ApplicationHost*" - - "*Get-RegAlwaysInstallElevated*" - - "*Get-Unconstrained*" - - "*Add-RegBackdoor*" - - "*Add-ScrnSaveBackdoor*" - - "*Gupt-Backdoor*" - - "*Invoke-ADSBackdoor*" - - "*Enabled-DuplicateToken*" - - "*Invoke-PsUaCme*" - - "*Remove-Update*" - - "*Check-VM*" - - "*Get-LSASecret*" - - "*Get-PassHashes*" - - "*Show-TargetScreen*" - - "*Port-Scan*" - - "*Invoke-PoshRatHttp*" - - "*Invoke-PowerShellTCP*" - - "*Invoke-PowerShellWMI*" - - "*Add-Exfiltration*" - - "*Add-Persistence*" - - "*Do-Exfiltration*" - - "*Start-CaptureServer*" - - "*Get-ChromeDump*" - - "*Get-ClipboardContents*" - - "*Get-FoxDump*" - - "*Get-IndexedItem*" - - "*Get-Screenshot*" - - "*Invoke-Inveigh*" - - "*Invoke-NetRipper*" - - "*Invoke-EgressCheck*" - - "*Invoke-PostExfil*" - - "*Invoke-PSInject*" - - "*Invoke-RunAs*" - - "*MailRaider*" - - "*New-HoneyHash*" - - "*Set-MacAttribute*" - - "*Invoke-DCSync*" - - "*Invoke-PowerDump*" - - "*Exploit-Jboss*" - - "*Invoke-ThunderStruck*" - - "*Invoke-VoiceTroll*" - - "*Set-Wallpaper*" - - "*Invoke-InveighRelay*" - - "*Invoke-PsExec*" - - "*Invoke-SSHCommand*" - - "*Get-SecurityPackages*" - - "*Install-SSP*" - - "*Invoke-BackdoorLNK*" - - "*PowerBreach*" - - "*Get-SiteListPassword*" - - "*Get-System*" - - "*Invoke-BypassUAC*" - - "*Invoke-Tater*" - - "*Invoke-WScriptBypassUAC*" - - "*PowerUp*" - - "*PowerView*" - - "*Get-RickAstley*" - - "*Find-Fruit*" - - "*HTTP-Login*" - - "*Find-TrustedDocuments*" - - "*Invoke-Paranoia*" - - "*Invoke-WinEnum*" - - "*Invoke-ARPScan*" - - "*Invoke-PortScan*" - - "*Invoke-ReverseDNSLookup*" - - "*Invoke-SMBScanner*" - - "*Invoke-Mimikittenz*" - - "*Invoke-AllChecks*" - false_positives: - - Get-SystemDriveInfo # http://bheltborg.dk/Windows/WinSxS/amd64_microsoft-windows-maintenancediagnostic_31bf3856ad364e35_10.0.10240.16384_none_91ef7543a4514b5e/CL_Utility.ps1 - condition: keywords and not false_positives -falsepositives: - - Penetration testing -level: high - -``` - - - - - -### powershell - -``` -Get-WinEvent -LogName Microsoft-Windows-PowerShell/Operational | where {(($_.message -match "Message.*.*Invoke-DllInjection.*" -or $_.message -match "Message.*.*Invoke-Shellcode.*" -or $_.message -match "Message.*.*Invoke-WmiCommand.*" -or $_.message -match "Message.*.*Get-GPPPassword.*" -or $_.message -match "Message.*.*Get-Keystrokes.*" -or $_.message -match "Message.*.*Get-TimedScreenshot.*" -or $_.message -match "Message.*.*Get-VaultCredential.*" -or $_.message -match "Message.*.*Invoke-CredentialInjection.*" -or $_.message -match "Message.*.*Invoke-Mimikatz.*" -or $_.message -match "Message.*.*Invoke-NinjaCopy.*" -or $_.message -match "Message.*.*Invoke-TokenManipulation.*" -or $_.message -match "Message.*.*Out-Minidump.*" -or $_.message -match "Message.*.*VolumeShadowCopyTools.*" -or $_.message -match "Message.*.*Invoke-ReflectivePEInjection.*" -or $_.message -match "Message.*.*Invoke-UserHunter.*" -or $_.message -match "Message.*.*Find-GPOLocation.*" -or $_.message -match "Message.*.*Invoke-ACLScanner.*" -or $_.message -match "Message.*.*Invoke-DowngradeAccount.*" -or $_.message -match "Message.*.*Get-ServiceUnquoted.*" -or $_.message -match "Message.*.*Get-ServiceFilePermission.*" -or $_.message -match "Message.*.*Get-ServicePermission.*" -or $_.message -match "Message.*.*Invoke-ServiceAbuse.*" -or $_.message -match "Message.*.*Install-ServiceBinary.*" -or $_.message -match "Message.*.*Get-RegAutoLogon.*" -or $_.message -match "Message.*.*Get-VulnAutoRun.*" -or $_.message -match "Message.*.*Get-VulnSchTask.*" -or $_.message -match "Message.*.*Get-UnattendedInstallFile.*" -or $_.message -match "Message.*.*Get-ApplicationHost.*" -or $_.message -match "Message.*.*Get-RegAlwaysInstallElevated.*" -or $_.message -match "Message.*.*Get-Unconstrained.*" -or $_.message -match "Message.*.*Add-RegBackdoor.*" -or $_.message -match "Message.*.*Add-ScrnSaveBackdoor.*" -or $_.message -match "Message.*.*Gupt-Backdoor.*" -or $_.message -match "Message.*.*Invoke-ADSBackdoor.*" -or $_.message -match "Message.*.*Enabled-DuplicateToken.*" -or $_.message -match "Message.*.*Invoke-PsUaCme.*" -or $_.message -match "Message.*.*Remove-Update.*" -or $_.message -match "Message.*.*Check-VM.*" -or $_.message -match "Message.*.*Get-LSASecret.*" -or $_.message -match "Message.*.*Get-PassHashes.*" -or $_.message -match "Message.*.*Show-TargetScreen.*" -or $_.message -match "Message.*.*Port-Scan.*" -or $_.message -match "Message.*.*Invoke-PoshRatHttp.*" -or $_.message -match "Message.*.*Invoke-PowerShellTCP.*" -or $_.message -match "Message.*.*Invoke-PowerShellWMI.*" -or $_.message -match "Message.*.*Add-Exfiltration.*" -or $_.message -match "Message.*.*Add-Persistence.*" -or $_.message -match "Message.*.*Do-Exfiltration.*" -or $_.message -match "Message.*.*Start-CaptureServer.*" -or $_.message -match "Message.*.*Get-ChromeDump.*" -or $_.message -match "Message.*.*Get-ClipboardContents.*" -or $_.message -match "Message.*.*Get-FoxDump.*" -or $_.message -match "Message.*.*Get-IndexedItem.*" -or $_.message -match "Message.*.*Get-Screenshot.*" -or $_.message -match "Message.*.*Invoke-Inveigh.*" -or $_.message -match "Message.*.*Invoke-NetRipper.*" -or $_.message -match "Message.*.*Invoke-EgressCheck.*" -or $_.message -match "Message.*.*Invoke-PostExfil.*" -or $_.message -match "Message.*.*Invoke-PSInject.*" -or $_.message -match "Message.*.*Invoke-RunAs.*" -or $_.message -match "Message.*.*MailRaider.*" -or $_.message -match "Message.*.*New-HoneyHash.*" -or $_.message -match "Message.*.*Set-MacAttribute.*" -or $_.message -match "Message.*.*Invoke-DCSync.*" -or $_.message -match "Message.*.*Invoke-PowerDump.*" -or $_.message -match "Message.*.*Exploit-Jboss.*" -or $_.message -match "Message.*.*Invoke-ThunderStruck.*" -or $_.message -match "Message.*.*Invoke-VoiceTroll.*" -or $_.message -match "Message.*.*Set-Wallpaper.*" -or $_.message -match "Message.*.*Invoke-InveighRelay.*" -or $_.message -match "Message.*.*Invoke-PsExec.*" -or $_.message -match "Message.*.*Invoke-SSHCommand.*" -or $_.message -match "Message.*.*Get-SecurityPackages.*" -or $_.message -match "Message.*.*Install-SSP.*" -or $_.message -match "Message.*.*Invoke-BackdoorLNK.*" -or $_.message -match "Message.*.*PowerBreach.*" -or $_.message -match "Message.*.*Get-SiteListPassword.*" -or $_.message -match "Message.*.*Get-System.*" -or $_.message -match "Message.*.*Invoke-BypassUAC.*" -or $_.message -match "Message.*.*Invoke-Tater.*" -or $_.message -match "Message.*.*Invoke-WScriptBypassUAC.*" -or $_.message -match "Message.*.*PowerUp.*" -or $_.message -match "Message.*.*PowerView.*" -or $_.message -match "Message.*.*Get-RickAstley.*" -or $_.message -match "Message.*.*Find-Fruit.*" -or $_.message -match "Message.*.*HTTP-Login.*" -or $_.message -match "Message.*.*Find-TrustedDocuments.*" -or $_.message -match "Message.*.*Invoke-Paranoia.*" -or $_.message -match "Message.*.*Invoke-WinEnum.*" -or $_.message -match "Message.*.*Invoke-ARPScan.*" -or $_.message -match "Message.*.*Invoke-PortScan.*" -or $_.message -match "Message.*.*Invoke-ReverseDNSLookup.*" -or $_.message -match "Message.*.*Invoke-SMBScanner.*" -or $_.message -match "Message.*.*Invoke-Mimikittenz.*" -or $_.message -match "Message.*.*Invoke-AllChecks.*") -and -not ($_.message -match "Get-SystemDriveInfo")) } | select TimeCreated,Id,RecordId,ProcessId,MachineName,Message -``` - - -### es-qs - -``` -(Message.keyword:(*Invoke\-DllInjection* OR *Invoke\-Shellcode* OR *Invoke\-WmiCommand* OR *Get\-GPPPassword* OR *Get\-Keystrokes* OR *Get\-TimedScreenshot* OR *Get\-VaultCredential* OR *Invoke\-CredentialInjection* OR *Invoke\-Mimikatz* OR *Invoke\-NinjaCopy* OR *Invoke\-TokenManipulation* OR *Out\-Minidump* OR *VolumeShadowCopyTools* OR *Invoke\-ReflectivePEInjection* OR *Invoke\-UserHunter* OR *Find\-GPOLocation* OR *Invoke\-ACLScanner* OR *Invoke\-DowngradeAccount* OR *Get\-ServiceUnquoted* OR *Get\-ServiceFilePermission* OR *Get\-ServicePermission* OR *Invoke\-ServiceAbuse* OR *Install\-ServiceBinary* OR *Get\-RegAutoLogon* OR *Get\-VulnAutoRun* OR *Get\-VulnSchTask* OR *Get\-UnattendedInstallFile* OR *Get\-ApplicationHost* OR *Get\-RegAlwaysInstallElevated* OR *Get\-Unconstrained* OR *Add\-RegBackdoor* OR *Add\-ScrnSaveBackdoor* OR *Gupt\-Backdoor* OR *Invoke\-ADSBackdoor* OR *Enabled\-DuplicateToken* OR *Invoke\-PsUaCme* OR *Remove\-Update* OR *Check\-VM* OR *Get\-LSASecret* OR *Get\-PassHashes* OR *Show\-TargetScreen* OR *Port\-Scan* OR *Invoke\-PoshRatHttp* OR *Invoke\-PowerShellTCP* OR *Invoke\-PowerShellWMI* OR *Add\-Exfiltration* OR *Add\-Persistence* OR *Do\-Exfiltration* OR *Start\-CaptureServer* OR *Get\-ChromeDump* OR *Get\-ClipboardContents* OR *Get\-FoxDump* OR *Get\-IndexedItem* OR *Get\-Screenshot* OR *Invoke\-Inveigh* OR *Invoke\-NetRipper* OR *Invoke\-EgressCheck* OR *Invoke\-PostExfil* OR *Invoke\-PSInject* OR *Invoke\-RunAs* OR *MailRaider* OR *New\-HoneyHash* OR *Set\-MacAttribute* OR *Invoke\-DCSync* OR *Invoke\-PowerDump* OR *Exploit\-Jboss* OR *Invoke\-ThunderStruck* OR *Invoke\-VoiceTroll* OR *Set\-Wallpaper* OR *Invoke\-InveighRelay* OR *Invoke\-PsExec* OR *Invoke\-SSHCommand* OR *Get\-SecurityPackages* OR *Install\-SSP* OR *Invoke\-BackdoorLNK* OR *PowerBreach* OR *Get\-SiteListPassword* OR *Get\-System* OR *Invoke\-BypassUAC* OR *Invoke\-Tater* OR *Invoke\-WScriptBypassUAC* OR *PowerUp* OR *PowerView* OR *Get\-RickAstley* OR *Find\-Fruit* OR *HTTP\-Login* OR *Find\-TrustedDocuments* OR *Invoke\-Paranoia* OR *Invoke\-WinEnum* OR *Invoke\-ARPScan* OR *Invoke\-PortScan* OR *Invoke\-ReverseDNSLookup* OR *Invoke\-SMBScanner* OR *Invoke\-Mimikittenz* OR *Invoke\-AllChecks*) AND (NOT \*.keyword:(*Get\-SystemDriveInfo*))) -``` - - -### xpack-watcher - -``` -curl -s -XPUT -H 'Content-Type: application/json' --data-binary @- localhost:9200/_watcher/watch/89819aa4-bbd6-46bc-88ec-c7f7fe30efa6 <
  • [TA0002: Execution](https://attack.mitre.org/tactics/TA0002)
    • | -| **ATT&CK Technique** |
    • [T1086: PowerShell](https://attack.mitre.org/techniques/T1086)
    | -| **Data Needed** | There is no documented Data Needed for this Detection Rule yet | -| **Trigger** | There is no documented Trigger for this Detection Rule yet | -| **Severity Level** | high | -| **False Positives** |
    • Penetration tests
    | -| **Development Status** | experimental | -| **References** |
    • [https://adsecurity.org/?p=2921](https://adsecurity.org/?p=2921)
    | -| **Author** | Sean Metcalf (source), Florian Roth (rule) | -| Other Tags |
    • attack.t1059.001
    | - -## Detection Rules - -### Sigma rule - -``` -title: Malicious PowerShell Keywords -id: f62176f3-8128-4faa-bf6c-83261322e5eb -status: experimental -description: Detects keywords from well-known PowerShell exploitation frameworks -modified: 2019/01/22 -references: - - https://adsecurity.org/?p=2921 -tags: - - attack.execution - - attack.t1086 - - attack.t1059.001 -author: Sean Metcalf (source), Florian Roth (rule) -date: 2017/03/05 -logsource: - product: windows - service: powershell - definition: 'It is recommended to use the new "Script Block Logging" of PowerShell v5 https://adsecurity.org/?p=2277' -detection: - keywords: - Message: - - "*AdjustTokenPrivileges*" - - "*IMAGE_NT_OPTIONAL_HDR64_MAGIC*" - - "*Microsoft.Win32.UnsafeNativeMethods*" - - "*ReadProcessMemory.Invoke*" - - "*SE_PRIVILEGE_ENABLED*" - - "*LSA_UNICODE_STRING*" - - "*MiniDumpWriteDump*" - - "*PAGE_EXECUTE_READ*" - - "*SECURITY_DELEGATION*" - - "*TOKEN_ADJUST_PRIVILEGES*" - - "*TOKEN_ALL_ACCESS*" - - "*TOKEN_ASSIGN_PRIMARY*" - - "*TOKEN_DUPLICATE*" - - "*TOKEN_ELEVATION*" - - "*TOKEN_IMPERSONATE*" - - "*TOKEN_INFORMATION_CLASS*" - - "*TOKEN_PRIVILEGES*" - - "*TOKEN_QUERY*" - - "*Metasploit*" - - "*Mimikatz*" - condition: keywords -falsepositives: - - Penetration tests -level: high - -``` - - - - - -### powershell - -``` -Get-WinEvent -LogName Microsoft-Windows-PowerShell/Operational | where {(($_.message -match "Message.*.*AdjustTokenPrivileges.*" -or $_.message -match "Message.*.*IMAGE_NT_OPTIONAL_HDR64_MAGIC.*" -or $_.message -match "Message.*.*Microsoft.Win32.UnsafeNativeMethods.*" -or $_.message -match "Message.*.*ReadProcessMemory.Invoke.*" -or $_.message -match "Message.*.*SE_PRIVILEGE_ENABLED.*" -or $_.message -match "Message.*.*LSA_UNICODE_STRING.*" -or $_.message -match "Message.*.*MiniDumpWriteDump.*" -or $_.message -match "Message.*.*PAGE_EXECUTE_READ.*" -or $_.message -match "Message.*.*SECURITY_DELEGATION.*" -or $_.message -match "Message.*.*TOKEN_ADJUST_PRIVILEGES.*" -or $_.message -match "Message.*.*TOKEN_ALL_ACCESS.*" -or $_.message -match "Message.*.*TOKEN_ASSIGN_PRIMARY.*" -or $_.message -match "Message.*.*TOKEN_DUPLICATE.*" -or $_.message -match "Message.*.*TOKEN_ELEVATION.*" -or $_.message -match "Message.*.*TOKEN_IMPERSONATE.*" -or $_.message -match "Message.*.*TOKEN_INFORMATION_CLASS.*" -or $_.message -match "Message.*.*TOKEN_PRIVILEGES.*" -or $_.message -match "Message.*.*TOKEN_QUERY.*" -or $_.message -match "Message.*.*Metasploit.*" -or $_.message -match "Message.*.*Mimikatz.*")) } | select TimeCreated,Id,RecordId,ProcessId,MachineName,Message -``` - - -### es-qs - -``` -Message.keyword:(*AdjustTokenPrivileges* OR *IMAGE_NT_OPTIONAL_HDR64_MAGIC* OR *Microsoft.Win32.UnsafeNativeMethods* OR *ReadProcessMemory.Invoke* OR *SE_PRIVILEGE_ENABLED* OR *LSA_UNICODE_STRING* OR *MiniDumpWriteDump* OR *PAGE_EXECUTE_READ* OR *SECURITY_DELEGATION* OR *TOKEN_ADJUST_PRIVILEGES* OR *TOKEN_ALL_ACCESS* OR *TOKEN_ASSIGN_PRIMARY* OR *TOKEN_DUPLICATE* OR *TOKEN_ELEVATION* OR *TOKEN_IMPERSONATE* OR *TOKEN_INFORMATION_CLASS* OR *TOKEN_PRIVILEGES* OR *TOKEN_QUERY* OR *Metasploit* OR *Mimikatz*) -``` - - -### xpack-watcher - -``` -curl -s -XPUT -H 'Content-Type: application/json' --data-binary @- localhost:9200/_watcher/watch/f62176f3-8128-4faa-bf6c-83261322e5eb <
  • [TA0002: Execution](https://attack.mitre.org/tactics/TA0002)
    • | -| **ATT&CK Technique** |
    • [T1086: PowerShell](https://attack.mitre.org/techniques/T1086)
    | -| **Data Needed** |
    • [DN0036_4104_windows_powershell_script_block](../Data_Needed/DN0036_4104_windows_powershell_script_block.md)
    • [DN0037_4103_windows_powershell_executing_pipeline](../Data_Needed/DN0037_4103_windows_powershell_executing_pipeline.md)
    | -| **Trigger** | There is no documented Trigger for this Detection Rule yet | -| **Severity Level** | high | -| **False Positives** |
    • Penetration testing
    | -| **Development Status** | experimental | -| **References** |
    • [https://github.com/samratashok/nishang](https://github.com/samratashok/nishang)
    | -| **Author** | Alec Costello | -| Other Tags |
    • attack.t1059.001
    | - -## Detection Rules - -### Sigma rule - -``` -title: Malicious Nishang PowerShell Commandlets -id: f772cee9-b7c2-4cb2-8f07-49870adc02e0 -status: experimental -description: Detects Commandlet names and arguments from the Nishang exploitation framework -date: 2019/05/16 -references: - - https://github.com/samratashok/nishang -tags: - - attack.execution - - attack.t1086 - - attack.t1059.001 -author: Alec Costello -logsource: - product: windows - service: powershell - definition: It is recommanded to use the new "Script Block Logging" of PowerShell v5 https://adsecurity.org/?p=2277 -detection: - keywords: - - Add-ConstrainedDelegationBackdoor - - Set-DCShadowPermissions - - DNS_TXT_Pwnage - - Execute-OnTime - - HTTP-Backdoor - - Set-RemotePSRemoting - - Set-RemoteWMI - - Invoke-AmsiBypass - - Out-CHM - - Out-HTA - - Out-SCF - - Out-SCT - - Out-Shortcut - - Out-WebQuery - - Out-Word - - Enable-Duplication - - Remove-Update - - Download-Execute-PS - - Download_Execute - - Execute-Command-MSSQL - - Execute-DNSTXT-Code - - Out-RundllCommand - - Copy-VSS - - FireBuster - - FireListener - - Get-Information - - Get-PassHints - - Get-WLAN-Keys - - Get-Web-Credentials - - Invoke-CredentialsPhish - - Invoke-MimikatzWDigestDowngrade - - Invoke-SSIDExfil - - Invoke-SessionGopher - - Keylogger - - Invoke-Interceptor - - Create-MultipleSessions - - Invoke-NetworkRelay - - Run-EXEonRemote - - Invoke-Prasadhak - - Invoke-BruteForce - - Password-List - - Invoke-JSRatRegsvr - - Invoke-JSRatRundll - - Invoke-PoshRatHttps - - Invoke-PowerShellIcmp - - Invoke-PowerShellUdp - - Invoke-PSGcat - - Invoke-PsGcatAgent - - Remove-PoshRat - - Add-Persistance - - ExetoText - - Invoke-Decode - - Invoke-Encode - - Parse_Keys - - Remove-Persistence - - StringtoBase64 - - TexttoExe - - Powerpreter - - Nishang - - EncodedData - - DataToEncode - - LoggedKeys - - OUT-DNSTXT - - Jitter - - ExfilOption - - Tamper - - DumpCerts - - DumpCreds - - Shellcode32 - - Shellcode64 - - NotAllNameSpaces - - exfill - - FakeDC - - Exploit - condition: keywords -falsepositives: - - Penetration testing -level: high - -``` - - - - - -### powershell - -``` -Get-WinEvent -LogName Microsoft-Windows-PowerShell/Operational | where {(($_.message -match "Add-ConstrainedDelegationBackdoor" -or $_.message -match "Set-DCShadowPermissions" -or $_.message -match "DNS_TXT_Pwnage" -or $_.message -match "Execute-OnTime" -or $_.message -match "HTTP-Backdoor" -or $_.message -match "Set-RemotePSRemoting" -or $_.message -match "Set-RemoteWMI" -or $_.message -match "Invoke-AmsiBypass" -or $_.message -match "Out-CHM" -or $_.message -match "Out-HTA" -or $_.message -match "Out-SCF" -or $_.message -match "Out-SCT" -or $_.message -match "Out-Shortcut" -or $_.message -match "Out-WebQuery" -or $_.message -match "Out-Word" -or $_.message -match "Enable-Duplication" -or $_.message -match "Remove-Update" -or $_.message -match "Download-Execute-PS" -or $_.message -match "Download_Execute" -or $_.message -match "Execute-Command-MSSQL" -or $_.message -match "Execute-DNSTXT-Code" -or $_.message -match "Out-RundllCommand" -or $_.message -match "Copy-VSS" -or $_.message -match "FireBuster" -or $_.message -match "FireListener" -or $_.message -match "Get-Information" -or $_.message -match "Get-PassHints" -or $_.message -match "Get-WLAN-Keys" -or $_.message -match "Get-Web-Credentials" -or $_.message -match "Invoke-CredentialsPhish" -or $_.message -match "Invoke-MimikatzWDigestDowngrade" -or $_.message -match "Invoke-SSIDExfil" -or $_.message -match "Invoke-SessionGopher" -or $_.message -match "Keylogger" -or $_.message -match "Invoke-Interceptor" -or $_.message -match "Create-MultipleSessions" -or $_.message -match "Invoke-NetworkRelay" -or $_.message -match "Run-EXEonRemote" -or $_.message -match "Invoke-Prasadhak" -or $_.message -match "Invoke-BruteForce" -or $_.message -match "Password-List" -or $_.message -match "Invoke-JSRatRegsvr" -or $_.message -match "Invoke-JSRatRundll" -or $_.message -match "Invoke-PoshRatHttps" -or $_.message -match "Invoke-PowerShellIcmp" -or $_.message -match "Invoke-PowerShellUdp" -or $_.message -match "Invoke-PSGcat" -or $_.message -match "Invoke-PsGcatAgent" -or $_.message -match "Remove-PoshRat" -or $_.message -match "Add-Persistance" -or $_.message -match "ExetoText" -or $_.message -match "Invoke-Decode" -or $_.message -match "Invoke-Encode" -or $_.message -match "Parse_Keys" -or $_.message -match "Remove-Persistence" -or $_.message -match "StringtoBase64" -or $_.message -match "TexttoExe" -or $_.message -match "Powerpreter" -or $_.message -match "Nishang" -or $_.message -match "EncodedData" -or $_.message -match "DataToEncode" -or $_.message -match "LoggedKeys" -or $_.message -match "OUT-DNSTXT" -or $_.message -match "Jitter" -or $_.message -match "ExfilOption" -or $_.message -match "Tamper" -or $_.message -match "DumpCerts" -or $_.message -match "DumpCreds" -or $_.message -match "Shellcode32" -or $_.message -match "Shellcode64" -or $_.message -match "NotAllNameSpaces" -or $_.message -match "exfill" -or $_.message -match "FakeDC" -or $_.message -match "Exploit")) } | select TimeCreated,Id,RecordId,ProcessId,MachineName,Message -``` - - -### es-qs - -``` -\*.keyword:(*Add\-ConstrainedDelegationBackdoor* OR *Set\-DCShadowPermissions* OR *DNS_TXT_Pwnage* OR *Execute\-OnTime* OR *HTTP\-Backdoor* OR *Set\-RemotePSRemoting* OR *Set\-RemoteWMI* OR *Invoke\-AmsiBypass* OR *Out\-CHM* OR *Out\-HTA* OR *Out\-SCF* OR *Out\-SCT* OR *Out\-Shortcut* OR *Out\-WebQuery* OR *Out\-Word* OR *Enable\-Duplication* OR *Remove\-Update* OR *Download\-Execute\-PS* OR *Download_Execute* OR *Execute\-Command\-MSSQL* OR *Execute\-DNSTXT\-Code* OR *Out\-RundllCommand* OR *Copy\-VSS* OR *FireBuster* OR *FireListener* OR *Get\-Information* OR *Get\-PassHints* OR *Get\-WLAN\-Keys* OR *Get\-Web\-Credentials* OR *Invoke\-CredentialsPhish* OR *Invoke\-MimikatzWDigestDowngrade* OR *Invoke\-SSIDExfil* OR *Invoke\-SessionGopher* OR *Keylogger* OR *Invoke\-Interceptor* OR *Create\-MultipleSessions* OR *Invoke\-NetworkRelay* OR *Run\-EXEonRemote* OR *Invoke\-Prasadhak* OR *Invoke\-BruteForce* OR *Password\-List* OR *Invoke\-JSRatRegsvr* OR *Invoke\-JSRatRundll* OR *Invoke\-PoshRatHttps* OR *Invoke\-PowerShellIcmp* OR *Invoke\-PowerShellUdp* OR *Invoke\-PSGcat* OR *Invoke\-PsGcatAgent* OR *Remove\-PoshRat* OR *Add\-Persistance* OR *ExetoText* OR *Invoke\-Decode* OR *Invoke\-Encode* OR *Parse_Keys* OR *Remove\-Persistence* OR *StringtoBase64* OR *TexttoExe* OR *Powerpreter* OR *Nishang* OR *EncodedData* OR *DataToEncode* OR *LoggedKeys* OR *OUT\-DNSTXT* OR *Jitter* OR *ExfilOption* OR *Tamper* OR *DumpCerts* OR *DumpCreds* OR *Shellcode32* OR *Shellcode64* OR *NotAllNameSpaces* OR *exfill* OR *FakeDC* OR *Exploit*) -``` - - -### xpack-watcher - -``` -curl -s -XPUT -H 'Content-Type: application/json' --data-binary @- localhost:9200/_watcher/watch/f772cee9-b7c2-4cb2-8f07-49870adc02e0 <
  • [TA0005: Defense Evasion](https://attack.mitre.org/tactics/TA0005)
    • | -| **ATT&CK Technique** |
    • [T1096: NTFS File Attributes](https://attack.mitre.org/techniques/T1096)
    | -| **Data Needed** |
    • [DN0036_4104_windows_powershell_script_block](../Data_Needed/DN0036_4104_windows_powershell_script_block.md)
    • [DN0037_4103_windows_powershell_executing_pipeline](../Data_Needed/DN0037_4103_windows_powershell_executing_pipeline.md)
    | -| **Trigger** | There is no documented Trigger for this Detection Rule yet | -| **Severity Level** | high | -| **False Positives** |
    • unknown
    | -| **Development Status** | experimental | -| **References** |
    • [http://www.powertheshell.com/ntfsstreams/](http://www.powertheshell.com/ntfsstreams/)
    | -| **Author** | Sami Ruohonen | -| Other Tags |
    • attack.t1564.004
    | - -## Detection Rules - -### Sigma rule - -``` -title: NTFS Alternate Data Stream -id: 8c521530-5169-495d-a199-0a3a881ad24e -status: experimental -description: Detects writing data into NTFS alternate data streams from powershell. Needs Script Block Logging. -references: - - http://www.powertheshell.com/ntfsstreams/ -tags: - - attack.defense_evasion - - attack.t1096 - - attack.t1564.004 -author: Sami Ruohonen -date: 2018/07/24 -logsource: - product: windows - service: powershell - definition: 'It is recommended to use the new "Script Block Logging" of PowerShell v5 https://adsecurity.org/?p=2277' -detection: - keyword1: - - "set-content" - - "add-content" - keyword2: - - "-stream" - condition: keyword1 and keyword2 -falsepositives: - - unknown -level: high - -``` - - - - - -### powershell - -``` -Get-WinEvent -LogName Microsoft-Windows-PowerShell/Operational | where {(($_.message -match "set-content" -or $_.message -match "add-content") -and $_.message -match "-stream") } | select TimeCreated,Id,RecordId,ProcessId,MachineName,Message -``` - - -### es-qs - -``` -(\*.keyword:(*set\-content* OR *add\-content*) AND "\-stream") -``` - - -### xpack-watcher - -``` -curl -s -XPUT -H 'Content-Type: application/json' --data-binary @- localhost:9200/_watcher/watch/8c521530-5169-495d-a199-0a3a881ad24e <
  • [TA0002: Execution](https://attack.mitre.org/tactics/TA0002)
  • [TA0006: Credential Access](https://attack.mitre.org/tactics/TA0006)
    • | -| **ATT&CK Technique** |
    • [T1086: PowerShell](https://attack.mitre.org/techniques/T1086)
    | -| **Data Needed** | There is no documented Data Needed for this Detection Rule yet | -| **Trigger** | There is no documented Trigger for this Detection Rule yet | -| **Severity Level** | high | -| **False Positives** |
    • Unknown
    | -| **Development Status** | experimental | -| **References** |
    • [https://twitter.com/JohnLaTwC/status/850381440629981184](https://twitter.com/JohnLaTwC/status/850381440629981184)
    • [https://t.co/ezOTGy1a1G](https://t.co/ezOTGy1a1G)
    | -| **Author** | John Lambert (idea), Florian Roth (rule) | -| Other Tags |
    • attack.t1059.001
    | - -## Detection Rules - -### Sigma rule - -``` -title: PowerShell Credential Prompt -id: ca8b77a9-d499-4095-b793-5d5f330d450e -status: experimental -description: Detects PowerShell calling a credential prompt -references: - - https://twitter.com/JohnLaTwC/status/850381440629981184 - - https://t.co/ezOTGy1a1G -tags: - - attack.execution - - attack.credential_access - - attack.t1086 - - attack.t1059.001 -author: John Lambert (idea), Florian Roth (rule) -date: 2017/04/09 -logsource: - product: windows - service: powershell - definition: 'Script block logging must be enabled' -detection: - selection: - EventID: 4104 - keyword: - Message: - - '*PromptForCredential*' - condition: all of them -falsepositives: - - Unknown -level: high - -``` - - - - - -### powershell - -``` -Get-WinEvent -LogName Microsoft-Windows-PowerShell/Operational | where {($_.ID -eq "4104" -and ($_.message -match "Message.*.*PromptForCredential.*")) } | select TimeCreated,Id,RecordId,ProcessId,MachineName,Message -``` - - -### es-qs - -``` -(winlog.event_id:"4104" AND Message.keyword:(*PromptForCredential*)) -``` - - -### xpack-watcher - -``` -curl -s -XPUT -H 'Content-Type: application/json' --data-binary @- localhost:9200/_watcher/watch/ca8b77a9-d499-4095-b793-5d5f330d450e <
  • [TA0002: Execution](https://attack.mitre.org/tactics/TA0002)
    • | -| **ATT&CK Technique** |
    • [T1086: PowerShell](https://attack.mitre.org/techniques/T1086)
    | -| **Data Needed** | There is no documented Data Needed for this Detection Rule yet | -| **Trigger** | There is no documented Trigger for this Detection Rule yet | -| **Severity Level** | high | -| **False Positives** |
    • Pentesters
    | -| **Development Status** | experimental | -| **References** |
    • [https://adsecurity.org/?p=2921](https://adsecurity.org/?p=2921)
    | -| **Author** | Sean Metcalf (source), Florian Roth (rule) | -| Other Tags |
    • attack.t1059.001
    | - -## Detection Rules - -### Sigma rule - -``` -title: PowerShell PSAttack -id: b7ec41a4-042c-4f31-a5db-d0fcde9fa5c5 -status: experimental -description: Detects the use of PSAttack PowerShell hack tool -references: - - https://adsecurity.org/?p=2921 -tags: - - attack.execution - - attack.t1086 - - attack.t1059.001 -author: Sean Metcalf (source), Florian Roth (rule) -date: 2017/03/05 -logsource: - product: windows - service: powershell - definition: 'It is recommended to use the new "Script Block Logging" of PowerShell v5 https://adsecurity.org/?p=2277' -detection: - selection: - EventID: 4103 - keyword: - - 'PS ATTACK!!!' - condition: all of them -falsepositives: - - Pentesters -level: high - -``` - - - - - -### powershell - -``` -Get-WinEvent -LogName Microsoft-Windows-PowerShell/Operational | where {($_.ID -eq "4103" -and $_.message -match "PS ATTACK!!!") } | select TimeCreated,Id,RecordId,ProcessId,MachineName,Message -``` - - -### es-qs - -``` -(winlog.event_id:"4103" AND "PS\ ATTACK\!\!\!") -``` - - -### xpack-watcher - -``` -curl -s -XPUT -H 'Content-Type: application/json' --data-binary @- localhost:9200/_watcher/watch/b7ec41a4-042c-4f31-a5db-d0fcde9fa5c5 <
  • [TA0002: Execution](https://attack.mitre.org/tactics/TA0002)
    • | -| **ATT&CK Technique** |
    • [T1086: PowerShell](https://attack.mitre.org/techniques/T1086)
    | -| **Data Needed** | There is no documented Data Needed for this Detection Rule yet | -| **Trigger** | There is no documented Trigger for this Detection Rule yet | -| **Severity Level** | high | -| **False Positives** |
    • Legitimate use remote PowerShell sessions
    | -| **Development Status** | experimental | -| **References** |
    • [https://github.com/Cyb3rWard0g/ThreatHunter-Playbook/tree/master/playbooks/windows/02_execution/T1086_powershell/powershell_remote_session.md](https://github.com/Cyb3rWard0g/ThreatHunter-Playbook/tree/master/playbooks/windows/02_execution/T1086_powershell/powershell_remote_session.md)
    | -| **Author** | Roberto Rodriguez @Cyb3rWard0g | -| Other Tags |
    • attack.t1059.001
    | - -## Detection Rules - -### Sigma rule - -``` -title: Remote PowerShell Session -id: 96b9f619-aa91-478f-bacb-c3e50f8df575 -description: Detects remote PowerShell sessions -status: experimental -date: 2019/08/10 -modified: 2019/11/10 -author: Roberto Rodriguez @Cyb3rWard0g -references: - - https://github.com/Cyb3rWard0g/ThreatHunter-Playbook/tree/master/playbooks/windows/02_execution/T1086_powershell/powershell_remote_session.md -tags: - - attack.execution - - attack.t1086 - - attack.t1059.001 -logsource: - product: windows - service: powershell -detection: - selection: - EventID: - - 4103 - - 400 - HostName: 'ServerRemoteHost' - HostApplication|contains: 'wsmprovhost.exe' - condition: selection -falsepositives: - - Legitimate use remote PowerShell sessions -level: high - -``` - - - - - -### powershell - -``` -Get-WinEvent -LogName Microsoft-Windows-PowerShell/Operational | where {(($_.ID -eq "4103" -or $_.ID -eq "400") -and $_.message -match "HostName.*ServerRemoteHost" -and $_.message -match "HostApplication.*.*wsmprovhost.exe.*") } | select TimeCreated,Id,RecordId,ProcessId,MachineName,Message -``` - - -### es-qs - -``` -(winlog.event_id:("4103" OR "400") AND HostName:"ServerRemoteHost" AND HostApplication.keyword:*wsmprovhost.exe*) -``` - - -### xpack-watcher - -``` -curl -s -XPUT -H 'Content-Type: application/json' --data-binary @- localhost:9200/_watcher/watch/96b9f619-aa91-478f-bacb-c3e50f8df575 <
  • [TA0004: Privilege Escalation](https://attack.mitre.org/tactics/TA0004)
  • [TA0002: Execution](https://attack.mitre.org/tactics/TA0002)
    • | -| **ATT&CK Technique** |
    • [T1055: Process Injection](https://attack.mitre.org/techniques/T1055)
    • [T1086: PowerShell](https://attack.mitre.org/techniques/T1086)
    • [T1059: Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059)
    | -| **Data Needed** | There is no documented Data Needed for this Detection Rule yet | -| **Trigger** |
    • [T1055: Process Injection](../Triggers/T1055.md)
    | -| **Severity Level** | critical | -| **False Positives** |
    • Unknown
    | -| **Development Status** | experimental | -| **References** |
    • [https://twitter.com/cyb3rops/status/1063072865992523776](https://twitter.com/cyb3rops/status/1063072865992523776)
    | -| **Author** | David Ledbetter (shellcode), Florian Roth (rule) | - - -## Detection Rules - -### Sigma rule - -``` -title: PowerShell ShellCode -id: 16b37b70-6fcf-4814-a092-c36bd3aafcbd -status: experimental -description: Detects Base64 encoded Shellcode -references: - - https://twitter.com/cyb3rops/status/1063072865992523776 -tags: - - attack.privilege_escalation - - attack.execution - - attack.t1055 - - attack.t1086 - - attack.t1059 -author: David Ledbetter (shellcode), Florian Roth (rule) -date: 2018/11/17 -logsource: - product: windows - service: powershell - description: 'Script block logging must be enabled' -detection: - selection: - EventID: 4104 - keyword1: - - '*AAAAYInlM*' - keyword2: - - '*OiCAAAAYInlM*' - - '*OiJAAAAYInlM*' - condition: selection and keyword1 and keyword2 -falsepositives: - - Unknown -level: critical - -``` - - - - - -### powershell - -``` -Get-WinEvent -LogName Microsoft-Windows-PowerShell/Operational | where {(($_.ID -eq "4104" -and $_.message -match "*AAAAYInlM*") -and ($_.message -match "*OiCAAAAYInlM*" -or $_.message -match "*OiJAAAAYInlM*")) } | select TimeCreated,Id,RecordId,ProcessId,MachineName,Message -``` - - -### es-qs - -``` -((winlog.event_id:"4104" AND "*AAAAYInlM*") AND \*.keyword:(*OiCAAAAYInlM* OR *OiJAAAAYInlM*)) -``` - - -### xpack-watcher - -``` -curl -s -XPUT -H 'Content-Type: application/json' --data-binary @- localhost:9200/_watcher/watch/16b37b70-6fcf-4814-a092-c36bd3aafcbd <
  • [TA0002: Execution](https://attack.mitre.org/tactics/TA0002)
    • | -| **ATT&CK Technique** |
    • [T1086: PowerShell](https://attack.mitre.org/techniques/T1086)
    | -| **Data Needed** | There is no documented Data Needed for this Detection Rule yet | -| **Trigger** | There is no documented Trigger for this Detection Rule yet | -| **Severity Level** | medium | -| **False Positives** |
    • PowerShell scripts that download content from the Internet
    | -| **Development Status** | experimental | -| **References** | There are no documented References for this Detection Rule yet | -| **Author** | Florian Roth | -| Other Tags |
    • attack.t1059.001
    | - -## Detection Rules - -### Sigma rule - -``` -title: Suspicious PowerShell Download -id: 65531a81-a694-4e31-ae04-f8ba5bc33759 -status: experimental -description: Detects suspicious PowerShell download command -tags: - - attack.execution - - attack.t1086 - - attack.t1059.001 -author: Florian Roth -date: 2017/03/05 -modified: 2020/03/25 -logsource: - product: windows - service: powershell -detection: - downloadfile: - Message|contains|all: - - 'System.Net.WebClient' - - '.DownloadFile(' - downloadstring: - Message|contains|all: - - 'System.Net.WebClient' - - '.DownloadString(' - condition: downloadfile or downloadstring -falsepositives: - - PowerShell scripts that download content from the Internet -level: medium - -``` - - - - - -### powershell - -``` -Get-WinEvent -LogName Microsoft-Windows-PowerShell/Operational | where {($_.message -match "Message.*.*System.Net.WebClient.*" -and ($_.message -match "Message.*.*.DownloadFile(.*" -or $_.message -match "Message.*.*.DownloadString(.*")) } | select TimeCreated,Id,RecordId,ProcessId,MachineName,Message -``` - - -### es-qs - -``` -(Message.keyword:*System.Net.WebClient* AND (Message.keyword:*.DownloadFile\(* OR Message.keyword:*.DownloadString\(*)) -``` - - -### xpack-watcher - -``` -curl -s -XPUT -H 'Content-Type: application/json' --data-binary @- localhost:9200/_watcher/watch/65531a81-a694-4e31-ae04-f8ba5bc33759 <
  • [TA0002: Execution](https://attack.mitre.org/tactics/TA0002)
    • | -| **ATT&CK Technique** |
    • [T1086: PowerShell](https://attack.mitre.org/techniques/T1086)
    | -| **Data Needed** |
    • [DN0036_4104_windows_powershell_script_block](../Data_Needed/DN0036_4104_windows_powershell_script_block.md)
    • [DN0037_4103_windows_powershell_executing_pipeline](../Data_Needed/DN0037_4103_windows_powershell_executing_pipeline.md)
    | -| **Trigger** | There is no documented Trigger for this Detection Rule yet | -| **Severity Level** | high | -| **False Positives** |
    • Penetration tests
    • Very special / sneaky PowerShell scripts
    | -| **Development Status** | experimental | -| **References** | There are no documented References for this Detection Rule yet | -| **Author** | Florian Roth (rule) | -| Other Tags |
    • attack.t1059.001
    | - -## Detection Rules - -### Sigma rule - -``` -title: Suspicious PowerShell Invocations - Generic -id: 3d304fda-78aa-43ed-975c-d740798a49c1 -status: experimental -description: Detects suspicious PowerShell invocation command parameters -tags: - - attack.execution - - attack.t1086 - - attack.t1059.001 -author: Florian Roth (rule) -date: 2017/03/12 -logsource: - product: windows - service: powershell -detection: - encoded: - - ' -enc ' - - ' -EncodedCommand ' - hidden: - - ' -w hidden ' - - ' -window hidden ' - - ' -windowstyle hidden ' - noninteractive: - - ' -noni ' - - ' -noninteractive ' - condition: all of them -falsepositives: - - Penetration tests - - Very special / sneaky PowerShell scripts -level: high - -``` - - - - - -### powershell - -``` -Get-WinEvent -LogName Microsoft-Windows-PowerShell/Operational | where {(($_.message -match " -enc " -or $_.message -match " -EncodedCommand ") -and ($_.message -match " -w hidden " -or $_.message -match " -window hidden " -or $_.message -match " -windowstyle hidden ") -and ($_.message -match " -noni " -or $_.message -match " -noninteractive ")) } | select TimeCreated,Id,RecordId,ProcessId,MachineName,Message -``` - - -### es-qs - -``` -(\*.keyword:(*\ \-enc\ * OR *\ \-EncodedCommand\ *) AND \*.keyword:(*\ \-w\ hidden\ * OR *\ \-window\ hidden\ * OR *\ \-windowstyle\ hidden\ *) AND \*.keyword:(*\ \-noni\ * OR *\ \-noninteractive\ *)) -``` - - -### xpack-watcher - -``` -curl -s -XPUT -H 'Content-Type: application/json' --data-binary @- localhost:9200/_watcher/watch/3d304fda-78aa-43ed-975c-d740798a49c1 <