From 2e8b6e4898abb53db1e8d6398e0f8c84be3ff55e Mon Sep 17 00:00:00 2001 From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com> Date: Thu, 18 Feb 2021 10:56:24 -0700 Subject: [PATCH] Add datamodel field to yml --- detections/endpoint/detect_html_help_renamed.yml | 1 + detections/endpoint/detect_html_help_spawn_child_process.yml | 2 ++ detections/endpoint/detect_html_help_url_in_command_line.yml | 2 ++ .../detect_html_help_using_infotech_storage_handlers.yml | 2 ++ detections/endpoint/detect_regasm_spawning_a_process.yml | 2 ++ detections/endpoint/detect_regsvcs_spawning_a_process.yml | 2 ++ 6 files changed, 11 insertions(+) diff --git a/detections/endpoint/detect_html_help_renamed.yml b/detections/endpoint/detect_html_help_renamed.yml index 9a14f00551..bbb45f9eeb 100644 --- a/detections/endpoint/detect_html_help_renamed.yml +++ b/detections/endpoint/detect_html_help_renamed.yml @@ -18,6 +18,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed hh.exe may be used. type: batch +datamodel: [] references: - https://attack.mitre.org/techniques/T1218/001/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md diff --git a/detections/endpoint/detect_html_help_spawn_child_process.yml b/detections/endpoint/detect_html_help_spawn_child_process.yml index ba322b8ecd..a955571928 100644 --- a/detections/endpoint/detect_html_help_spawn_child_process.yml +++ b/detections/endpoint/detect_html_help_spawn_child_process.yml @@ -12,6 +12,8 @@ how_to_implement: To successfully implement this search you need to be ingesting on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. type: batch +datamodel: +- Endpoint references: - https://attack.mitre.org/techniques/T1218/001/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md diff --git a/detections/endpoint/detect_html_help_url_in_command_line.yml b/detections/endpoint/detect_html_help_url_in_command_line.yml index a51807977e..61dbf860d2 100644 --- a/detections/endpoint/detect_html_help_url_in_command_line.yml +++ b/detections/endpoint/detect_html_help_url_in_command_line.yml @@ -14,6 +14,8 @@ how_to_implement: To successfully implement this search you need to be ingesting on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. type: batch +datamodel: +- Endpoint references: - https://attack.mitre.org/techniques/T1218/001/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md diff --git a/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml b/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml index ada05bd0d3..e1e51fc74e 100644 --- a/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml +++ b/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml @@ -19,6 +19,8 @@ how_to_implement: To successfully implement this search you need to be ingesting on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. type: batch +datamodel: +- Endpoint references: - https://attack.mitre.org/techniques/T1218/001/ - https://www.kb.cert.org/vuls/id/851869 diff --git a/detections/endpoint/detect_regasm_spawning_a_process.yml b/detections/endpoint/detect_regasm_spawning_a_process.yml index 0f4e172be2..fc17561571 100644 --- a/detections/endpoint/detect_regasm_spawning_a_process.yml +++ b/detections/endpoint/detect_regasm_spawning_a_process.yml @@ -14,6 +14,8 @@ how_to_implement: To successfully implement this search you need to be ingesting on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. type: batch +datamodel: +- Endpoint references: - https://attack.mitre.org/techniques/T1218/009/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.009/T1218.009.md diff --git a/detections/endpoint/detect_regsvcs_spawning_a_process.yml b/detections/endpoint/detect_regsvcs_spawning_a_process.yml index 0f857c82b2..ac3de23dbb 100644 --- a/detections/endpoint/detect_regsvcs_spawning_a_process.yml +++ b/detections/endpoint/detect_regsvcs_spawning_a_process.yml @@ -14,6 +14,8 @@ how_to_implement: To successfully implement this search you need to be ingesting on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. type: batch +datamodel: +- Endpoint references: - https://attack.mitre.org/techniques/T1218/009/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.009/T1218.009.md